Operations teams everywhere, start writing that playbook for this. On Tue, Dec 9, 2025 at 3:10 PM Christopher Hawker via NANOG <nanog@lists.nanog.org> wrote:
"accidentally reallocated" is a new one to me... You would think that there would be checks and balances in place to prevent this from happening, such as looking for any valid ROAs or route objects in ARIN's IRR database, looking for any existing Whois objects or BGP routes, etc. to make sure the route is not being used or delegated prior to redelegation.
Regards, Christopher Hawker ________________________________ From: Chase via NANOG <nanog@lists.nanog.org> Sent: Wednesday, 10 December 2025 5:19 AM To: nanog <nanog@lists.nanog.org> Cc: Chase <chase@galaxygate.net> Subject: Accidental ARIN Reallocation
Hey NANOG,
After receiving a BGPAlerter notification that one of our subnets (23.150.164.0/24) had been hijacked, I checked and noticed the prefix in question was missing RPKI. Assuming I had fat fingered something and butchered the ROA, I logged into ARIN and found that the prefix was missing from our resource list entirely, and had been reallocated to another organization and announced from their network. I created a ticket in ARIN and called immediately.
They confirmed that our subnet had been accidentally reallocated to another customer, and that they are currently working on returning it to us. After a couple hours, they told us the other organization will stop announcing the prefix, and WHOIS will be returned shortly.
I’m guessing there’s no way to prevent this kind of thing on our side if the RPKI ROA itself is removed along with the allocation? I’m planning on adding checks to look for missing ROAs (in addition to invalid/expiring ones), which I'm guessing would've caught this earlier.
Have any of you had anything like this happen with ARIN or another RIR? I’m especially curious what might have happened if we’d only noticed and reached out a few weeks later instead of within a few minutes.
Best,
Chase Lauer
GalaxyGate, AS397031
https://galaxygate.net _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/5MCMSACQ... _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/XDJIYKX5...
-- - Andrew "lathama" Latham -