Re: AS11296 -- Hijacked?

[Franck Martin <franck () genius com>]

Then you have:
http://www.uceprotect.net/en/rblcheck.php

Which has a level to identify IPs belonging to an ASN which has been reported as spewing spam...

The only issue here, is that this site has listed whole countries... Yes, some countries are behind one ASN only...

----- Original Message -----
From: "Heath Jones" <hj1980 () gmail com>
To: "Franck Martin" <franck () genius com>
Cc: nanog () nanog org
Sent: Wednesday, 29 September, 2010 5:22:02 PM
Subject: Re: AS11296 -- Hijacked?

> This is not what the Team Cymru Bogons list for? http://www.team-cymru.org/Services/Bogons/
I just had a very quick look at that site and it seems at first glance
to just be providing information on unallocated prefixes/ASs..
They are prefixes/ASs that spammers can and do use, but if you have a
look at cidr report or potaroo then you will see that an ISP who
filters based on that will cause some issues (allocation records are
not always up to date).

> List bad ASNs after proper investigation?
Not really, just based on registry information as far as I can see.
For instance, if a known and stable AS suddenly started originating
spam, it doesnt look like that would appear on the site.

> It then depends if you trust Team Cymru or not, like you would trust or not Spamhaus...
Trust will always be the issue. Peer review and communication is one
way of building trust.