[nsp-sec] Cogent hijacking many Israeli IPs

Hank Nussbacher hank at efes.iucc.ac.il
Wed Apr 1 07:06:34 EDT 2009


What started out this morning as just one /32 
(192.116.154.209/32) being announced by AS174 - has now turned into a 
free-for-all with the following /32s being announced by AS174:
AS1680
93.173.40.204/32
93.173.134.97/32
217.132.154.96/32
93.172.104.38/32
217.132.61.27/32
85.250.53.236/32
89.0.134.96/32
89.138.97.39/32
62.0.167.181/32

AS8584
212.150.129.205/32
212.150.164.114/32

AS9116
192.116.154.209/32
195.189.140.80/32
84.94.229.73/32

The 192.116.154.209/32 was announced directly by AS174 but now all the 
newer /32s are being announced by AS65334.

Are other ISPs seeing this or is it just a Cogent/Israeli thing?  IAR is 
showing lots of interesting announcements at Cogent:
http://cs.unm.edu/~karlinjf/IAR/subprefix.php?filter=most

Is IAR hosed or is Cogent?

Thanks,
Hank



More information about the nsp-security mailing list