On 2018-07-09 17:24, Fredrik Korsbäck wrote: > On 2018-07-06 21:18, Tom Paseka via NANOG wrote: >> Hi, >> >> I've been casually observing the connectivity to Bitcanal / AS3266 / >> AS197426 since the thread started. >> >> After GTT shared that bitcanal had been disconnected, bitcanal was only >> visible behind Cogent. But the Cogent path now also seems to have been >> disconnected. After Cogent they popped up behind BICS (but just for a few >> days), that circuit seems to have been disconnected too. >> >> On the IX front: I noticed that Bitcanal's IP addresses on LINX (since >> yesterday) and FranceIX (since today) are no longer responding. >> >> It is good to see that discussing BGP hijacking abuse complaints actually >> results in clean up activities. I hope the remaining IX's they're still >> connected to can act too. >> >> Thanks! >> -Tom >> > > And it also seems that they are now no longer reachable over the AMS-IX > fabric (and is no longer listed as a member). > > I also noticed that hey are not reachable over the Megaport/ECIX fabric in > Frankfurt either (no arp or ping-reply) but > is listed as member on the megaport website, so not sure whats going on there. > > The only routes i can see now for 3266/197426 is two /24 v4 and one /29 v6 > that jumps on over to portugal through 1299 > (telia) -> 174 (cogent) -> 29003 (refertelecom / iptelecom). > >
And now it also seems that NANOG-contributor Doug over at Dyn has done a complete wrap-up of the thing and he has hilighted all the important aspects of this incident in a very educative manner. https://dyn.com/blog/shutting-down-the-bgp-hijack-factory/ Thanks for this Doug! I will bring this post up with my NOC and L2-teams since i think these type of incidents will become as common as regular spam in the future... -- hugge
