| Website | https://www.spamhaus.org |
| Threat Intel Community | https://submit.spamhaus.org |
| https://www.linkedin.com/company/the-spamhaus-project | |
| https://twitter.com/spamhaus |
Good news: over the past 30 days, activity has declined across almost all of the Top 20 countries hosting IPs associated with exploited devices.
Only four countries saw increases:
🇨🇳 #1 China (+19%)
🇮🇩 #6 Indonesia (+9%)
🇩🇿 #7 Algeria (+9%)
🇪🇬 #20 Egypt (+11%)
For a full picture of where activity is rising and falling globally, dig deeper into Spamhaus Reputations Statistics here ⤵️⤵️
https://www.spamhaus.org/reputation-statistics/countries/exploit/
This operation has established a clear modus operandi:
- Find a large unused network assigned to a large ISP
- Find an ASN not in use but also assigned to the same large ISP
- Set up a router announcing the network from the ASN, so that (almost) nobody will see anything wrong with the announcement.
- Set up a fake transport ISP in between, to confuse waters
- Connect the whole thing to the internet through an ISP with "relaxed" vetting procedures on what customers announce, and voila', a hijacked network is connected.
This series of events clearly demonstrates how important it is to look at routes including their connectivity, not just the ASN and network - it's only the connectivity which reveals the hijacking issue.
We've identified additional suspicious routes (see image):
AS22521 and AS4183: Verizon Business 🇺🇸
AS22541: MEGALINK S.R.L. 🇧🇴
AS20940: Akamai International B.V.
AS18734: Operbes S.A. de C.V. 🇲🇽
They all lead back to Chicago. https://www.youtube.com/watch?v=gvKs2VLmVnY ⬇️
RE: https://infosec.exchange/@spamhaus/116398003458245821
Over the past 48 hours there have been some very interesting developments...
The "Charter Communications" announcements for 47.1.0.0/16 and 47.2.0.0/16 have disappeared, implicitly confirming that they were hijacked.
The "Orange" announcement for AS41128 has changed - the path is now:
90.98.0.0/15 AS41128 AS22541 AS29802
AS41128: Orange 🇫🇷
AS22541: MEGALINK S.R.L. 🇧🇴
AS29802: Hivelocity 🇺🇸
The entire network has relocated from Chicago to Dallas (likely to the Prime Dallas Campus DFW01 datacenter). Once more the inclusion of a South-American ISP appears completely unrealistic, with the traffic between the AS29802 router (de-cix.dfw.hivelocity.net) and the final destination seemingly within the Dallas datacenter.
But there's more. ⬇️
🌐 OUT NOW | Spamhaus Domain Report Oct 2025 - March 2026!
⬆️ 46.9 million new domains
⬇️ 2.15 million malicious domain detections
⬆️ Domains associated with botnet C&C’s (+289%) & malware (+206%)
🔄 .bond (and many more!) see high churn of new registrations
And find out which TLD has a massive 17.5% of its zone file listed 😱!
Read the full domain report here 👉 https://www.spamhaus.org/resource-hub/domain-reputation/domain-reputation-update-oct-2025-mar-2026/
📢 FINAL REMINDER | From tomorrow we will start to restrict access to Oracle IP addresses querying our DNSBLs. To stay protected by the data, register for Spamhaus Technology's FREE Data Query Service - changes to config take minutes.
Sign up here 👇
https://www.spamhaus.com/data-access/free-data-query-service/
Comcast 'apparently' last used AS393232 in 2017
Charter abandoned AS36429 in 2014
Orange only used AS41128 briefly from August to October 2025
In all three cases, the originating ASNs were not active prior to these announcements...making the situation even more unusual.
And raises the question 🤔 ...⬇️
Testing shows that these networks appear to be physically located just behind the router vrrp.gcore.lu (213.156.140.67) at the DE-CIX facility in Chicago.
This suggests that transport between Gcore and the final destination appears to take place within the same datacenter, despite the apparent involvement of 🇲🇽 Mexican ISPs and in one case even Cloudflare 🇺🇸.
And there are more anomalies to note: ⬇️
We've recently observed some unusual large-scale routes appearing on the internet (see image), involving the following networks:
AS393232: Comcast Cable Communications 🇺🇸
AS36429: Charter Communications 🇺🇸
AS41128: Orange 🇫🇷
AS13335: Cloudflare 🇺🇸
AS17072: Total Play Telecommunications 🇲🇽
AS270118: Soluciones, Analíticos Y Servicios Team (Stratosphere Technology Latam) 🇲🇽
AS199524: Gcore Labs 🇱🇺
The label "path (fixed)" indicates that identical paths were observed by several probes across the internet. This strongly suggests that AS199524 is the central pivot point behind these announcements.
While the first four paths have since disappeared, the most recent three remain active. ⬇️
