[cfp-interest 3376] Re: a sampler of active attacking subnets

[Damian McGuckin]

Young David,

On Mon, 10 Feb 2025, David Hough CFP wrote:

>  25458 138.204.48  LACNIC TURBONET INFO E TELECOM
>  25115 170.78.162  LACNIC TURBONET INFO E TELECOM
>  24193 138.94.53   LACNIC ANDRADE & LANDIM TELECOMUNICACOES LTDA
>  15780 177.73.104  LACNIC FATIMA VIDEO ELETRONICA LTDA ME
>  14546 45.165.65   LACNIC MAURILIO SANTANA DE AZEVEDO LTDA
>  13090 45.164.39   LACNIC OLIVEIRA TELECOM
>  13120 177.190.173 LACNIC Interlink Comunicacao Virtual LTDA ME
>  12835 45.165.67   LACNIC D. S. ALVES SERVICOS DE INTERNET
>
>  21228 45.142.193  RIPE Limited Network LTD
>   2260 114.119.159 APNIC HUAWEI INTERNATIONAL PTE. LTD.
>
> Looks like some Brazilian ISP customers are pretty lax about security;

Yes.

> other ISP's will take anybody's money and look the other way -

We found that with a lot of Singaporean ISPs several years ago.

> when every host in a subnet is attacking,
> there must be some common control over that subnet.

Definitely. W got attacked for a few hours the other day from South Africa 
and Bulgaria before I dropped their packets on the floor rather than just
blocking them. After that, they gave up.

> There is a host of subnets with substantial access attempts less than
> these.   HUAWEI was more active at the beginning but has since subsided.

That looks like they have some way of finding naughty people and put a 
stop to some of it, at least to some extent. Not sure Huawei could afford
to have that happening too often with their name attached to it.

All pretty scary stuff.

Thanks for your efforts - Damian