Re: AS21299 - 46.42.196.0/24 ASN prepending 255 times

[Erik Sundberg <ESundberg () nitelusa com>]

I emailed all the contacts listed for their ASN in the RIPE Database. One of them just respond to me saying they will 
fix this, so there is some hope that this will get addressed.

Now that you mentioned it. I remember seeing the previous thread and responding to it.

Erik


________________________________
From: surfer () mauigateway com <surfer () mauigateway com>
Sent: Thursday, March 24, 2022 11:45 PM
To: Erik Sundberg <ESundberg () nitelusa com>; nanog () nanog org <nanog () nanog org>
Subject: Re: AS21299 - 46.42.196.0/24 ASN prepending 255 times



On 3/24/2022 5:43 PM, Erik Sundberg wrote:
If anyone from AS21299 is lurking on Nanog. Please reduce your AS prepends for 46.42.196.0/24 from 255 prepends to a 
more reasonable number of prepends let's say 20. Thanks!

This is a Kazakhstan register IP Block and ASN

  Network   Next Hop   Metric LocPrf Weight Path
*> 46.42.196.0/24  x.x.x.x     0  100   0 2914 174 3216 3216 35168 21299 <many prepends snipped>

------------------------------------------------------------


This is the one I was asking about in:
https://mailman.nanog.org/pipermail/nanog/2022-March/217925.html

There're a lot more prefixes from them.

86.107.128.0/21
92.49.252.0/24
176.222.164.0/23
176.222.166.0/23
176.222.181.0/24
37.99.2.0/23
5.34.106.0/23

In that email I was worried they were probing for attack vectors, but when I looked into it I found it has been 
happening off and on for a fairly long time.

My bet is the network guys don't want to do anything until told by non-tech managers as the Kazakhstan people just went 
through (are still going through?) an authoritarian beat down from the Kazakhstan government helped by the Russian 
government just before the invasion of Ukraine.

scott

________________________________

CONFIDENTIALITY NOTICE: This e-mail transmission, and any documents, files or previous e-mail messages attached to it 
may contain confidential information that is legally privileged. If you are not the intended recipient, or a person 
responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, 
distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If 
you have received this transmission in error please notify the sender immediately by replying to this e-mail. You must 
destroy the original transmission and its attachments without reading or saving in any manner.
Thank you.