[arin-ppml] Hijackings

[Ted Mittelstaedt]

On 4/25/2011 4:04 PM, Ronald F. Guilmette wrote:
>
> Eleven days ago, I reported a set of apparent IP and ASN block hijackings
> to the NANOG mailing list:
>
>    http://mailman.nanog.org/pipermail/nanog/2011-April/035235.html
>
> At the time, I had what now appears to have been a naive belief that
> since John Curran reads the traffic on that list, that the self-evidenly
> no-longer-valid ARIN WHOIS records for the relevant IP blocks and ASNs
> would be withdrawn or corrected in short order.
>
> Well, as I say, that appears to have been naive on my part.
>
> So anyway, just to make sure that the message gets through, I am reposting
> here a list of the stuff that has been hijacked, and for which ARIN's WHOIS
> data base currently (still) contains invalid records which to not reflect
> current reality:
>
> S8143
> AS29987
> AS11756
> AS47024
> AS27906 (LACNIC)
>
> 198.23.32.0/20 - NET-198-23-32-0-1
> 198.57.64.0/20 - NET-198-57-64-0-1
> 199.88.32.0/20 - NET-199-88-32-0-1
> 199.192.16.0/20 - NET-199-192-16-0-1
> 199.196.192.0/19 - NET-199-196-192-0-1
> 200.107.216.0/21 - (LACNIC)
> 204.147.240.0/20 - NET-204-147-240-0-1
> 207.22.224.0/19 - (NET-207-22-192-0-1
>
> It is my hope that the various records indicated above will be withdrawn
> from ARIN's WHOIS data base in the near future.
>

John Curran,

   Could you check with ARIN staff and see if the POC's that are
referenced by those address blocks passed the validity check that is
required by the NRPM?

Ted