Of possible interest to this group.
Forwarding at Alexander’s suggestion, who says he has already shared info in the NANOG facebook group "(with updated prefixlist)".
—Sandy
I know I saw a significant number of suspicious routes from 31133 in the past day or two as well.
There appears to be some pretty widespread bogus routing.
- jared
I guess this is already a big issue + this is going to be a problem for
people attending the FIFA World Cup using information from the cloud
(few people, no?)
Ale,
Russian ISPs MUST fully block all traffic to such networks. The list is
frequently updated and gets automatically propagated to ISP every once in a
while, failure to block any address may result in 1500eur fine.
Per day? That's a cost of doing business. Can we donate to pay it somewhere?
The
infrastructure listed above is being added to the blocklist under
“counter-terrorist and counter-extremist” order of the General Prosecutor
Office, #27-31-2015/Id4082-15, issued in 2015 and often used for blocking
an arbitrary unwanted content. The real reason for such blocking is an
attempt to cut access to Telegram messenger, which refused to provide
end-to-end encryption keys to the Federal Security Service (previously
known as KGB).
Necessity is the plea for every infringement of human liberty.
It is the argument of tyrants; it is the creed of slaves.
-- William Pitt
Thanks for sharing,
Note of caution - there is a mess going on with this blocking so if some IP
range/domain is not in any list it doesn't necessary mean it is not
blocked. Lists are created/updated pretty sporadically (e.g. the list does
not say so but there are reports of blocked DigitalOCean nets 167.99.0.0/16
& 206.189.0.0/16 https://www.securitylab.ru/news/492749.php) .
My 2 cents - once Russian Internet authorities get tired of chasing their
own tail (any sysadmin knows you can't block ain't nothing by IP addresses
today) they will stop this fruitless effort (but of course they cannot do
it right now and lose the face) and things will be back to normal.