Just noticed another thing:
➜ ~ whois -h whois.ripe.net – “–list-versions AS1299” | tail -n10
2862 2022-07-11T14:44:49Z ADD/UPD
2863 2022-07-27T11:17:25Z ADD/UPD
2864 2022-08-02T08:43:02Z ADD/UPD
2865 2022-08-10T12:11:29Z ADD/UPD
2866 2022-08-17T10:47:43Z ADD/UPD
2867 2022-08-18T12:53:37Z ADD/UPD
% This query was served by the RIPE Database Query Service version 1.103 (WAGYU)
➜ ~ whois -h whois.ripe.net – “–show-version 2865 AS1299” | grep 209243
➜ ~ whois -h whois.ripe.net – “–show-version 2866 AS1299” | grep 209243
import: from AS209243 accept AS209243
mp-import: afi ipv6 from AS209243 accept AS209243
➜ ~ whois -h whois.ripe.net – “–show-version 2867 AS1299” | grep 209243
import: from AS209243 accept AS-SET209243
mp-import: afi ipv6 from AS209243 accept AS-SET209243
Looks like the first thing that AS209243 had done after they got AS1299 transit is … hijacking an Amazon prefix …?