Re: Accidental ARIN Reallocation

[Andrew Latham via NANOG <nanog () lists nanog org>]

Operations teams everywhere, start writing that playbook for this.

On Tue, Dec 9, 2025 at 3:10 PM Christopher Hawker via NANOG
<nanog () lists nanog org> wrote:
> "accidentally reallocated" is a new one to me... You would think that there would be checks and balances in place to 
> prevent this from happening, such as looking for any valid ROAs or route objects in ARIN's IRR database, looking for 
> any existing Whois objects or BGP routes, etc. to make sure the route is not being used or delegated prior to 
> redelegation.
>
> Regards,
> Christopher Hawker
> ________________________________
> From: Chase via NANOG <nanog () lists nanog org>
> Sent: Wednesday, 10 December 2025 5:19 AM
> To: nanog <nanog () lists nanog org>
> Cc: Chase <chase () galaxygate net>
> Subject: Accidental ARIN Reallocation
>
> Hey NANOG,
>
>
>
> After receiving a BGPAlerter notification that one of our subnets (23.150.164.0/24) had been hijacked, I checked and 
> noticed the prefix in question was missing RPKI. Assuming I had fat fingered something and butchered the ROA, I 
> logged into ARIN and found that the prefix was missing from our resource list entirely, and had been reallocated to 
> another organization and announced from their network. I created a ticket in ARIN and called immediately.
>
>
>
> They confirmed that our subnet had been accidentally reallocated to another customer, and that they are currently 
> working on returning it to us. After a couple hours, they told us the other organization will stop announcing the 
> prefix, and WHOIS will be returned shortly.
>
>
>
> I’m guessing there’s no way to prevent this kind of thing on our side if the RPKI ROA itself is removed along with 
> the allocation? I’m planning on adding checks to look for missing ROAs (in addition to invalid/expiring ones), which 
> I'm guessing would've caught this earlier.
>
>
>
> Have any of you had anything like this happen with ARIN or another RIR? I’m especially curious what might have 
> happened if we’d only noticed and reached out a few weeks later instead of within a few minutes.
>
>
>
> Best,
>
> Chase Lauer
>
> GalaxyGate, AS397031
>
> https://galaxygate.net
> _______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/5MCMSACQADNXE65BTK34MQ3PXY4PDETF/
> _______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/XDJIYKX5SEQFAXZDGQDZXVM4QDISB45B/



-- 
- Andrew "lathama" Latham -
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/W674NRSOHX5ZXVMLRW4TXUNOKFJAIRG3/