Help! My IP Address Has Been Hijacked!
Summary: Cisco Talos reported that IP address 146.0.53.17, legitimately allocated to Logfont Ltd in Dublin under AS51677, was announced via BGP by AS201640, belonging to MEGA-SPRED in Bulgaria, and used to send spam from outside the owner's network. Talos also found the spam domain registered to the email address mikeprescott7777@gmail.com, which DomainTools shows is responsible for registering 45 domains used in the same hijacking campaign from different IPs in the hijacked netblock.
Why it matters: The hijack worked because networks were not filtering BGP traffic, and Talos notes a hijacked IP can be used for denial of service or stealing traffic from the legitimate owner, not just spam - so an unannounced or unused IPv4 prefix in your allocation is an opening someone else can claim.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026