104.245.96.0/21 RPKI valid MOAS
Announced by 2 different origins, which is either a deliberate multi-origin setup or a hijack.
This prefix is announced by more than one AS. Compare how many collector
peers see each origin below: a hijack is usually visible as a second
origin seen by far fewer peers than the legitimate one.
Origins
| Origin AS | RPKI | Peers seeing it | Sample path | First seen | Last seen |
|---|---|---|---|---|---|
| AS25820 IT7 Networks Inc | RPKI valid | 42 | 3772125820 | 2026-09-18 | 2026-10-07 |
| AS3214 xTom GmbH | RPKI valid | 1 | 2051412993214 | 2026-10-06 | 2026-10-07 |
RPKI
5 ROAs cover this prefix
| ROA prefix | Max length | Authorised origin | Trust anchor | Result for this route |
|---|---|---|---|---|
| 104.245.96.0/21 | /24 | AS3214 | arin | wrong origin |
| 104.245.96.0/21 | /24 | AS21887 | arin | wrong origin |
| 104.245.96.0/21 | /24 | AS25820 | arin | authorises it |
| 104.245.96.0/21 | /24 | AS210110 | arin | wrong origin |
| 104.245.96.0/21 | /24 | AS400981 | arin | wrong origin |
Registry
Who this address space is delegated to, regardless of whether it is routed
- Delegated block
- 104.245.96.0/21
- RIR
- ARIN
- Country
- 🇨🇦 CA
- Status
- allocated
- Allocated
- 2018-09-19
Less specific routes
Announced prefixes that contain this one
Nothing less specific is announced.
More specific routes
0 announced prefixes inside this one
Nothing more specific is announced.
Recorded changes
| When | Change | Origin | Path |
|---|---|---|---|
| 2026-10-05 22:52:31Z | origin change | AS3214 → AS25820 | 5805717413740925820 |
| 2026-10-05 22:07:15Z | origin change | AS25820 → AS3214 | 2051412993214321432143214 |
| 2026-10-01 10:25:02Z | origin change | AS3214 → AS25820 | 2265217413740925820 |
| 2026-10-01 10:25:02Z | origin change | AS25820 → AS3214 | 2265212993214321432143214 |