BGPmon.net /32 hijack alerts

NetSecGuy netsecguy at gmail.com
Fri Jul 26 12:59:54 UTC 2013


BGPMon.net has alerted me to /32 hijacks.  Does anyone have thoughts on
what this might be and if it's malicious or misconfiguration?

Date           OriginAS     Prefix          Type       ASPath
2013.07.24       25459  72.52.11.117/32 A       286 25459 25459 25459
2013.07.24       25459  72.52.11.117/32 A       3333 1103 286 25459 25459
25459
2013.07.24       25459  74.120.64.17/32 A       286 25459 25459 25459
2013.07.24       25459  74.120.64.17/32 A       3333 1103 286 25459 25459
25459
2013.07.24       25459  77.243.235.57/32        A       286 25459 25459
25459
2013.07.24       25459  77.243.235.57/32        A       3333 1103 286 25459
25459 25459
2013.07.24       25459  79.110.92.75/32 A       286 25459 25459 25459
2013.07.24       25459  79.110.92.75/32 A       3333 1103 286 25459 25459
25459
2013.07.24       25459  79.170.88.67/32 A       286 25459 25459 25459
2013.07.24       25459  79.170.88.67/32 A       3333 1103 286 25459 25459
25459
2013.07.24       25459  83.84.194.112/32        A       286 25459 25459
25459
2013.07.24       25459  83.84.194.112/32        A       3333 1103 286 25459
25459 25459
2013.07.24       25459  89.33.242.99/32 A       286 25459 25459 25459
2013.07.24       25459  89.33.242.99/32 A       3333 1103 286 25459 25459
25459
2013.07.24       25459  91.121.183.228/32       A       286 25459 25459
25459
2013.07.24       25459  91.121.183.228/32       A       3333 1103 286 25459
25459 25459
2013.07.24       25459  91.121.82.179/32        A       286 25459 25459
25459
2013.07.24       25459  91.121.82.179/32        A       3333 1103 286 25459
25459 25459
2013.07.24       25459  94.126.8.26/32  A       286 25459 25459 25459
2013.07.24       25459  94.126.8.26/32  A       3333 1103 286 25459 25459
25459
2013.07.24       25459  94.23.207.222/32        A       286 25459 25459
25459
2013.07.24       25459  94.23.207.222/32        A       3333 1103 286 25459
25459 25459
2013.07.24       25459  94.23.40.106/32 A       286 25459 25459 25459
2013.07.24       25459  94.23.40.106/32 A       3333 1103 286 25459 25459
25459
2013.07.24       25459  94.236.46.240/32        A       286 25459 25459
25459
2013.07.24       25459  94.236.46.240/32        A       3333 1103 286 25459
25459 25459
2013.07.24       25459  95.211.113.200/32       A       286 25459 25459
25459
2013.07.24       25459  95.211.113.200/32       A       3333 1103 286 25459
25459 25459
2013.07.24       25459  95.211.211.76/32        A       286 25459 25459
25459
2013.07.24       25459  95.211.211.76/32        A       3333 1103 286 25459
25459 25459

My first thought is leaked null routes.    Is this even worth alerting on?



More information about the NANOG mailing list