37.9.112.0/24 RPKI valid MOAS

Announced by 2 different origins, which is either a deliberate multi-origin setup or a hijack.

This prefix is announced by more than one AS. Compare how many collector peers see each origin below: a hijack is usually visible as a second origin seen by far fewer peers than the legitimate one.

Origins

Origin AS	RPKI	Peers seeing it	Sample path	First seen	Last seen
AS208398 Edge Technology Plus (Yandex)	RPKI valid	34	34549 1299 208398	2026-09-18	2026-09-22
AS13238 YANDEX LLC	RPKI valid	8	37721 13238	2026-09-18	2026-09-22

RPKI

2 ROAs cover this prefix

ROA prefix	Max length	Authorised origin	Trust anchor	Result for this route
37.9.64.0/18	/24	AS13238	ripe	wrong origin
37.9.64.0/18	/24	AS208398	ripe	authorises it

Registry

Who this address space is delegated to, regardless of whether it is routed

Delegated block: 37.9.64.0/18
RIR: RIPENCC
Country: 🇷🇺 RU
Status: allocated
Allocated: 2011-12-14

Less specific routes

Announced prefixes that contain this one

Prefix	Origin	RPKI	Peers	Sample path	First seen
37.9.64.0/18 v4	AS208398 Edge Technology Plus (Yandex)	RPKI valid	34	34549 1299 208398	2026-09-18
37.9.64.0/18 v4	AS13238 YANDEX LLC	RPKI valid	8	37721 13238	2026-09-18

More specific routes

0 announced prefixes inside this one

Nothing more specific is announced.

Recorded changes

When	Change	Origin	Path
2026-09-22 20:35:42Z	origin change	AS208398 → AS13238	61218 6939 13238
2026-09-22 11:36:37Z	origin change	AS13238 → AS208398	852 3491 208398
2026-09-22 11:30:38Z	origin change	AS208398 → AS13238	55720 6939 13238
2026-09-22 10:24:45Z	origin change	AS13238 → AS208398	57821 12586 3257 1299 208398
2026-09-22 10:17:21Z	origin change	AS208398 → AS13238	61218 6939 13238
2026-09-22 10:16:37Z	origin change	AS13238 → AS208398	852 3491 208398
2026-09-22 10:15:21Z	origin change	AS208398 → AS13238	49134 53356 6939 13238
2026-09-22 06:20:27Z	origin change	AS13238 → AS208398	328840 327727 174 208398
2026-09-22 06:19:44Z	origin change	AS208398 → AS13238	37721 13238