bgpmap

How to spot a BGP hijack on a map

Updated 20 October 2026

A BGP hijack is a network announcing address space it does not hold, so that traffic meant for the real holder goes to it instead. In public route data it leaves three kinds of trace, and each of them has a harmless look-alike.

What a map can and cannot tell you

A map shows the AS paths that route collectors see for one prefix. It does not know who is entitled to announce that prefix. To judge that you compare the map with something else: the AS you expect to be the origin, the registry record for the address block, or the ROA the holder has published in RPKI. The map is where you notice that something differs, not where you prove it.

A different origin

The origin is the last AS on every path, drawn in the bottom row of the map. If the network you know announces the prefix is missing, or a second origin has appeared beside it, start there.

The harmless explanations are common. A company may have moved the prefix to a new provider or merged two AS numbers into one. A DDoS protection service may announce a customer's prefix from its own AS for as long as an attack lasts, which changes the origin for hours or days. A customer may also announce its provider's space under the provider's number by agreement. A hijack usually looks different: an unrelated network, announced from a place the holder has no presence, and seen by only some of the collector peers.

Two origins at once

When collector peers disagree about the origin, the prefix has multiple origins, often called MOAS. Some of those are legitimate, for example two AS numbers run by the same organisation. A hijack tends to show up as a second origin with a small share of the peers behind it, because the false route spreads further in some places than in others. Compare the share of paths each origin carries on the paths table, and look at whether the second AS has any connection to the first.

A more specific prefix

Routers prefer the longest matching prefix, whatever the AS path length says. A network that announces a smaller piece of someone else's block, a /24 inside a /22, attracts the traffic for that piece even though the real announcement stays in place. The 2008 YouTube outage worked this way. Pakistan Telecom (AS17557) announced 208.65.153.0/24, which sits inside YouTube's 208.65.152.0/22, and the route spread beyond Pakistan, so for about two hours much of the Internet could not reach YouTube.

So check the neighbours of the prefix you care about. Search for each smaller prefix inside it on its own and read its origin. A /24 with an unfamiliar origin inside a block you know is worth a closer look.

A leak is not a hijack

A route leak is a legitimate route passed to neighbours it should not have gone to. The origin is correct, but a customer network suddenly appears as the way between two large providers, and traffic follows it. RFC 7908 describes the common types. On a map a leak shows as a path through a small network sitting between networks that normally connect to each other directly. The fix is on the leaker's side, but the picture on the map is the same shape as a hijack until you check the origin.

Checks before you call it a hijack

If it looks wrong

Tell the holder first, using the contact from whois, and the networks that carry the strange route on the paths you see. A hijack stops when the network announcing it withdraws the route or when its providers filter it, and both happen faster when someone has pointed at the exact prefix and origin. For a calm baseline, 1.1.1.0/24 has a single origin, AS13335, on every path.

The guides on AS paths and finding the origin of an IP address cover the reading side in more detail.

More guides