Suspicious network resurrections

UPDATE Dec 1st 2020: A big thank you to Telia Carrier, Hurricane Electric and GTT for taking swift and positive action in shutting down the related announcements.

We believe there is a serious issue relating to the equivalent of 56 “/20” networks, with a corresponding 230k IPv4 addresses. The total value of these is approximately $5M to $6M1 . This is an urgent notification to all organizations involved; ARIN and the backbones, in addition to the legitimate owners, whose IPv4 ranges and ASNs may have been used without their authorization.

What activity has Spamhaus observed?

Over the past few days, we have observed 52 networks in the ARIN (North-America) area concurrently burst into life. Until this week, all these networks had been dormant (not routed) for a significant length of time. Even more unusual is that a different autonomous system number (ASN), also previously inactive, has announced each network.

In 48 cases, these are /20 networks amounting to 4096 IPv4 addresses, and in the remaining 4 cases, they are /19 networks with 8192 addresses.

Why do we consider this to be a problem?

1. The improbability of the timing 
Occasionally, organizations that have gone offline do reappear on the internet; however it’s a rarity. Meanwhile, the probability of 52 organizations simultaneously choosing to go back online is almost nil.
2. No relationships between each network and the announcing ASN As far as we can deduce there is no relation between each network and the ASN announcing it, other than they’ve been inactive for some time. For instance: 

198.14.0.0/20 assigned to Hybrid Networks in Cupertino, CA, is seen announced by AS14126 assigned to VoiceStar in Philadelphia, PA.

Traceroutes and pings indicate that they are all physically hosted in the New York City area, in the US. 3. Suspect Border Gateway Protocol (BGP) paths and connecting major backbones The BGP paths connecting these American networks to the New York City hosting facility involve several Ukrainian ASNs, namely: * AS204293 and AS204815 - LLC SOLAR STRATEGIA, Chernivtsi, UA * AS201292 - Agrofirma Aleks PP, Chumaky, UA * AS42602 - KING-TRANS LLC, Kyiv, UA * AS209946 - ALINDA LLC, Mykolayiv, UA * AS205145 - Start Telecom LLC, Kyiv, UA * AS205268 - Ipcom invest LLC, Kyiv, UA Additionally, the above Ukrainian companies appear to be connecting these "suddenly reborn" networks to major backbones, notably: * Telia (AS1299) and Hurricane Electric (AS6939) for AS42602, * Cogent (AS174) for AS209946, * GTT (AS3257) for AS201292, * Lumen (AS3356) for AS205268.

What action has Spamhaus taken?

Given the unlikelihood that these routes are legitimate, we have placed almost all of them on our DROP (Do not Route or Peer) list, until their owners clarify the situation.

Here are the full details of the networks and associated resources, as well as the Spamhaus Block List (SBL) ID referring to their case

Some of these routes have been withdrawn already, but the majority remain up and running today. We urge all parties to investigate immediately.

1. Based on current market values ↩︎