206208 looking glass

165.112.0.0/20 RPKI valid MOAS

Announced by 2 different origins, which is either a deliberate multi-origin setup or a hijack.

This prefix is announced by more than one AS. Compare how many collector peers see each origin below: a hijack is usually visible as a second origin seen by far fewer peers than the legitimate one.

Origins

Origin ASRPKI Peers seeing itSample path First seenLast seen
AS30387 National Institutes of Health RPKI valid 41 377213356150291905030387 2026-09-18 2026-09-29
AS3527 National Institutes of Health RPKI valid 3 382292449011537108863527 2026-09-18 2026-09-29

RPKI

2 ROAs cover this prefix

ROA prefixMax lengthAuthorised originTrust anchorResult for this route
165.112.0.0/20 /25 AS30387 arin authorises it
165.112.0.0/16 /25 AS3527 arin wrong origin

Registry

Who this address space is delegated to, regardless of whether it is routed

Delegated block
165.112.0.0/16
RIR
ARIN
Country
🇺🇸 US
Status
allocated
Allocated
1993-05-19

Less specific routes

Announced prefixes that contain this one

Prefix Origin RPKI Peers Sample path First seen
165.112.0.0/16 v4 AS3527 National Institutes of Health RPKI valid 44 1490711164108863527 2026-09-18

More specific routes

4 announced prefixes inside this one

Prefix Origin RPKI Peers First seen
165.112.0.0/21 v4 AS3527 National Institutes of Health RPKI valid 3 2026-09-18
165.112.0.0/21 v4 AS30387 National Institutes of Health RPKI valid 41 2026-09-18
165.112.6.0/23 v4 AS393689 National Library of Medicine RPKI valid 41 2026-09-18
165.112.8.0/22 v4 AS393689 National Library of Medicine RPKI valid 41 2026-09-18

Recorded changes

WhenChangeOriginPath
2026-09-27 20:30:40Z origin change AS3527 → AS30387 140357733561502915029150291905030387303873038730387
2026-09-27 20:03:21Z origin change AS30387 → AS3527 333311032096511537108863527
2026-09-27 20:02:59Z origin change AS3527 → AS30387 3333332033561502915029150291905030387303873038730387
2026-09-27 16:49:46Z origin change AS30387 → AS3527 333311032096511537108863527
2026-09-25 17:16:44Z origin change AS3527 → AS30387 852325733561502915029150291905030387303873038730387
2026-09-25 17:00:13Z origin change AS30387 → AS3527 382292449011537108863527
2026-09-22 07:30:02Z origin change AS3527 → AS30387 852325733561502915029150291905030387303873038730387
2026-09-22 06:46:48Z origin change AS30387 → AS3527 4608757511537108863527
2026-09-22 06:21:09Z origin change AS3527 → AS30387 3772133561502915029150291905030387303873038730387
2026-09-22 06:13:00Z origin change AS30387 → AS3527 4608757511537108863527