July 8, 2026

How a BGP hijack actually looks from a looking glass

The first BGP hijack I ever caught did not look like a movie. Nobody was shouting. A /24 we had been announcing for years simply started answering from someone else’s origin ASN in a handful of looking-glass views, and a customer in São Paulo said the site “felt far away.” That is usually how it starts.

A BGP hijack is when another network originates your prefix — or a more-specific slice of it — and the rest of the internet prefers that route. Sometimes it is malice. Sometimes it is a fat-fingered IRR object or a leaked customer route. From the glass, those two look almost the same. The difference is what you do next.

What changes first: origin ASN, not your feelings

Open a looking glass and ask for the prefix, not the domain. You want the RIB, not a traceroute story. The tell is almost always the origin ASN at the right-hand side of the AS path. Yesterday it was yours. Today it is a four-digit ASN you have never billed, sitting in a region you do not peer.

BGP routing table entry for 203.0.113.0/24
Paths: (2 available, best #2)
  64511 99999
    from rrc00 (RIPE NCC)
    Origin IGP, localpref 100
  3356 64500
    from route-views2
    Origin IGP, localpref 100

If half of RIS collectors show the old path and half show the new short one, you are not imagining it — the internet is partitioned.

Then look at the path length. Hijacks love being shorter. A two-AS path to a prefix that used to be six hops away will win in a lot of networks that still pick on AS-path length. If half of RIS collectors show the old path and half show the new short one, you are not imagining it — the internet is partitioned, and that is the most common shape of a leaky or targeted hijack.

More-specifics are the quiet knife

A full /22 can look healthy while a /24 carved out of it is being stolen. Always walk the covering prefix and the children. If 203.0.113.0/22 is still yours but 203.0.113.64/24 is originated by someone else, you will miss it if you only query the aggregate. This is why a BGP lookup that accepts a list of prefixes is more useful than a single pretty map when you are in a hurry.

I keep a text file of every prefix we announce, one per line, including the more-specifics we use for traffic engineering. When something feels off I paste the whole file. The first row that does not match last week’s origin is the row I care about.

RPKI will save you — unless you never signed

If you have a ROA that says “only AS64500 may originate 203.0.113.0/24, maxLength 24,” then a hijacker announcing that /24 from AS99999 should show RPKI invalid in any validator that is actually dropping invalids. That is the whole point of RPKI validation.

ROA:  203.0.113.0/24
ASN:  AS64500
maxLength: 24
state: valid for AS64500
       invalid for AS99999

Two caveats operators still trip over. First, a ROA with a loose maxLength (say /24 allowed up to /32) lets an attacker more-specify inside your authorization. Second, a lot of networks still only tag invalids; they do not drop them. So “it is invalid” is not the same as “the hijack is dead.” Check both the ROA and whether the collectors you trust are treating invalid as unusable.

A ten-minute looking-glass drill

1. Query the exact prefix and the covering aggregate.
2. Write down origin ASN, AS path, and last-update time from at least three collectors on different continents.
3. Run the same prefix through RPKI. Valid, invalid, or unknown?
4. Look up the new origin in ASN explorer — PeeringDB, announced prefixes, upstreams. A brand-new ASN with one prefix and a residential upstream is a different animal than a tier-1 leaking a customer.
5. WHOIS / IRR: does the hijacker have a route object? A forged route object is a hint they planned this. No object at all is a hint they did not.

If the new origin is your own downstream, it is probably a leak. Call them before you call a lawyer. If it is a stranger and RPKI is invalid, you still want a paper trail: screenshots of the glass, RIS dump times, the ROA you published. Hijacks get cleaned up faster when you can show the other NOC exactly what the world sees.

What a hijack is not

A single collector with a weird path is not a hijack. RIS has bad days. A traceroute that takes a scenic route through Frankfurt is not a hijack. An anycast prefix that shows different origins by design is not a hijack. If you only have one view, you do not have a story — you have a rumor.

The glass is a flashlight, not a verdict. Use it to see the path, then use RPKI, IRR, and a phone call to decide what the path means. That is the whole job.