In message <d3230863-c17a-7fe7-e7b6-c0742bcdadfb@tana.it>, Alessandro Vesely <vesely@tana.it> writes
These blocks appear to be mostly or entirely very old "legacy" block, primarily from the ARIN region.
Only a few of them are listed on https://www.spamhaus.org/drop/
Spamhaus have built that table from what they know of previous hijacking events (because they observed that there was some repetition in the prefixes that the hijackers chose). So announcing a prefix that is on that list is not a good sign (indeed far from it) -- but don't expect a "new" hijacker to only choose from that list or indeed to pick any prefixes from that list at all. -- Dr Richard Clayton <richard.clayton@cl.cam.ac.uk> Director, Cambridge Cybercrime Centre mobile: +44 (0)7887 794090 Computer Laboratory, University of Cambridge, CB3 0FD tel: +44 (0)1223 763570