<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:AngsanaUPC;
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Georgia","serif";
color:#002060;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Georgia","serif";
color:#002060;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Thanks Brian for your nice findings.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#17365D">Sincerely Yours<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#365F91">-------------------------------------------------------<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:#365F91">Md. Mahbubul Alam
<b>Reyad</b><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">Assistant Manager<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">CORE-IP Network || Technology<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">Cell: +880 1976672281 || Skype: new_reyad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><a href="http://www.qubee.com.bd/"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">www.qubee.com.bd</span></a></span><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Tahoma","sans-serif";color:gray">T +88 02 8812113 || F +88 02 8812115<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:AngsanaUPC;color:#D99594"><img border="0" width="103" height="31" id="Picture_x0020_1" src="cid:image001.jpg@01D14612.C8A9C560" alt="Description: Description: logo-02"></span><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> Brian Candler [mailto:brian@nsrc.org]
<br>
<b>Sent:</b> Thursday, December 31, 2015 3:20 PM<br>
<b>To:</b> Md. Mahbubul Alam Reyad; nog@bdnog.org<br>
<b>Subject:</b> Re: [bdNOG] BGP Prefix hijacking<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 31/12/2015 07:31, Md. Mahbubul Alam Reyad wrote:<span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">Hi</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060">I received the following alert mail from bgpmon where one of our (QUBEE) prefix (163.47.76.0/22 ) is announce by an indian ISP. FYN this IP prefix was newly acquired from APNIC
and yet to be announce from QUBEE (AS45951) network.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Georgia","serif";color:#002060"> </span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
It looks like they're not announcing it at the moment. Here are some useful test sites<br>
<br>
* <a href="http://bgp.he.net/">http://bgp.he.net/</a><br>
<br>
Search by IP address or AS number. It doesn't see anything for 163.47.76.0/22<br>
<br>
* Other looking glasses, e.g. telnet route-views.oregon-ix.net<br>
<br>
This shows no route (only default) matching that address<br>
<br>
route-views>sh ip bgp 163.47.76.0<br>
BGP routing table entry for 0.0.0.0/0, version 8805302<br>
Paths: (4 available, best #4, table default, RIB-failure(17))<br>
Not advertised to any peer<br>
Refresh Epoch 1<br>
58901 51167<br>
93.104.209.174 from 93.104.209.174 (93.104.209.174)<br>
Origin IGP, localpref 100, valid, external<br>
rx pathid: 0, tx pathid: 0<br>
Refresh Epoch 1<br>
58443 45177<br>
103.255.249.22 from 103.255.249.22 (103.255.249.250)<br>
Origin IGP, localpref 100, valid, external<br>
rx pathid: 0, tx pathid: 0<br>
Refresh Epoch 1<br>
20771 1299<br>
80.241.176.31 from 80.241.176.31 (80.241.176.30)<br>
Origin IGP, localpref 100, valid, external<br>
rx pathid: 0, tx pathid: 0<br>
Refresh Epoch 1<br>
58511 2764<br>
103.247.3.45 from 103.247.3.45 (103.247.3.45)<br>
Origin IGP, localpref 100, valid, external, best<br>
rx pathid: 0, tx pathid: 0x0<br>
route-views><br>
<br>
* <a href="https://stat.ripe.net/">https://stat.ripe.net/</a><br>
which will take you to<br>
<a href="https://stat.ripe.net/widget/routing-history">https://stat.ripe.net/widget/routing-history</a><br>
<br>
This shows a full history of announcements, and I can only see that route being announced up to March 2012.<br>
<br>
You could also try the older site <a href="http://bgplay.routeviews.org/">http://bgplay.routeviews.org/</a> (needs Java I think)<br>
<br>
So... it seems to me that if AS131788 is really announcing your route, it's probably being filtered before the rest of the Internet sees it. Or maybe it was just a temporary glitch.<br>
<br>
I note from<br>
<a href="http://bgp.he.net/AS131788">http://bgp.he.net/AS131788</a><br>
that it says they are also announcing bogons :-(<br>
<br>
Regards,<br>
<br>
Brian.<o:p></o:p></span></p>
</div>
</body>
</html>