BGP hijack detected & BGP route leak detected

I am receiving numerous alerts an hour. Another post said to contact your ISP. I have a VPS with Namecheap.com I sent them the BGP alerts I was getting and they said they do not have a network issue.

Namecheap response:
Regarding bgp traffic, you should investigate in on your end.
The first two alerts are redirected from the site to the same site, but with “Private” marking.

BGP hijack detected

Hijacker ASN: AS37332 - Zimbabwe Online

Victim ASN(s):
30969 - Zimbabwe Online (Private) Ltd.

Prefixes:
41.60 .40.0/21
41.174 .100.0/22
41.174 .112.0/21
41.174 .160.0/20
41.175 .128.0/20

Messages: 88
Peer coount: 19

First detected at: 2024-03-31T20:54:31.693Z
Last detected at: 2024-03-31T20:56:21.761Z

Confidence: Medium

Tags:
irr_new_origin_invalid
irr_old_origin_invalid
irr_old_origin_valid
rpki_new_origin_unknown
rpki_old_origin_unknown

Hide
BGP hijack detected

Hijacker ASN: AS30969 - Zimbabwe Online (Private) Ltd.

Victim ASN(s):
37332 - Zimbabwe Online

Prefixes:
41.174. 160.0/20
41.175. 128.0/20

Messages: 38
Peer coount: 18

First detected at: 2024-03-31T20:53:43.294Z
Last detected at: 2024-03-31T20:57:05.563Z

Confidence: Low

Tags:
bogon_old_origin
irr_new_origin_invalid
irr_old_origin_invalid
rpki_new_origin_unknown
rpki_old_origin_unknown

BGP route leak detected

Routes obtained from: AS16735 - ALGAR TELECOM S/A
Routes leaked by : AS11271 - SENCINET LATAM BRASIL LTDA
Routes leaked to: AS4230 - CLARO S.A.

Prefix count: 1
Origin count: 1
Peer count: 8

First detected at: 2024-03-31T20:24:55Z

BGP hijack detected

Hijacker ASN: AS28889 - LinzNet Internet Service Provider GmbH

Victim ASN(s):
204577 - LinzNet Internet Service Provider GmbH

Prefixes:
185.54. 210.0/24

Messages: 1
Peer coount: 1

First detected at: 2024-03-31T22:16:19.285Z
Last detected at: 2024-03-31T22:16:19.285Z

Confidence: High

Tags:
asrel_sibling_origins
irr_new_origin_invalid
irr_old_origin_valid
rpki_new_origin_invalid
rpki_old_origin_valid

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.