2605:340:f0d9::/48 RPKI valid MOAS

Announced by 2 different origins, which is either a deliberate multi-origin setup or a hijack.

This prefix is announced by more than one AS. Compare how many collector peers see each origin below: a hijack is usually visible as a second origin seen by far fewer peers than the legitimate one.

Origins

Origin AS	RPKI	Peers seeing it	Sample path	First seen	Last seen
AS11983 Tiktok U.S. Data Security Inc.	RPKI valid	31	34549 174 11983	2026-09-18	2026-09-23
AS396986 Bytedance, Inc. (TikTok)	RPKI valid	2	61218 6939 3356 396986	2026-09-18	2026-09-23

RPKI

2 ROAs cover this prefix

ROA prefix	Max length	Authorised origin	Trust anchor	Result for this route
2605:340:f0d9::/48	/48	AS11983	arin	authorises it
2605:340::/32	/64	AS396986	arin	wrong origin

Registry

Who this address space is delegated to, regardless of whether it is routed

Delegated block: 2605:340::/32
RIR: ARIN
Country: 🇺🇸 US
Status: allocated
Allocated: 2018-10-18

Less specific routes

Announced prefixes that contain this one

Nothing less specific is announced.

More specific routes

0 announced prefixes inside this one

Nothing more specific is announced.

Recorded changes

When	Change	Origin	Path
2026-09-21 05:08:25Z	origin change	AS396986 → AS11983	216285 8280 6762 174 11983
2026-09-20 04:44:58Z	origin change	AS11983 → AS396986	34800 29632 9002 3356 396986 396986 396986
2026-09-18 05:35:31Z	origin change	AS396986 → AS11983	49432 48362 1299 174 11983