North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Potential Prefix Hijack

  • From: Tim Peiffer
  • Date: Mon Nov 10 22:05:55 2008

Mark Tinka wrote:
Hi all.

Anyone know how we can contact AS16735 and their upstream AS27664. We think they are hijacking a number of our prefixes (AS24218- and AS17992-originated). Thanks BGPmon:

All 19 of my prefixes for AS57, AS217 and AS1998 are being hijacked by the same ASN. I sent a note to the ASN contact [email protected] I can't seem to contact lacnic for more than a few queries without being blacked out.

Tim Peiffer Network Support Engineer Office of Information Technology University of Minnesota/NorthernLights GigaPOP

% Joint Whois -
% This server accepts single ASN, IPv4 or IPv6 queries

% LACNIC resource:

% Copyright LACNIC % The data below is provided for information purposes % and to assist persons in obtaining information about or % related to AS and IP numbers registrations % By submitting a whois query, you agree to use this data % only for lawful purposes. % 2008-11-11 00:51:09 (BRST -02:00)

aut-num: AS16735
owner: Companhia de Telecomunicacoes do Brasil Central
ownerid: BR-CTBC1-LACNIC
responsible: Adriana Maria Rocha Paula
address: Av Joïo Pinheiro, 620, Centro
address: 38400-126 - Uberlïndia - MG
country: BR
phone: +34 3256 2575 [2575]
owner-c: AMP
routing-c: AMP
abuse-c: AMP
created: 20000605
changed: 20040415

nic-hdl: AMP
person: Adriana Maria Rocha Paula
e-mail: [email protected]
address: Rua Josï Alves Garcia, 415,
address: 38400710 - Uberlïndia -
country: BR
phone: +34 3256 2575 [2575]
created: 20040628
changed: 20040628

% accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.


Possible Prefix Hijack (Code: 11)
1 number of peer(s) detected this updates for your prefix Update details: 2008-11-11 02:24 (UTC) Announced by: AS16735 (Companhia de Telecomunicacoes do Brasil Central)
Transit AS: 27664 (CTBC Multimïdia)
ASpath: 27664 16735

RIPE's RIS BGPlay confirms the same, for about the last hour.

E-mails to them won't get there (of course), so our NOC are contacting them via Gmail/Yahoo.

All help appreciated.