Rethem Hosting LLC (AS14987) has been added to the ASN watchlist.
AS14987 is the autonomous system that originates the scanning traffic of a now seemingly defunct “research project” known as InterneTTL.
These scans originate from the 104.152.52.0/24 netblock and each IP has a reverse DNS (PTR) record of “internettl.org” – a website that stopped functioning sometime after September 2021, per data provided by the Internet Archive and urlscan.io.
BGP.tools notes that 104.152.52.0/24 is originated by AS14987 and AS139989 (CV Atha Media Prima). The BGP Toolkit, provided Hurricane Electric, notes the lesser specific prefix 104.152.52.0/22 is announced by AS14987 and AS51088 (A2B IP B.V.).
Using the RIPEstat tool BGPplay, we can see AS51088 is noted as an Origin AS, however it does not appear the route propagated to the wider internet. The cause of these routing shenanigans is not known, so we’ll regard it as a red herring in the dubious history of InterneTTL.
Given the high volume of scanning activity, with no opt-out mechanism, you would be wise to drop all traffic from 104.152.52.0/24.
Leave a Reply