Re: Interesting Announcements

["Roland Verlander" <rolyv () bigpond com>]

miltonningis () hushmail com wrote:
> Anyone know why AS 8143:
> $ whois -h whois.arin.net 8143
>
> OrgName:    Publicom Corp.
> OrgID:      PUBLIC-35
> Address:    1450 Coral Way #10
> City:       Miami
> StateProv:  FL
> PostalCode: 33145
> Country:    US
> RegDate:    1997-04-25
>
> Is announcing the following blocks?
>
> $ whois -h whois.arin.net 155.73.0.0
> OrgName:    Borealis AS
>
> $ whois -h whois.arin.net 134.33.0.0
>
> OrgName:    Codex Corporation

In that case, the hijacker setup a fake webhost
that It's impossible to signup for at
http://www.codexcorp.net [134.33.0.7] to make
them look legitimate.

> $ whois -h whois.arin.net 196.4.167.0                            
>
> OrgName:    Juta Information Network
>
> $ whois -h whois.arin.net 144.2.0.0                              
>
> OrgName:    Publico B.V.
>
> $ whois -h whois.arin.net 143.49.160.0                           
> OrgName:    Inform, Ltd.
>
> $ whois -h whois.arin.net 160.116.160.0                          
> OrgName:    Affiliated Computing Services (Pty) Ltd
>
> $ whois -h whois.arin.net 162.73.128.0                           
> OrgName:    Information Technology
>
> $ whois -h whois.arin.net 198.204.0.0                            
> OrgName:    GHR Services Inc.

Thier all hijacked netblocks.

> Also,
> Perhaps someone from AS16631 (Cogent) can explain this one:
>
> Why is AS27255:
> $ whois -h whois.arin.net 27255                                  
>
> OrgName:    VMX Inc
>
> Announcing this?
>
> $ whois -h whois.arin.net 157.156.0.0                            
>
> OrgName:    VMX Inc
> RegDate:    1992-01-13

Another hijacked one.

> Had a /16 for 11 years, just recently decided to get an ASN? Seems like
> someone just registered a new company to have the same name as a company
> that had a /16, and then got a new ASN....

No. Thier just hijacked netblocks.

Tower Group who had thier unused netblocks been
announced by AS8143 confirmed that it was hijacked.