164.156.0.0/20 no ROA MOAS

Announced by 2 different origins, which is either a deliberate multi-origin setup or a hijack.

This prefix is announced by more than one AS. Compare how many collector peers see each origin below: a hijack is usually visible as a second origin seen by far fewer peers than the legitimate one.

Origins

Origin AS	RPKI	Peers seeing it	Sample path	First seen	Last seen
AS18756 Level 3 Parent, LLC	no ROA	24	14907 3356 18756	2026-09-18	2026-09-21
AS10753 Level 3 Parent, LLC	no ROA	19	37721 3356 10753	2026-09-18	2026-09-21

RPKI

No ROA covers this prefix

No ROA covers this prefix, so origin validation returns "unknown". That is not a fault; most of the table is still unsigned.

Registry

Who this address space is delegated to, regardless of whether it is routed

Delegated block: 164.156.0.0/16
RIR: ARIN
Country: 🇺🇸 US
Status: allocated
Allocated: 1993-03-19

Less specific routes

Announced prefixes that contain this one

Prefix	Origin	RPKI	Peers	Sample path	First seen
164.156.0.0/16 v4	AS10753 Level 3 Parent, LLC	no ROA	19	37721 3356 10753	2026-09-18
164.156.0.0/16 v4	AS18756 Level 3 Parent, LLC	no ROA	24	14907 3356 18756	2026-09-18

More specific routes

0 announced prefixes inside this one

Nothing more specific is announced.

Recorded changes

When	Change	Origin	Path
2026-09-19 21:35:09Z	origin change	AS18756 → AS10753	34549 2914 3356 10753
2026-09-19 21:32:59Z	origin change	AS10753 → AS18756	206499 34549 2914 3356 18756
2026-09-19 08:44:00Z	origin change	AS18756 → AS10753	328840 327727 174 3356 10753
2026-09-19 08:30:28Z	origin change	AS10753 → AS18756	29504 15935 174 3356 18756
2026-09-18 20:59:19Z	origin change	AS18756 → AS10753	328840 327727 174 3356 10753
2026-09-18 20:22:38Z	origin change	AS10753 → AS18756	49673 3216 3356 18756
2026-09-18 14:03:03Z	origin change	AS18756 → AS10753	328840 327727 174 3356 10753