Re: Attacks from poneytelecom.eu

["Radu-Adrian Feurdean" <nanog () radu-adrian feurdean net>]

On Thu, Jan 4, 2018, at 06:46, Tim Burke wrote:
> AS12876 is online.net... home of the €2.99 physical server, perfect for 
> all of your favorite illegitimate activity. I’m curious how much traffic 
> originates from that ASN that is actually legitimate... probably close 
> to none. 

For you, in US, probably not so much, but you should really check.
For us, here in France, Online is one of the 2 top hosting providers (they even have several neutral datacenters where 
they lease racks/cages/datarooms) with a quite enough of legitimate traffic. I say enough, since 10's of MBps of 
traffic to classic (locally) well-known sites is easily hidden by spikes due to file transfer (they are also popular 
here for hosting private off-site backups - they actually even have an archiving service) or bittorrent.

I also saw a mention of Iliad, their parent company, stock-listed (ILD on EuroNext Paris), as "buletproof hosting". You 
should note that they also own one of the top 4 ISPs here in France and one of the 4 frequence-owning mobile operators. 
But those run each on separate networks.

One should probably do some minimal research on non-US companies before accusing.

PS: No, I don't work for them. Just happen to be personally a customer of 3 of the Iliad-owned companies (Online.net 
being one of them).