RE: Potential Prefix Hijack

["Frank Bulk" <frnkblk () iname com>]

More contact people here:
http://www.bovespa.com.br/Companies/FormConsultaImpressao.asp?CodCVM=21032

If I knew someone (readily available) who spoke Portuguese I would call them, but alas, they are sleeping and not 
technical.

Frank

-----Original Message-----
From: Tim Peiffer [mailto:peiffer () umn edu] 
Sent: Monday, November 10, 2008 9:04 PM
To: mtinka () globaltransit net
Cc: nanog () nanog org
Subject: Re: Potential Prefix Hijack

Mark Tinka wrote:
> Hi all.
>
> Anyone know how we can contact AS16735 and their upstream
> AS27664. We think they are hijacking a number of our
> prefixes (AS24218- and AS17992-originated). Thanks BGPmon:
All 19 of my prefixes for AS57, AS217 and AS1998 are being hijacked by
the same ASN. I sent a note to the ASN contact
adrianamr () CTBCTELECOM NET BR. I can't seem to contact lacnic for more
than a few queries without being blacked out.


Tim Peiffer
Network Support Engineer
Office of Information Technology
University of Minnesota/NorthernLights GigaPOP

% Joint Whois - whois.lacnic.net
% This server accepts single ASN, IPv4 or IPv6 queries

% LACNIC resource: whois.lacnic.net


% Copyright LACNIC lacnic.net
% The data below is provided for information purposes
% and to assist persons in obtaining information about or
% related to AS and IP numbers registrations
% By submitting a whois query, you agree to use this data
% only for lawful purposes.
% 2008-11-11 00:51:09 (BRST -02:00)

aut-num: AS16735
owner: Companhia de Telecomunicacoes do Brasil Central
ownerid: BR-CTBC1-LACNIC
responsible: Adriana Maria Rocha Paula
address: Av Jo�o Pinheiro, 620, Centro
address: 38400-126 - Uberl�ndia - MG
country: BR
phone: +34 3256 2575 [2575]
owner-c: AMP
routing-c: AMP
abuse-c: AMP
created: 20000605
changed: 20040415

nic-hdl: AMP
person: Adriana Maria Rocha Paula
e-mail: adrianamr () CTBCTELECOM NET BR
address: Rua Jos� Alves Garcia, 415,
address: 38400710 - Uberl�ndia -
country: BR
phone: +34 3256 2575 [2575]
created: 20040628
changed: 20040628

% whois.lacnic.net accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.


> e.g.,
>
> ====================
> Possible Prefix Hijack (Code: 11)
> 1 number of peer(s) detected this updates for your prefix
> 61.11.208.0/20:
> Update details: 2008-11-11 02:24 (UTC)
> 61.11.208.0/20
> Announced by: AS16735 (Companhia de Telecomunicacoes do
> Brasil Central)
> Transit AS: 27664 (CTBC Multim�dia)
> ASpath: 27664 16735
> =====================
>
> RIPE's RIS BGPlay confirms the same, for about the last
> hour.
>
> E-mails to them won't get there (of course), so our NOC are
> contacting them via Gmail/Yahoo.
>
> All help appreciated.
>
> Cheers,
>
> Mark.