TIME: 03/15/14 17:23:56 TYPE: BGP4MP/MESSAGE/Update FROM: 220.127.116.11 AS28571 TO: 18.104.22.168 AS6447 ORIGIN: IGP ASPATH: 28571 1251 20080 7908 NEXT_HOP: 22.214.171.124 ANNOUNCE 126.96.36.199/32 TIME: 03/15/14 17:23:56 TYPE: BGP4MP/MESSAGE/Update FROM: 188.8.131.52 AS52888 TO: 184.108.40.206 AS6447 ORIGIN: IGP ASPATH: 52888 1251 20080 7908 NEXT_HOP: 220.127.116.11 ANNOUNCE 18.104.22.168/32
Our TA would say the attacker's AS was 7908 (BT LATAM Venezuela, S.A). But in my opinion it wasn't, because in my view there is no advantages to be exploited by the attacker if he does redirect traffics to his own AS. Despite of this, I couldn't find any update messages originated by this AS in dump files. In other hand, in the picture above, time of attack has been announced 17:23 and from this time onwards, I couldn't find any interesting messages in dump files.
My question is, can anyone please tell me what's the real AS number of attacker?
Thanks in advance