On Thu, 12 Apr 2018 at 11:52, Matt Harris <[email protected]> wrote: > On Thu, Apr 12, 2018 at 12:05 PM, <[email protected]> wrote: > > > Have you tried their IRR entries? Bull appears to redirect to Atos now > > (site-wise). > > > > notify: [email protected] > > notify: [email protected] > > changed: [email protected] 20180117 #18:47:40Z > > > > I'm now in touch with Christophe; it looks as though perhaps there's a > separate, rogue AS 6 running around with a different set of peers/transits, > as he was able to confirm that none of his gear is advertising these > prefixes.
That is what I feared as well. It appears the single digit ASNs often fall victim of other people’s misconfigurations or malicious activities. Hard to separate the impersonator from the real autonomous system. Job
