Prefix hijack by INDOSAT AS4795 / AS4761

Thu Mar 26 14:46:51 UTC 2015

Hi,

2015-03-26 15:08 GMT+01:00 Randy <amps at djlab.com>:
> On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing more
> specifics on one of our prefixes.   Anyone else seeing similar or is it just
> us?
>
> 198.98.180.0/23 4795 4795 4761 9304 40633 18978 4436 29889
> 198.98.182.0/23 4795 4795 4761 9304 40633 18978 4436 29889

We (as3215) are seeing almost the same path with 40633 18978 3257
3215, for some quite a lot of prefixes.

Some alerts from bgpmon:
193.251.32.0/20 271 6939 40633 18978 3257 3215
193.251.32.0/20 271 6939 40633 18978 3257 3215

We are not directly connected to 3257. Looks like 18978 deaggregated
to /20 and reannounced to 40633 (LAIX).

Rgds,
pierre