Thursday, April 2, 2020

CenturyLink prefix persistently hijacked by Firstlight?

There's a weird case of hijacking prefixes 216.158.168.0/24 and 64.30.26.0/24, which according to RPKI belong to CenturyLink(AS209).

However, these prefixes are advertised since 2016 by Firstlight (AS5738), and according to RIPE Stat the advertisement by AS5738 has much higher BGP visibility. You can check the RIPE Stat widget or this snapshot. AS209 started advertising the prefix only in March 2020.

In RADB AS5738 is the owner of that prefix. However, in WHOIS CenturyLink (AS209) has marked the prefixes as Hijacked.

Back in 2007 these prefixes were advertised by AS16425 (Innevi) which was later acquired by Firstlight, but covering prefixes were advertised by AS19094 (Level3) which was acquired by Centurylink. AS16425 was a customer of AS19094. Is it possible to have some kind of ownership dispute, or it may be prefix squatting? Can CenturyLink register a prefix in RPKI if the prefix ownership is disputed?



No comments:

Post a Comment