In message <d3230863-c17a-7fe7-e7b6-c0742bcda...@tana.it>, Alessandro Vesely <ves...@tana.it> writes
>> These blocks appear to be mostly or entirely very old "legacy" block, >> primarily from the ARIN region. > > >Only a few of them are listed on https://www.spamhaus.org/drop/ Spamhaus have built that table from what they know of previous hijacking events (because they observed that there was some repetition in the prefixes that the hijackers chose). So announcing a prefix that is on that list is not a good sign (indeed far from it) -- but don't expect a "new" hijacker to only choose from that list or indeed to pick any prefixes from that list at all. -- Dr Richard Clayton <richard.clay...@cl.cam.ac.uk> Director, Cambridge Cybercrime Centre mobile: +44 (0)7887 794090 Computer Laboratory, University of Cambridge, CB3 0FD tel: +44 (0)1223 763570
signature.asc
Description: PGP signature
