Re: ASN "Hijacked"

[Althaf Navaskhan via NANOG <nanog () lists nanog org>]

Hi Matt,

If AS27421 is being originated from an unexpected network in Brazil, I
would recommend first confirming the exact prefixes and BGP paths being
advertised by the suspected ASN.

You can check the announcements and AS paths using tools such as BGPStream,
RIPEstat, or HE BGP Toolkit. It would also be worth checking whether the
affected prefixes are covered by valid RPKI ROAs. If they are, and the
Brazilian announcement is RPKI Invalid, that provides strong evidence of an
unauthorized origin.

Since you have already contacted the upstream abuse contacts without a
response, I would suggest escalating through their upstream/transit
providers and the relevant RIR (ARIN for AS27421, and LACNIC for networks
involved in Brazil). You can also report the incident to the NOC/security
contacts listed in the relevant WHOIS/RDAP records.

If there is no traffic impact at the moment, it may be a route leak or
limited hijack rather than a full traffic interception. However, I would
still recommend documenting the observed prefixes, timestamps, AS paths,
and collectors reporting the announcement so you have a clear record for
escalation.

Hope this helps.

Regards,
Althaf


On Fri, Sep 11, 2026 at 7:56 PM Matt Brennan via NANOG <
nanog () lists nanog org> wrote:

> Hi Folks,
>
>   This is a new one for me. One of my AS numbers (AS27421) appears to be
> being used by someone in Brazil. We haven't seen any actual effects of the
> hijack -- that is, we don't appear to be losing any traffic. The only
> reason we noticed is because it's being reported on HE's BGP monitoring
> site.
>
>   I've reached out to the abuse contact for the AS's the hijacker is
> peering with (AS1000, AS271253 - same abuse contact for both) several times
> and gotten no response. Though, looking at which prefixes AS271253 is
> originating, it doesn't appear this AS cares much about proper behavior.
>
>   If anyone has any advice on next steps, it would be appreciated.
>
> Thanks,
> Matt
> _______________________________________________
> NANOG mailing list
>
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/63VQ3WKNMBJJFBUTI5ZDO74V2Y3T5IUK/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/SPR2OHLHB7VU7RNAUK4LCXUGZLJEOCYN/