[anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552
- Previous message (by thread): [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552
- Next message (by thread): [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Richard Clayton
richard at highwayman.com
Mon Nov 30 11:05:37 CET 2020
In message <d3230863-c17a-7fe7-e7b6-c0742bcdadfb at tana.it>, Alessandro Vesely <vesely at tana.it> writes >> These blocks appear to be mostly or entirely very old "legacy" block, >> primarily from the ARIN region. > > >Only a few of them are listed on https://www.spamhaus.org/drop/ Spamhaus have built that table from what they know of previous hijacking events (because they observed that there was some repetition in the prefixes that the hijackers chose). So announcing a prefix that is on that list is not a good sign (indeed far from it) -- but don't expect a "new" hijacker to only choose from that list or indeed to pick any prefixes from that list at all. -- Dr Richard Clayton <richard.clayton at cl.cam.ac.uk> Director, Cambridge Cybercrime Centre mobile: +44 (0)7887 794090 Computer Laboratory, University of Cambridge, CB3 0FD tel: +44 (0)1223 763570 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 185 bytes Desc: not available URL: <https://lists.ripe.net/ripe/mail/archives/anti-abuse-wg/attachments/20201130/c4f93658/attachment.sig>
- Previous message (by thread): [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552
- Next message (by thread): [anti-abuse-wg] IPv4 squatting -- Courtesy of AS44050, AS58552
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]