Prefix hijack by INDOSAT AS4795 / AS4761

Thu Mar 26 14:45:09 UTC 2015

On Thu, Mar 26, 2015 at 10:43 AM, Peter Rocca <rocca at start.ca> wrote:
> We just received a similar alert from bgpmon - part of 108.168.0.0/17 is being advertised as /20's - although we're still listed as the origin. We are 40788.
>
> 108.168.64.0/20  4795 4795 4761 9304 40633 18978 6939 40788
> 108.168.80.0/20  4795 4795 4761 9304 40633 18978 6939 40788
> 108.168.96.0/20  4795 4795 4761 9304 40633 18978 6939 40788
> 108.168.112.0/20 4795 4795 4761 9304 40633 18978 6939 40788
>

common point looks like LAIX ? their routeserver go crazy perhaps? or
did they change in/out prefix management information?

> -----Original Message-----
> From: NANOG [mailto:nanog-bounces at nanog.org] On Behalf Of Randy
> Sent: March-26-15 10:08 AM
> To: nanog at nanog.org
> Subject: Prefix hijack by INDOSAT AS4795 / AS4761
>
> On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing
> more specifics on one of our prefixes.   Anyone else seeing similar or
> is it just us?
>
> 198.98.180.0/23 4795 4795 4761 9304 40633 18978 4436 29889
> 198.98.182.0/23 4795 4795 4761 9304 40633 18978 4436 29889
>
> --
> Randy