BGPHorizon

Providing BGP insights and a tool for network engineers and investigators.

[BGPHorizon @BGPHorizon]

39 networks in 30 days sent their own routes with AS1, 2, 3, 5 or 10 added to the end of the path, so monitors saw MIT, UDel or Symbolics as the origin. Some of the prefixes:

200.14.69.0/24 (Universidad de Valparaíso)
209.12.71.0/24 (Level 3) -> Widely observed
160.137.193.0/24 (DoD)
2402:4e00:c060::/44 (Tencent)

#bgp #networking #routing

[BGPHorizon @BGPHorizon]

BGPHorizon detected a drop of ~14,650 ROAs under the APNIC RPKI trust anchor on 4 to 5 Oct.

IDNIC's network lost routes to 85% of peers at 09:01 UTC, its RPKI repository went unreachable, and its ROAs expired from validation until 10:35 UTC. No evidence of hijacks exploiting it.

#bgp #rpki

[BGPHorizon @BGPHorizon]

Automating BGP Analysis: A Deep Dive into the BGPHorizon API & MCP

https://t.co/3ky4qOV7dp

#bgp #mcp #ai

[BGPHorizon @BGPHorizon]

PKTELECOM (AS17557) has originated /24s from T-Mobile US's 172.32.0.0/11 (AS21928) for a few days around the 25th of every month since at least May of this year.

All announcements have violated RPKI since T-Mobile covers the /11. The announcements didn't propagate far.

A detailed report was sent directly to PKTELECOM.

https://t.co/5FKp9veYIY

#bgp #rpki #networking #routing

[BGPHorizon @BGPHorizon]

Lumen's legacy AS203 originated two prefixes held by Cboe Global Markets (Cboe, formerly the Chicago Board Options Exchange):
- 170.137.215.0/24 on Sep 24 for 23 minutes
- 170.137.219.0/24 on Sep 25 for 33 minutes.

Both were RPKI-invalid and propagated via AS3356 (Lumen).

AS203 did the same to 13 other networks' prefixes in the past 30 days, including Walmart and JetPay.

Sep 24: https://t.co/4Djt0qEczb
Sep 25: https://t.co/v3ewzimkgx

#bgp

[BGPHorizon @BGPHorizon]

On 20 Sep, AS197207 (MCCI-AS) announced 419 prefixes that weren't its own for about 30 minutes, all through its upstream AS49666. 85 spread widely. The other 334 barely spread. None of the 419 had a ROA.

@Qrator_Radar spotted it first: https://t.co/GWqjX3KHdQ

The 85 that spread were almost all Iranian space, including some univeristies, Bank Saderat, and the Tehran stock exchange's tech company (TSETMC).

The 334 that barely spread included six /8s, including US DoD blocks (21, 22, 26 and 29/8), each only seen by at most 9 collector sessions.

#bgp #bgphijack

[Radar by Qrator @Qrator_Radar]

🚨 BGP Hijack at 2026-09-20 10:04 UTC

🇮🇷AS197207 (MCCI-AS) announced 190 prefixes, creating 10,865 conflicts with 1,524 ASNs in 100🌏.

🌏Max propagation: 100%
⏱️Duration: 8 min (first part) and 15 min (second part)

[BGPHorizon @BGPHorizon]

BGPHorizon September update

- A public API and MCP server for programmatic and LLM-based access
- A BGP community decoder
- New AS presence maps and prefix timelines
- Improved hijack and outage alerting.

Sign up for free! https://t.co/dhDYsmVdlA

[BGPHorizon @BGPHorizon]

The August 2026 Virtualizor Incident in BGPHorizon

https://t.co/EHIV03XPnG

#virtualizor #bgp #bgphijack #bgphorizon

[BGPHorizon @BGPHorizon]

Using BGPHorizon to Investigate the June 2026 Telegram BGP Hijack

https://t.co/L9iFNu1CP4

#bgp #hijack #bgphorizon