<div dir="ltr">Additionally I looked at <span style="font-size:12.8px">AS44050 looking glass <a href="http://lg.pinspb.ru/">here</a>. </span><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><div style=""><font size="1" face="monospace, monospace">Router: PIN-SPB-ASR9001-CORE </font></div><div style=""><font size="1" face="monospace, monospace">Command: show bgp ipv4 unicast regexp 131788$</font></div><div style=""><font size="1" face="monospace, monospace"><br></font></div><div style=""><font size="1" face="monospace, monospace"><br></font></div><div style=""><font size="1" face="monospace, monospace">Thu Dec 31 12:45:53.169 MSK</font></div><div style=""><font size="1" face="monospace, monospace">BGP router identifier 95.215.3.1, local AS number 65221</font></div><div style=""><font size="1" face="monospace, monospace">BGP generic scan interval 60 secs</font></div><div style=""><font size="1" face="monospace, monospace">BGP table state: Active</font></div><div style=""><font size="1" face="monospace, monospace">Table ID: 0xe0000000 RD version: 246514823</font></div><div style=""><font size="1" face="monospace, monospace">BGP main routing table version 246514823</font></div><div style=""><font size="1" face="monospace, monospace">BGP scan interval 60 secs</font></div><div style=""><font size="1" face="monospace, monospace"><br></font></div><div style=""><font size="1" face="monospace, monospace">Status codes: s suppressed, d damped, h history, * valid, > best</font></div><div style=""><font size="1" face="monospace, monospace"> i - internal, r RIB-failure, S stale, N Nexthop-discard</font></div><div style=""><font size="1" face="monospace, monospace">Origin codes: i - IGP, e - EGP, ? - incomplete</font></div><div style=""><font size="1" face="monospace, monospace"> Network Next Hop Metric LocPrf Weight Path</font></div><div style=""><font size="1" face="monospace, monospace">*> <a href="http://203.23.51.0/24">203.23.51.0/24</a> 95.215.3.78 0 500 131788 i</font></div><div style=""><font size="1" face="monospace, monospace"><br></font></div><div style=""><font size="1" face="monospace, monospace">Processed 1 prefixes, 1 paths</font></div></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px">So that old route is removed but still a new/weird AS</span><span style="font-size:12.8px">131788 route is visible. Hard to believe </span><span style="font-size:12.8px"><a href="http://203.23.51.0/24">203.23.51.0/24</a> is allocated over there. So ASN and prefix hijacked for purpose of spamming or something like that. </span></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px"><br></span></div><div style=""><span style="font-size:12.8px">Thanks. </span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 31, 2015 at 2:59 PM, Anurag Bhatia <span dir="ltr"><<a href="mailto:me@anuragbhatia.com" target="_blank">me@anuragbhatia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Dear Mahbubul<div><br></div><div><br></div><div><br></div><div><br></div><div>I think this is not BGP prefix hijack based on the aspath in bgpmon alert. </div><span class=""><div><br></div><div><br></div><div>1103 286 9002 44050 131788<br></div><div><br></div><div><br></div></span><div>Shows AS 131788 is announcing to AS44050 and beyond. Except origin AS none of other AS belongs to any Indian telco and I am sure AS 44050 transit is not available in India. :)</div><div><br></div><div>Hence, I think AS131788 has not hijacked prefix but it's rather a case where an ASN has been hijacked and is being used to announce fishy routes. </div><div><br></div><div><br></div><div><a href="http://bgp.he.net/AS131788#_graph4" target="_blank">http://bgp.he.net/AS131788#_graph4</a><br></div><div><br></div><div><br></div><div>Shows the relations. </div><div><br></div><div><br></div><div>Anyways, will wait to hear back from AS131788 (though I think they haven't done any misconfig at their end). </div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Thu, Dec 31, 2015 at 2:31 PM, Scott Weeks <span dir="ltr"><<a href="mailto:surfer@mauigateway.com" target="_blank">surfer@mauigateway.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span><br>
<br>
On Thu, Dec 31, 2015 at 1:31 PM, Md. Mahbubul Alam Reyad<br>
<<a href="mailto:mahbubul.reyad@qubee.com.bd" target="_blank">mahbubul.reyad@qubee.com.bd</a>> wrote:<br>
<br>
</span><span>> I received the following alert mail from bgpmon where one of our (QUBEE)<br>
> prefix (<a href="http://163.47.76.0/22" rel="noreferrer" target="_blank">163.47.76.0/22</a> ) is announce by an indian ISP. FYN this IP<br>
> prefix was newly acquired from APNIC and yet to be announce from QUBEE<br>
> (AS45951) network.<br>
</span>--------------------------------<br>
<br>
<br>
--- <a href="mailto:kzobair@gmail.com" target="_blank">kzobair@gmail.com</a> wrote:<br>
From: "Md. Zobair Khan" <<a href="mailto:kzobair@gmail.com" target="_blank">kzobair@gmail.com</a>><br>
<span><br>
You can send an email to that ISP querying about this possible hijack.<br>
Other than that, there is no big primary steps. If the ISP doesn't reply<br>
you back with suitable answers, then you can communicate with their<br>
upstream to filter these routes from that ISP, since it is your prefix.<br>
</span>---------------------------------<br>
<br>
<br>
<br>
You could also email their upstream providers and ask<br>
them to properly filter their customers. The upstream<br>
providers should allow the ISP to only announce the<br>
prefixes they're supposed to announce.<br>
<span><font color="#888888"><br>
scott<br>
</font></span><div><div><br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
><br>
> _______________________________________________<br>
> nog mailing list<br>
> <a href="mailto:nog@bdnog.org" target="_blank">nog@bdnog.org</a><br>
> <a href="http://mailman.bdnog.org/mailman/listinfo/nog" rel="noreferrer" target="_blank">http://mailman.bdnog.org/mailman/listinfo/nog</a><br>
><br>
><br>
<br>
<br>
_______________________________________________<br>
nog mailing list<br>
<a href="mailto:nog@bdnog.org" target="_blank">nog@bdnog.org</a><br>
<a href="http://mailman.bdnog.org/mailman/listinfo/nog" rel="noreferrer" target="_blank">http://mailman.bdnog.org/mailman/listinfo/nog</a><br>
<br>
<br>
_______________________________________________<br>
nog mailing list<br>
<a href="mailto:nog@bdnog.org" target="_blank">nog@bdnog.org</a><br>
<a href="http://mailman.bdnog.org/mailman/listinfo/nog" rel="noreferrer" target="_blank">http://mailman.bdnog.org/mailman/listinfo/nog</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br><div><div dir="ltr"><div><div dir="ltr"><div><font face="arial, helvetica, sans-serif"><br></font></div><div><br></div><font face="arial, helvetica, sans-serif">Anurag Bhatia<br></font><div></div><div><font face="arial, helvetica, sans-serif"><a href="http://anuragbhatia.com" target="_blank">anuragbhatia.com</a></font><div><br></div></div><div><font face="arial, helvetica, sans-serif"><a><br></a></font></div><div>PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2</div></div></div></div></div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><font face="arial, helvetica, sans-serif"><br></font></div><div><br></div><font face="arial, helvetica, sans-serif">Anurag Bhatia<br></font><div></div><div><font face="arial, helvetica, sans-serif"><a href="http://anuragbhatia.com" target="_blank">anuragbhatia.com</a></font><div><br></div></div><div><font face="arial, helvetica, sans-serif"><a><br></a></font></div><div>PGP Key Fingerprint: 3115 677D 2E94 B696 651B 870C C06D D524 245E 58E2</div></div></div></div></div>
</div>