Hi Matt, If AS27421 is being originated from an unexpected network in Brazil, I would recommend first confirming the exact prefixes and BGP paths being advertised by the suspected ASN. You can check the announcements and AS paths using tools such as BGPStream, RIPEstat, or HE BGP Toolkit. It would also be worth checking whether the affected prefixes are covered by valid RPKI ROAs. If they are, and the Brazilian announcement is RPKI Invalid, that provides strong evidence of an unauthorized origin. Since you have already contacted the upstream abuse contacts without a response, I would suggest escalating through their upstream/transit providers and the relevant RIR (ARIN for AS27421, and LACNIC for networks involved in Brazil). You can also report the incident to the NOC/security contacts listed in the relevant WHOIS/RDAP records. If there is no traffic impact at the moment, it may be a route leak or limited hijack rather than a full traffic interception. However, I would still recommend documenting the observed prefixes, timestamps, AS paths, and collectors reporting the announcement so you have a clear record for escalation. Hope this helps. Regards, Althaf On Fri, Sep 11, 2026 at 7:56 PM Matt Brennan via NANOG < nanog@lists.nanog.org> wrote:
Hi Folks,
This is a new one for me. One of my AS numbers (AS27421) appears to be being used by someone in Brazil. We haven't seen any actual effects of the hijack -- that is, we don't appear to be losing any traffic. The only reason we noticed is because it's being reported on HE's BGP monitoring site.
I've reached out to the abuse contact for the AS's the hijacker is peering with (AS1000, AS271253 - same abuse contact for both) several times and gotten no response. Though, looking at which prefixes AS271253 is originating, it doesn't appear this AS cares much about proper behavior.
If anyone has any advice on next steps, it would be appreciated.
Thanks, Matt _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/63VQ3WKN...