September 3, 2026
How to Spot a BGP Hijack With Free Tools
A hijack does not look like a skull on the login page. It looks like a prefix that suddenly originates from the wrong ASN, or a /24 that appears inside a /22 and steals traffic because routers prefer the more-specific. You can see that from a browser. You do not need a collector rack in your basement.
Name the failure before you screenshot it
| Event | What you see in a lookup |
|---|---|
| Origin hijack | Same prefix, unexpected origin ASN |
| More-specific hijack | A longer prefix appears from a stranger; traffic follows the long one |
| Route leak | A customer or peer announces a path they should only have learned, often with a weird AS_PATH |
| Legitimate anycast or traffic engineering | Multiple origins or paths that the owner intended |
The last row is why you never page the internet on a single collector. Anycast CDNs originate the same prefix from many places. A dual-homed enterprise may originate from two ISPs. Hijack hunting is about unexpected change plus invalid origin, not about “more than one path exists.”
Step 1 — Who originates this address right now?
Paste the victim IP or prefix into IP Lookup or BGP Lookup. Write down:
- Covering prefix (the block actually in the table).
- Origin ASN.
- Whether IPv6 tells the same story.
Compare that origin with RDAP/WHOIS. Registry and live origin should rhyme. They will not be byte-identical — orgs rename — but a bank prefix originating from an offshore VPS ASN is not a rebrand.
Step 2 — Is the origin allowed by RPKI?
Open the RPKI Validator. Valid means a ROA exists for that origin and prefix length. Invalid means a ROA exists and this announcement violates it. Not found means nobody published a ROA; hijacks are still possible and many networks will still accept the route.
Invalid plus a surprise ASN is the closest thing this industry has to a smoking gun. Networks that enforce Route Origin Validation should drop it. Networks that do not will keep sending people into the attacker’s lap. That split is why some regions “work” during a hijack and others do not.
Step 3 — What do other networks see?
A single vantage point lies by omission. Use Looking Glass and compare AS paths from more than one region. Patterns that deserve a ticket:
- One continent has the good origin; another has the stranger.
- Paths suddenly insert an ASN that never appears in PeeringDB for that operator.
- The path is unusually long, then short again — a leak bouncing through a network that should have been a customer-only.
Take notes with timestamps. Hijacks are often brief. A screenshot without a clock is a rumor.
Step 4 — Does forwarding agree with the control plane?
Run traceroute and ping from multiple probes. If looking glasses still show the legitimate origin but traceroute dives into a strange ASN at hop 6, you may be seeing a more-specific that only some peers accepted. If ping works from one city and dies from another, think anycast split or regional acceptance of an invalid route — not “the server is down.”
What is not a hijack
- A CDN IP that geolocates to the wrong country. Anycast geo databases are coarse.
- A corporate prefix that moved from ISP A to ISP B last Tuesday after a circuit cutover.
- RPKI “not found” on a hobby network that never made a ROA.
- ICMP rate-limiting that makes traceroute look like a black hole.
Always ask “did the owner intend this?” before “who do we blame.” Intent leaves traces: matching ROAs, matching RDAP, matching looking-glass views worldwide.
If you operate the victim prefix
Publish ROAs that cover every prefix you actually announce, with the correct origin ASN and a max length tight enough that a /25 cannot hide inside your /24. Turn on ROV for what you accept from peers. Monitor origin changes; do not wait for a customer to tweet.
A ROA is not a firewall for packets already in flight. It is a filter other people can apply. The more of your peers enforce it, the smaller the blast radius.
If you are the curious bystander
Document prefix, old origin, new origin, RPKI state, two looking-glass paths, and a traceroute. Share that bundle. “Twitter said it was hijacked” is not a report.
Work a live case: look up a prefix on BGP Lookup, validate the ROA, then compare regional paths on the Looking Glass.
FAQ
FAQ
Can RPKI stop a path manipulation that keeps the valid origin?
No. Classic ROAs protect origin, not the full AS path. ASPA and similar work try to cover that; adoption is incomplete.
Why did my users in one country break and others did not?
Different networks filter differently. Some honor invalids, some do not. Looking glasses make that disagreement visible.
Is a leaked route the same as a hijack?
Motive differs. A leak is often a fat-fingered export policy. The user-visible damage can be identical.