TIME: 03/15/14 17:23:56 TYPE: BGP4MP/MESSAGE/Update FROM: 18.104.22.168 AS28571 TO: 22.214.171.124 AS6447 ORIGIN: IGP ASPATH: 28571 1251 20080 7908 NEXT_HOP: 126.96.36.199 ANNOUNCE 188.8.131.52/32 TIME: 03/15/14 17:23:56 TYPE: BGP4MP/MESSAGE/Update FROM: 184.108.40.206 AS52888 TO: 220.127.116.11 AS6447 ORIGIN: IGP ASPATH: 52888 1251 20080 7908 NEXT_HOP: 18.104.22.168 ANNOUNCE 22.214.171.124/32
Our TA would say the attacker's AS was 7908 (BT LATAM Venezuela, S.A). But in my opinion it wasn't, because in my view there is no advantages to be exploited by the attacker if he does redirect traffics to his own AS. Despite of this, I couldn't find any update messages originated by this AS in dump files. In other hand, in the picture above, time of attack has been announced 17:23 and from this time onwards, I couldn't find any interesting messages in dump files.
My question is, can anyone please tell me what's the real AS number of attacker?
Thanks in advance