Re: Slightly OT: Looking for an old domain for spam collection

[william(at)elan.net]

On Sun, 8 Apr 2007, Jim Popovitch wrote:

> On Wed, 2007-03-28 at 11:24 -0700, Douglas Otis wrote:
> > On Mar 28, 2007, at 11:08 AM, william(at)elan.net wrote:
> > > On Wed, 28 Mar 2007, Tony Finch wrote:
> > > > completewhois has lists in various forms of bogon and hijacked
> > > > networks.
> > > >
> > > > http://completewhois.com/bogons/bogons_usage.htm
> >
> > This list apparently does not track much of the active spoofed
> > announcements.  This is understandable, as this tracking remains a
> > difficult task.
>
> I've been tracking that list for the past few days, and it seems to
> change quite a bit.  I've also seen it delete > 30% on day, and add it
> back in the next.  Do bogons really change that much?

If you're interested in comparing previous days data, its all archived at:
 http://completewhois.com/bogons/data/dailydata/

If you look at specific RIR files data files, you'd be able to tell that 
issue is lacnic space that is different. There exists a bug that causes 
cidr data after processing to not include .0 address which when happens 
severaly increases size of the list. Here is bogons data from today:
  190.15.224.0/19
But yesterday the processing resulted in:

190.15.224.1/32
190.15.224.2/31
190.15.224.4/30
190.15.224.8/29
190.15.224.16/28
190.15.224.32/27
190.15.224.64/26
190.15.224.128/25
190.15.225.0/24
190.15.226.0/23
190.15.228.0/22
190.15.232.0/21
190.15.240.0/20

Stupid bug but its not reproduceable every time and with little impact
(ok it does open small window for abuse) except size of file (correct 
size of is about 117-120k).

--
William Leibzon
Elan Networks
william@xxxxxxxx