comparison of hijack alert systems [was]: prefix hijack by ASN 8997

Scott Weeks surfer at
Tue Sep 23 08:08:46 CDT 2008

On Mon, 22 Sep 2008, Scott Weeks wrote:
> I am hoping to confirm a short-duration prefix hijack

--- hank at wrote:
From: Hank Nussbacher <hank at>

I too spotted this via PHAS for a large number of prefixes, but have not 
received alerts from IAR, Watchmy.Net nor does RIPE RIS show this hijack: I would have expected 
with so many RRC boxes that RIPE RIS would have caught it.  I had thought 
it was a false positive from PHAS but now that you and others have seen it 
- I guess it is for real.

It'd be very interesting to compare said systems using this event.  I have not subscribed to MyASN or yet, so I can't do that.  I do note, however, that PHAS took 4 hours and 20 minutes to email me, which is within the specs noted on their site.


More information about the NANOG mailing list