BGPmon.net /32 hijack alerts

Mailman List Mirror (Read Only)
1

BGPMon.net has alerted me to /32 hijacks. Does anyone have thoughts on
what this might be and if it's malicious or misconfiguration?

Date OriginAS Prefix Type ASPath
2013.07.24 25459 72.52.11.117/32 A 286 25459 25459 25459
2013.07.24 25459 72.52.11.117/32 A 3333 1103 286 25459 25459
25459
2013.07.24 25459 74.120.64.17/32 A 286 25459 25459 25459
2013.07.24 25459 74.120.64.17/32 A 3333 1103 286 25459 25459
25459
2013.07.24 25459 77.243.235.57/32 A 286 25459 25459
25459
2013.07.24 25459 77.243.235.57/32 A 3333 1103 286 25459
25459 25459
2013.07.24 25459 79.110.92.75/32 A 286 25459 25459 25459
2013.07.24 25459 79.110.92.75/32 A 3333 1103 286 25459 25459
25459
2013.07.24 25459 79.170.88.67/32 A 286 25459 25459 25459
2013.07.24 25459 79.170.88.67/32 A 3333 1103 286 25459 25459
25459
2013.07.24 25459 83.84.194.112/32 A 286 25459 25459
25459
2013.07.24 25459 83.84.194.112/32 A 3333 1103 286 25459
25459 25459
2013.07.24 25459 89.33.242.99/32 A 286 25459 25459 25459
2013.07.24 25459 89.33.242.99/32 A 3333 1103 286 25459 25459
25459
2013.07.24 25459 91.121.183.228/32 A 286 25459 25459
25459
2013.07.24 25459 91.121.183.228/32 A 3333 1103 286 25459
25459 25459
2013.07.24 25459 91.121.82.179/32 A 286 25459 25459
25459
2013.07.24 25459 91.121.82.179/32 A 3333 1103 286 25459
25459 25459
2013.07.24 25459 94.126.8.26/32 A 286 25459 25459 25459
2013.07.24 25459 94.126.8.26/32 A 3333 1103 286 25459 25459
25459
2013.07.24 25459 94.23.207.222/32 A 286 25459 25459
25459
2013.07.24 25459 94.23.207.222/32 A 3333 1103 286 25459
25459 25459
2013.07.24 25459 94.23.40.106/32 A 286 25459 25459 25459
2013.07.24 25459 94.23.40.106/32 A 3333 1103 286 25459 25459
25459
2013.07.24 25459 94.236.46.240/32 A 286 25459 25459
25459
2013.07.24 25459 94.236.46.240/32 A 3333 1103 286 25459
25459 25459
2013.07.24 25459 95.211.113.200/32 A 286 25459 25459
25459
2013.07.24 25459 95.211.113.200/32 A 3333 1103 286 25459
25459 25459
2013.07.24 25459 95.211.211.76/32 A 286 25459 25459
25459
2013.07.24 25459 95.211.211.76/32 A 3333 1103 286 25459
25459 25459

My first thought is leaked null routes. Is this even worth alerting on?

2

We had similar cases. In most cases they appeared to be indeed leaked null routes.

3

I'll poke AS 25459, they are fellow Dutchies

Kind regards,

Job