[nsp-sec] Unassigned networks being announced (AS 702, 26116, 26896, and 30991)

[Tim Wilde]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey everyone,

We got a question this morning about some networks that appeared in our
fullbogon list but that were generating traffic.  Upon investigation,
they weren't FPs in the list, but unassigned networks being announced by
various folks.  Nothing new and exciting, of course, but since I know at
least one of the ASNs in question is on NSP-SEC, I figured I'd send them
out in case anyone can whack them (or yell at the RIRs to update their
info and indicate that the blocks really are assigned).  The IPs and
networks we see being routed are:

702     | 192.101.64.254   | 192.101.64.0/21     | AS702 Verizon
Business EMEA - Commercial IP service provider in Europe
26116   | 207.174.190.193  | 207.174.190.0/24    | INDRA - Indra_s Net Inc.
26116   | 207.174.191.230  | 207.174.191.0/24    | INDRA - Indra_s Net Inc.
26896   | 199.233.92.34    | 199.233.92.0/24     | D102-ITC - Data 102, LLC
30991   | 196.201.250.190  | 196.201.250.0/24    | SAHANNET Sahannet AS
Network
30991   | 196.201.253.38   | 196.201.253.0/24    | SAHANNET Sahannet AS
Network

I doubt any but 702 from that list are represented here, so here are the
peer ASNs:

Bulk mode; peer-whois.cymru.com [2010-05-11 12:11:11 +0000]
209     | 207.174.190.193  | 207.174.190.0/24    | ASN-QWEST - Qwest
Communications Company, LLC
209     | 207.174.191.230  | 207.174.191.0/24    | ASN-QWEST - Qwest
Communications Company, LLC
701     | 192.101.64.254   | 192.101.64.0/21     | UUNET - MCI
Communications Services, Inc. d/b/a Verizon Business
703     | 192.101.64.254   | 192.101.64.0/21     | UUNET - MCI
Communications Services, Inc. d/b/a Verizon Business
1299    | 192.101.64.254   | 192.101.64.0/21     | TELIANET TeliaNet
Global Network
3320    | 192.101.64.254   | 192.101.64.0/21     | DTAG Deutsche Telekom AG
3356    | 192.101.64.254   | 192.101.64.0/21     | LEVEL3 Level 3
Communications
3549    | 207.174.190.193  | 207.174.190.0/24    | GBLX Global Crossing Ltd.
3549    | 207.174.191.230  | 207.174.191.0/24    | GBLX Global Crossing Ltd.
6453    | 192.101.64.254   | 192.101.64.0/21     | GLOBEINTERNET TATA
Communications
33302   | 199.233.92.34    | 199.233.92.0/24     | ONS-COS - Data 102, LLC
33770   | 196.201.250.190  | 196.201.250.0/24    | KDN
33770   | 196.201.253.38   | 196.201.253.0/24    | KDN

Just an FYI, no specific knowledge of malicious activity from these, but
something you might want to look at cleaning up!

Best regards,
Tim Wilde

- -- 
Tim Wilde, Senior Software Engineer, Team Cymru, Inc.
twilde at cymru.com | +1-630-230-5433 | http://www.team-cymru.org/
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAkvpSbUACgkQluRbRini9thbBACcDzS27x7iWspR5URAs68EBNCD
9eYAnjbh17ufAqrN2HkjDm7qgplmPG7+
=iJn2
-----END PGP SIGNATURE-----