Re: an IP hijacking attempt

If they had a route record that was close, I Would give them the benefit of doubt.
They do not however as the only records start with 217. And our IPs are 45.

So It Is very strange. Would you send a LOA without a route record?

Brian Turnbow

Not everyone uses RRs, and there is also the possibility that their upstream would register it. Having an RR doesn’t seem definitive either way. I can see reasons to wait on the RR until ready to receive traffic.

-mel via cell

RPKI can be very useful to mitigate an attempt.

I used to process IP LOAs all the time. I never saw a RR attached but usually we did a check against the RIR just to make sure (because we made access-list per interface as well)