Prefix hijack by INDOSAT AS4795 / AS4761

Thu Mar 26 15:00:31 UTC 2015

We are AS 10326 130.215.0.0/16 and I just received a BGPmon alert as
well:

130.215.160.0/20 4795 4795 4761 9304 40633 18978 4436 10326
130.215.176.0/20 4795 4795 4761 9304 40633 18978 4436 10326

On Thu, Mar 26, 2015 at 10:45:09AM -0400, Christopher Morrow wrote:
> On Thu, Mar 26, 2015 at 10:43 AM, Peter Rocca <rocca at start.ca> wrote:
> > We just received a similar alert from bgpmon - part of 108.168.0.0/17 is being advertised as /20's - although we're still listed as the origin. We are 40788.
> >
> > 108.168.64.0/20  4795 4795 4761 9304 40633 18978 6939 40788
> > 108.168.80.0/20  4795 4795 4761 9304 40633 18978 6939 40788
> > 108.168.96.0/20  4795 4795 4761 9304 40633 18978 6939 40788
> > 108.168.112.0/20 4795 4795 4761 9304 40633 18978 6939 40788
> >
> 
> common point looks like LAIX ? their routeserver go crazy perhaps? or
> did they change in/out prefix management information?
> 
> > -----Original Message-----
> > From: NANOG [mailto:nanog-bounces at nanog.org] On Behalf Of Randy
> > Sent: March-26-15 10:08 AM
> > To: nanog at nanog.org
> > Subject: Prefix hijack by INDOSAT AS4795 / AS4761
> >
> > On Thursday March 26th 2015 at 12:18 UTC (and on-going) we are seeing
> > more specifics on one of our prefixes.   Anyone else seeing similar or
> > is it just us?
> >
> > 198.98.180.0/23 4795 4795 4761 9304 40633 18978 4436 29889
> > 198.98.182.0/23 4795 4795 4761 9304 40633 18978 4436 29889
> >
> > --
> > Randy