<div dir="ltr">Hi Reyad Vai,<div><br></div><div><br></div><div>You can send an email to that ISP querying about this possible hijack. Other than that, there is no big primary steps. If the ISP doesn't reply you back with suitable answers, then you can communicate with their upstream to filter these routes from that ISP, since it is your prefix.</div><div><br></div><div><br></div><div>BR<br>Zobair</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 31, 2015 at 1:31 PM, Md. Mahbubul Alam Reyad <span dir="ltr"><<a href="mailto:mahbubul.reyad@qubee.com.bd" target="_blank">mahbubul.reyad@qubee.com.bd</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Hi<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">I received the following alert mail from bgpmon where one of our (QUBEE) prefix (<a href="http://163.47.76.0/22" target="_blank">163.47.76.0/22</a> ) is announce by an indian ISP. FYN this IP prefix was newly acquired from APNIC
and yet to be announce from QUBEE (AS45951) network.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">====================================================================<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">RPKI Validation Failed (Code: 9)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">====================================================================<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Your prefix: <a href="http://163.47.76.0/22" target="_blank">163.47.76.0/22</a>:
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Prefix Description: Augere BD IP Prefix
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Update time: 2015-12-31 03:14 (UTC)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Detected by #peers: 41<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Detected prefix: <a href="http://163.47.76.0/22" target="_blank">163.47.76.0/22</a>
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Announced by: AS131788 (FUTURINT-IN -- FUTURISTIC INTERNET SERVICES PRIVATE LIMITED)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Upstream AS: AS44050 (Petersburg Internet Network ltd.)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">ASpath: 1103 286 9002 44050 131788
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Alert details: <a href="https://portal.bgpmon.net/alerts.php?details&alert_id=58623617" target="_blank">https://portal.bgpmon.net/alerts.php?details&alert_id=58623617</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Mark as false alert: <a href="https://portal.bgpmon.net/fp.php?aid=58623617" target="_blank">https://portal.bgpmon.net/fp.php?aid=58623617</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">RPKI Status: ROA validation failed: Invalid Origin ASN, expected 45951
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">====================================================================<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Withdraw of Prefix (Code: 97)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">====================================================================<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Your prefix: <a href="http://163.47.76.0/22" target="_blank">163.47.76.0/22</a>:
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Prefix Description: Augere BD IP Prefix
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Update time: 2015-12-31 03:14 (UTC)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Detected by #peers: 46<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Detected prefix: <a href="http://163.47.76.0/22" target="_blank">163.47.76.0/22</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">May be the upstreams of that ISP are not validating RPKI. What measure should I take for this?
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#17365d">Sincerely Yours<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#365f91">-------------------------------------------------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#365f91">Md. Mahbubul Alam
<b>Reyad</b><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">Assistant Manager<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">CORE-IP Network || Technology<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">Cell: <a href="tel:%2B880%201976672281" value="+8801976672281" target="_blank">+880 1976672281</a> || Skype: new_reyad<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#002060"><a href="http://www.qubee.com.bd/" target="_blank"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">www.qubee.com.bd</span></a></span><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">T <a href="tel:%2B88%2002%208812113" value="+88028812113" target="_blank">+88 02 8812113</a> || F <a href="tel:%2B88%2002%208812115" value="+88028812115" target="_blank">+88 02 8812115</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"AngsanaUPC","serif";color:#d99594"><img border="0" width="103" height="31" src="cid:image001.jpg@01D143CA.2906A090" alt="Description: Description: logo-02"></span><span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#002060"><u></u> <u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>_______________________________________________<br>
nog mailing list<br>
<a href="mailto:nog@bdnog.org">nog@bdnog.org</a><br>
<a href="http://mailman.bdnog.org/mailman/listinfo/nog" rel="noreferrer" target="_blank">http://mailman.bdnog.org/mailman/listinfo/nog</a><br>
<br></blockquote></div><br></div>