38.181.42.0/24 RPKI valid MOAS

Announced by 2 different origins, which is either a deliberate multi-origin setup or a hijack.

This prefix is announced by more than one AS. Compare how many collector peers see each origin below: a hijack is usually visible as a second origin seen by far fewer peers than the legitimate one.

Origins

Origin AS	RPKI	Peers seeing it	Sample path	First seen	Last seen
AS140227 Hong Kong Communications International Co., Limited	RPKI valid	39	17639 8796 140227	2026-09-18	2026-09-18
AS8796 FASTNET DATA INC	RPKI valid	1	44393 35710 10099 8796	2026-09-18	2026-09-18

RPKI

13 ROAs cover this prefix

ROA prefix	Max length	Authorised origin	Trust anchor	Result for this route
38.181.0.0/18	/24	AS7607	arin	wrong origin
38.181.0.0/18	/24	AS8796	arin	wrong origin
38.181.0.0/18	/24	AS9886	arin	wrong origin
38.181.0.0/18	/24	AS18186	arin	wrong origin
38.181.0.0/18	/24	AS40115	arin	wrong origin
38.181.0.0/18	/24	AS137535	arin	wrong origin
38.181.0.0/18	/24	AS140042	arin	wrong origin
38.181.0.0/18	/24	AS140096	arin	wrong origin
38.181.0.0/18	/24	AS140224	arin	wrong origin
38.181.0.0/18	/24	AS140227	arin	authorises it
38.181.0.0/18	/24	AS151797	arin	wrong origin
38.181.0.0/18	/24	AS395886	arin	wrong origin
38.181.0.0/18	/24	AS400618	arin	wrong origin

Registry

Who this address space is delegated to, regardless of whether it is routed

Delegated block: 38.0.0.0/8
RIR: ARIN
Country: 🇺🇸 US
Status: allocated
Allocated: 1991-04-16

Less specific routes

Announced prefixes that contain this one

Prefix	Origin	RPKI	Peers	Sample path	First seen
38.0.0.0/8 v4	AS174 Cogent Communications, LLC	no ROA	42	34549 174	2026-09-18

More specific routes

0 announced prefixes inside this one

Nothing more specific is announced.

Recorded changes

When	Change	Origin	Path
2026-09-18 04:38:37Z	origin change	AS140227 → AS8796	44393 35710 10099 8796
2026-09-18 04:38:37Z	origin change	AS8796 → AS140227	61218 6939 8796 140227