[anti-abuse-wg] Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud

A quick update to an old thread.

http://krebsonsecurity.com/2016/06/fbi-raids-spammer-outed-by-krebsonsecurity/

—srs

> On 07-Nov-2014, at 12:54 AM, Ronald F. Guilmette <rfg at tristatelogic.com> wrote:
> 
> 
> In message <8F1040D0-94EA-47DC-97DD-027F186F2B12 at nickshorey.com>, 
> Nick Shorey <nick at nickshorey.com> wrote:
> 
>> These are really interesting discussions so please keep me updated on
>> progress against these rogue ASNs.
> 
> Progress??
> 
> I'll give you an update, but it hardly represents anything that could
> be called ``progress''.
> 
> As of today, AS201640 is still squatting on these same 11 routes:
> 
> 36.0.56.0/21
> 41.92.206.0/23
> 41.198.80.0/20
> 41.198.224.0/20
> 61.242.128.0/19
> 119.227.224.0/19
> 123.29.96.0/19
> 177.22.117.0/24
> 177.46.48.0/22
> 187.189.158.0/23
> 202.39.112.0/20
> 
> If you check back in a month or two, perhaps one or more of the networks
> that provides connectivity to AS201640's upstream, i.e. AS200002, may
> have finally taken its head out of its ass and done something about
> this ridiculously blatant case, but I wouldn't hold my breath if I
> were you.
> 
> 
> Regards,
> rfg
> 
> 
> P.S.  Of course, it would be Nice if RIPE NCC eventually terminated
> the registration of AS201640.  I think that's their only reasonable
> course of action, long term.  But as is often noted, they are not the
> routing police, and even if they did so today or tomorrow, there would
> still be all these bogus route announcements being propagated to the
> far corners of the earth.  The announcements would all then just be
> attached to an AS number that isn't in the RIPE DB anymore.  But as
> far as I know, the announcements would still flow anyway.  (I feel
> sure that somebody here will correct me if I'm wrong about that.)
> 
> Its the network operators who need to put a stop to this over-the-top
> ludicrous situation.  And so far, not a single one is stepping up to do
> that.
>