According to RIPEStat, 2400::/12 hasn't been seen since Oct 2023, from AS13030 (Init7). I also cannot seem to see any recent announcement of that anywhere in the usual sources, or my internal data. I would say this was an error on Qrator's part. In that case, what more do I must do? Although it didn't seem to happen here, best practice is to always announce 100% of your allocated IPs at all times. This provides protection against someone announcing an umbrella and pulling traffic for any uncovered space. It's not perfect , but protects against general stupid. On Sat, Aug 30, 2025 at 2:59 AM Pirawat WATANAPONGSE via NANOG < nanog@lists.nanog.org> wrote:
Dear Gurus,
Radar tool by Qrator [Reference: https://radar.qrator.net ] claims that Zenlayer Inc. [AS4229] is “umbrella-ing” me by announcing ‘2400::/12’ on top of my more-specific address block. The tool classifies it as a type of hijacking. [Disclaimer: apologies to Zenlayer if you didn’t do it; but that’s the information I received] My neighboring organization also has a more-specific block that falls under The Umbrella too.
However, other tools (https://stat.ripe.net , https://irrexplorer.nlnog.net , https://bgp.he.net , etc.) seem unable to see that particular announcement.
Questions: 1. Is Qrator claim true? (because I have already tried but cannot verify) 2. If so, should I be concerned? Even though I already ROA-ed *and* IRR-ed my own block, but if “the other end” doesn’t validate, it won’t do any good, correct? (Oh, yeah, the other end also has to somehow “not see” my longer-prefix. But that can happen as well, no?) 3. In that case, what more do I must do?
I would extremely appreciate someone helping me out on this matter.
Best Regards,
Pirawat. _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/GT2M54NG...