156.227.128.0/24 RPKI valid MOAS

Announced by 2 different origins, which is either a deliberate multi-origin setup or a hijack.

This prefix is announced by more than one AS. Compare how many collector peers see each origin below: a hijack is usually visible as a second origin seen by far fewer peers than the legitimate one.

Origins

Origin AS	RPKI	Peers seeing it	Sample path	First seen	Last seen
AS17561 LARUS Limited	RPKI valid	26	58057 174 17497 17561	2026-10-19	2026-11-02
AS134494 Code For Host Inc Ltd	RPKI valid	16	34549 4229 29752 62610 134494	2026-11-02	2026-11-02

RPKI

2 ROAs cover this prefix

ROA prefix	Max length	Authorised origin	Trust anchor	Result for this route
156.227.128.0/24	/24	AS17561	afrinic	authorises it
156.227.128.0/24	/24	AS134494	afrinic	wrong origin

Registry

Who this address space is delegated to, regardless of whether it is routed

Delegated block: 156.224.0.0/11
RIR: AFRINIC
Country: 🇸🇨 SC
Status: allocated
Allocated: 2015-12-22

Less specific routes

Announced prefixes that contain this one

Nothing less specific is announced.

More specific routes

0 announced prefixes inside this one

Nothing more specific is announced.

Recorded changes

When	Change	Origin	Path
2026-11-02 12:36:10Z	origin change	AS134494 → AS17561	204092 34019 3303 174 17497 17561
2026-11-02 09:40:34Z	origin change	AS17561 → AS134494	49432 48362 4229 29752 62610 134494
2026-11-02 04:42:49Z	origin change	AS134494 → AS17561	37989 56300 132132 4657 174 17497 17561
2026-11-02 04:41:50Z	origin change	AS17561 → AS134494	202365 50673 4229 29752 62610 134494
2026-11-02 04:41:41Z	origin change	AS134494 → AS17561	55720 2914 174 17497 17561
2026-11-02 04:41:23Z	origin change	AS134494 → AS17561	49432 215510 31543 174 17497 17561
2026-11-02 04:41:23Z	origin change	AS17561 → AS134494	208972 4229 29752 62610 134494
2026-11-02 04:41:23Z	origin change	AS17561 → AS134494	37721 4229 29752 62610 134494