On Thu, 12 Apr 2018 at 11:52, Matt Harris <m...@netfire.net> wrote: > On Thu, Apr 12, 2018 at 12:05 PM, <li...@as23738.net> wrote: > > > Have you tried their IRR entries? Bull appears to redirect to Atos now > > (site-wise). > > > > notify: ed.gie...@atos.net > > notify: charlie.mol...@atos.net > > changed: christophe.fra...@atos.net 20180117 #18:47:40Z > > > > I'm now in touch with Christophe; it looks as though perhaps there's a > separate, rogue AS 6 running around with a different set of peers/transits, > as he was able to confirm that none of his gear is advertising these > prefixes.
That is what I feared as well. It appears the single digit ASNs often fall victim of other people’s misconfigurations or malicious activities. Hard to separate the impersonator from the real autonomous system. Job
