<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-NZ link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I just got –<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>“Dear Tony,</span><span lang=EN-US style='color:#1F497D;mso-fareast-language:EN-NZ'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>We are done to deny all prefixes from indosat.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>We apologize for any inconvenience. Thank you.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> Best Regards,<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> Mr.Alongkorn Thanomchankul<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> <o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> THailand Internet eXchange (THIX)<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> CAT.Telecom Public Co., Ltd.<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> E-mail : <a href="mailto:noc@cat.net.th"><span style='color:blue'>noc@cat.net.th</span></a><o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> TEL. +662-104-2372<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> +662-104-2374<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='color:#1F497D'> FAX. +662-104-2270<o:p></o:p></span></b></p><p class=MsoNormal><span style='color:#1F497D'>“<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='mso-fareast-language:EN-NZ'>From:</span></b><span lang=EN-US style='mso-fareast-language:EN-NZ'> AusNOG [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Tristram Cheer<br><b>Sent:</b> Thursday, 3 April 2014 1:33 p.m.<br><b>To:</b> ausnog@lists.ausnog.net<br><b>Subject:</b> {Disarmed} Re: [AusNOG] BGPMon/Thailand AS4761 Hijacking<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Just got this response from their NOC contact:<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>“</span><span lang=EN-US style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D'>Dear Sir, <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D'>Today we have trouble with our network and still investigate.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#E36C0A'>Thank's<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#E36C0A'>xxxxxxxx <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#E36C0A'>TOC IP Surveillance</span><span lang=EN-US style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>“<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p><span style='color:#7D7D7D'>--</span><o:p></o:p></p><p><b><span style='font-family:"Verdana","sans-serif";color:#7D7D7D'>Tristram Cheer</span></b><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";color:#7D7D7D'><br>Network Architect - <i>Most problems are the result of previous solutions...</i></span><o:p></o:p></p><p><img border=0 width=192 height=79 id=IMG1 src="cid:image001.jpg@01CF4F42.C64C78D0" alt="cid:image001.jpg@01CF4F42.C64C78D0"><o:p></o:p></p><p><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";color:#7D7D7D'>09 438 5472 Ext 803 |022 412 1985 | PO Box 5083, Whangarei, 0140</span> <br><a href="mailto:tristram.cheer@ubergroup.co.nz" title="Click to send email to Tristram Cheer"><span style='font-size:7.5pt;font-family:"Verdana","sans-serif"'>tristram.cheer@ubergroup.co.nz</span></a><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";color:#7D7D7D'> |</span><a href="http://www.uber.co.nz" title=""><span style='font-size:7.5pt;font-family:"Verdana","sans-serif"'>possiblefraudstart "www.uber.co.nz" possiblefraudend www.ubergroup.co.nz</span></a><o:p></o:p></p><p><a href="http://ubergroup.co.nz/fb"><span style='text-decoration:none'><img border=0 width=40 height=40 id="Picture_x0020_9" src="cid:image004.png@01CF4F42.D9E05FB0" alt="cid:image650141.PNG@2e3a410c.43ab2a1c"></span></a> <a href="https://twitter.com/#!/ubergroupltd"><span style='text-decoration:none'><img border=0 width=40 height=40 id="Picture_x0020_10" src="cid:image005.png@01CF4F42.D9E05FB0" alt="cid:image385fb4.PNG@f87ca25b.43bf2aa3"></span></a><o:p></o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='mso-fareast-language:EN-NZ'>From:</span></b><span lang=EN-US style='mso-fareast-language:EN-NZ'> AusNOG [</span><a href="mailto:ausnog-bounces@lists.ausnog.net"><span lang=EN-US style='mso-fareast-language:EN-NZ'>mailto:ausnog-bounces@lists.ausnog.net</span></a><span lang=EN-US style='mso-fareast-language:EN-NZ'>] <b>On Behalf Of </b>Michael Gehrmann<br><b>Sent:</b> Thursday, 3 April 2014 12:21 p.m.<br><b>To:</b> </span><a href="mailto:ausnog@lists.ausnog.net"><span lang=EN-US style='mso-fareast-language:EN-NZ'>ausnog@lists.ausnog.net</span></a><span lang=EN-US style='mso-fareast-language:EN-NZ'><br><b>Subject:</b> Re: [AusNOG] BGPMon/Thailand AS4761 Hijacking<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-AU style='color:#1F497D'>We got alerts for several /24’s out of our larger blocks.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN style='font-size:8.5pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:EN-AU'>Michael Gehrmann<br><b>Hosting Support Specialist – Networks <br>Macquarie Telecom</b> <o:p></o:p></span></p><div><div><div><div><div><div class=MsoNormal><span lang=EN style='font-size:8.5pt;font-family:"Arial","sans-serif";color:#1F497D;mso-fareast-language:EN-AU'><hr size=2 width=760 style='width:570.0pt' align=left></span></div></div></div></div></div></div><p class=MsoNormal><span lang=EN-AU style='color:#1F497D;mso-fareast-language:EN-AU'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'> AusNOG [</span><a href="mailto:ausnog-bounces@lists.ausnog.net"><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>mailto:ausnog-bounces@lists.ausnog.net</span></a><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>] <b>On Behalf Of </b>Tristram Cheer<br><b>Sent:</b> Thursday, 3 April 2014 6:08 AM<br><b>To:</b> </span><a href="mailto:ausnog@lists.ausnog.net"><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'>ausnog@lists.ausnog.net</span></a><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-AU'><br><b>Subject:</b> [AusNOG] BGPMon/Thailand AS4761 Hijacking<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Hi All,<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Is anyone else getting alerts that AS4761 is hijacking IP ranges? I’ve just got alerting from BGPMon that all of our ASN’s announced prefix’s are being announced by AS4761. So far it’s only showing up at a peer in Thailand.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Cheers<o:p></o:p></span></p><p><span style='color:#7D7D7D'>--</span><o:p></o:p></p><p><b><span style='font-family:"Verdana","sans-serif";color:#7D7D7D'>Tristram Cheer</span></b><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";color:#7D7D7D'><br>Network Architect - <i>Most problems are the result of previous solutions...</i></span><o:p></o:p></p><p><img border=0 width=192 height=79 id="Picture_x0020_5" src="cid:image001.jpg@01CF4F42.C64C78D0" alt="cid:image001.jpg@01CF4F42.C64C78D0"><o:p></o:p></p><p><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";color:#7D7D7D'>09 438 5472 Ext 803 |022 412 1985 | PO Box 5083, Whangarei, 0140</span> <br><a href="mailto:tristram.cheer@ubergroup.co.nz" title="Click to send email to Tristram Cheer"><span style='font-size:7.5pt;font-family:"Verdana","sans-serif"'>tristram.cheer@ubergroup.co.nz</span></a><span style='font-size:7.5pt;font-family:"Verdana","sans-serif";color:#7D7D7D'> |</span><a href="http://www.uber.co.nz" title=""><span style='font-size:7.5pt;font-family:"Verdana","sans-serif"'>possiblefraudstart "www.uber.co.nz" possiblefraudend www.ubergroup.co.nz</span></a><o:p></o:p></p><p><a href="http://ubergroup.co.nz/fb"><span style='text-decoration:none'><img border=0 width=40 height=40 id="Picture_x0020_6" src="cid:image008.png@01CF4F42.C64C78D0" alt="cid:image008.png@01CF4F42.C64C78D0"></span></a> <a href="https://twitter.com/#!/ubergroupltd"><span style='text-decoration:none'><img border=0 width=40 height=40 id="Picture_x0020_7" src="cid:image009.png@01CF4F42.C64C78D0" alt="cid:image009.png@01CF4F42.C64C78D0"></span></a><o:p></o:p></p></div></body></html>