<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:680661959;
mso-list-type:hybrid;
mso-list-template-ids:446446010 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hello,<o:p></o:p></p><p class=MsoNormal>My name is Lefteris Manassakis, Internet researcher and COO of Code BGP.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Since January 20, 2023, we have been monitoring the root DNS prefixes using our product, the Code BGP Platform, and we have identified multiple BGP anomalies related to these prefixes, some of which I will present in this email.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>1.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]> January 27, 2023: AS 24028 appeared as origin of prefix 2001:500:2f::/48 of F-Root. The event as seen by BGPlay: <a href="https://stat.ripe.net/widget/bgplay#w.resource=2001:500:2f::/48&w.ignoreReannouncements=false&w.starttime=1674752397&w.endtime=1674925197&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp">https://stat.ripe.net/widget/bgplay#w.resource=2001:500:2f::/48&w.ignoreReannouncements=false&w.starttime=1674752397&w.endtime=1674925197&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp</a><o:p></o:p></p><p class=MsoListParagraph><o:p> </o:p></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>2.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>February 25, 2023: AS 17639 appeared as origin of prefix 2001:500:a8::/48 of E-Root. At the exact same time, appeared as origin of 2001:500:2f::/48 of F-Root:<o:p></o:p></p><p class=MsoListParagraph style='margin-left:72.0pt;text-indent:-18.0pt;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>a.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>BGPlay for E-Root: <a href="https://stat.ripe.net/widget/bgplay#w.resource=2001:500:a8::/48%20&w.ignoreReannouncements=false&w.starttime=1677322776&w.endtime=1677409176&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp">https://stat.ripe.net/widget/bgplay#w.resource=2001:500:a8::/48%20&w.ignoreReannouncements=false&w.starttime=1677322776&w.endtime=1677409176&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp</a><o:p></o:p></p><p class=MsoListParagraph style='margin-left:72.0pt'><o:p> </o:p></p><p class=MsoListParagraph style='margin-left:72.0pt;text-indent:-18.0pt;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>b.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>BGPlay for F-Root: <a href="https://stat.ripe.net/widget/bgplay#w.resource=2001:500:2f::/48&w.ignoreReannouncements=false&w.starttime=1677347997&w.endtime=1677434397&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp">https://stat.ripe.net/widget/bgplay#w.resource=2001:500:2f::/48&w.ignoreReannouncements=false&w.starttime=1677347997&w.endtime=1677434397&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp</a><o:p></o:p></p><p class=MsoListParagraph><o:p> </o:p></p><p class=MsoListParagraph style='margin-left:72.0pt'>The offending network (AS 17639 Converge ICT Solutions) is mentioned in a report by Aftab Siddiqui for events that took place in 2020: <a href="https://www.manrs.org/2021/02/bgp-rpki-and-manrs-2020-in-review/">https://www.manrs.org/2021/02/bgp-rpki-and-manrs-2020-in-review/</a><o:p></o:p></p><p class=MsoListParagraph style='margin-left:72.0pt'><o:p> </o:p></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>3.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>April 28, 2023. AS 137661 appeared as origin of prefix 199.7.83.0/24 of L-Root. This event has very low visibility due to the very long AS path. However, it had been active for 2 months: <a href="https://stat.ripe.net/widget/bgplay#w.resource=199.7.83.0/24&w.ignoreReannouncements=false&w.starttime=1682589576&w.endtime=1688205576&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp">https://stat.ripe.net/widget/bgplay#w.resource=199.7.83.0/24&w.ignoreReannouncements=false&w.starttime=1682589576&w.endtime=1688205576&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp</a><o:p></o:p></p><p class=MsoListParagraph><o:p> </o:p></p><p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>4.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>June 12, 2023. AS 201333 appeared as origin of prefix 193.0.14.0/24 of K-Root: <a href="https://stat.ripe.net/widget/bgplay#w.resource=193.0.14.0/24&w.ignoreReannouncements=false&w.starttime=1686528000&w.endtime=1686614399&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp">https://stat.ripe.net/widget/bgplay#w.resource=193.0.14.0/24&w.ignoreReannouncements=false&w.starttime=1686528000&w.endtime=1686614399&w.rrcs=0,1,5,6,7,10,11,13,14,15,16,18,20&w.instant=null&w.type=bgp</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If you have any questions of comments, feel free to message me.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Best regards,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Lefteris<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse'><tr style='height:72.1pt'><td valign=top style='border:solid white 1.0pt;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:72.1pt'><p class=MsoNormal><span style='font-family:"Arial",sans-serif;color:black;border:none windowtext 1.0pt;padding:0cm'><img border=0 width=84 height=84 style='width:.875in;height:.875in' id="Picture_x0020_1" src="cid:image001.png@01D9AC27.C25458F0" alt="https://lh6.googleusercontent.com/fe88PZfWTJvodUjyCegNJS1Wif6k5eJmP_Da3gP2wla2Qq82UlQqhm40IvOOjTi-8O6yPmhom5owiNBDHgRBskAxJpLNsE5NwSxHkUDnMa2kVAlizjWLRm1_Lm22SEu3GthF5cU7"></span><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D'><o:p></o:p></span></p></td><td valign=top style='border:solid white 1.0pt;border-left:none;padding:5.0pt 5.0pt 5.0pt 5.0pt;height:72.1pt'><p class=MsoNormal><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#092B50'>Lefteris Manassakis</span><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#172B4D'>COO & Co-founder</span><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#172B4D'><br></span><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D'><a href="http://www.codebgp.com"><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#3B62F0'>www.codebgp.com</span></a></span><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:black'> </span><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#172B4D'>|</span><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:black'> +30 </span><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#092B50'>281 039 1248</span><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:10.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:0cm'><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#092B50'>Monitor • Detect • Protect</span><span style='font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D'><o:p></o:p></span></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>