What is an RPKI-invalid BGP route?

An RPKI-invalid route is a BGP announcement where the origin ASN does not match any valid Route Origin Authorization (ROA) for that prefix. This can indicate a BGP hijack, where a malicious or misconfigured AS is announcing prefixes it does not own, or an operator error such as an expired or misconfigured ROA.

How does ipctl.io detect BGP hijacks?

ipctl.io compares live BGP routes collected from multiple BGP collector sessions against RPKI ROA data. Routes where the announcing ASN is not authorized by a valid ROA are flagged as RPKI-invalid and surfaced as potential hijacks. The authorized ASN from the ROA and the actual announcing ASN are shown side by side.

What is the difference between a BGP hijack and a route leak?

A BGP hijack occurs when an AS announces a prefix it does not own, intentionally or due to misconfiguration, potentially redirecting traffic. A BGP route leak occurs when a valid prefix is re-announced to peers that should not receive it, violating routing policy but not necessarily involving a stolen prefix. RPKI can detect origin hijacks; ASPA is designed to catch route leaks.

Does RPKI fully prevent BGP hijacks?

RPKI Route Origin Validation (ROV) prevents origin hijacks only when the receiving AS enforces RPKI filtering. If a transit provider does not drop RPKI-invalid routes, those announcements can still propagate. RPKI does not protect against path-based attacks or route leaks - ASPA and BGPsec are being developed to address those.

How often is the RPKI-invalid route list updated?

ipctl.io refreshes BGP routing data and RPKI validation results every 15 minutes from live BGP collector feeds. The hijack table reflects routes currently observed in the global routing table that fail RPKI validation.

HomeBGP Statistics

BGP Routing Table & Hijack Monitor

Global IPv4 and IPv6 routing table size, prefix distribution by RIR, RPKI ROA validation coverage, IRR registration rates, ASPA provider authorization deployment, and live RPKI-invalid routes flagged as potential BGP prefix hijacks.

Last updated: July 5, 2026

IPv4 Prefixes

1,275,179

IPv6 Prefixes

317,007

IPv4 Origins

79,435

IPv6 Origins

37,840

Total ASNs

87,543

New ASNs

Today-

This month-

Past 12 months-

RPKI Coverage

65.0%

+0.78pp

+0.78 percentage points vs 30 days ago

RPKI invalid101,282

Potentially hijacked routes11,219

IPv6 Dual-Stack

38.2%

Dual-stack ASNs30,469

IPv4-only ASNs49,292

ASPA Adoption

ASNs with ASPA

2,374

Transit-Free (AS0)

Top Upstream Providers

#	ASN	Name	Cust.
1	AS6939	HURRICANE - Hurricane Electric LLC	355
2	AS174	COGENT-174 - Cogent Communications, LLC	249
3	AS1299	TWELVE99 Arelion Sweden AB	176
4	AS20473	AS-VULTR - The Constant Company, LLC	150
5	AS212895	ROUTE64_ORG Johannes Ernst	129
6	AS34927	iFog-GmbH iFog GmbH	125
7	AS3356	LEVEL3 - Level 3 Parent, LLC	122
8	AS3257	GTT-BACKBONE GTT Communications Inc.	96
9	AS41051	FREETRANSIT Openfactory GmbH	76
10	AS9002	RETN-AS RETN Limited	72

1–10 of 20

Transit-Free ASNs (AS0)

ASNs declaring no upstream provider

#	ASN	Name	Down.
1	AS174	COGENT-174 - Cogent Communications, LLC	249
2	AS1299	TWELVE99 Arelion Sweden AB	176
3	AS3257	GTT-BACKBONE GTT Communications Inc.	96
4	AS3320	DTAG Deutsche Telekom AG	39
5	AS6830	LibertyGlobal Liberty Global Europe Holding B.V.	28
6	AS7018	ATT-INTERNET4 - AT&T Enterprises, LLC	23
7	AS6777	AMS-IX-RS Amsterdam Internet Exchange B.V.	2
8	AS57328	DDIX-RS BCIX Management GmbH	2
9	AS47200	NIXCZ-RS NIX.CZ z.s.p.o.	2
10	AS215405	FREEIX-GR Antonios A. Chariton	1

1–10 of 50

Potentially Hijacked Routes11,219 invalid

RPKI-invalid routes are BGP announcements where the origin ASN is not authorized by any Route Origin Authorization (ROA). These routes may indicate active prefix hijacks or operator misconfiguration. Routes observed on multiple BGP collectors (higher detection points) are a stronger signal and rank first. Validate specific prefixes via the RPKI lookup tool.

Prefix	Announced by	Authorized (ROA)	Trust Anchor
2001:438:800d::/48	AS7385🇺🇸 ABUL-14-7385 - Allstream Business US, LLC	AS6461max /32 ZAYO-6461 - Zayo Bandwidth	arin
2001:470:42c::/48	AS5065🇺🇸 BUNNY-COMMUNICATIONS-GLOBAL - Bunny Communications	AS10821max /48 PIONEERINTERNET - The Pioneer Telephone Association, Inc.	arin
2001:500:61::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin
2001:500:62::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin
2001:500:63::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin
2001:500:64::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin
2001:500:65::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin
2001:500:66::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin
2001:500:67::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin
2001:500:68::/48	AS1280🇺🇸 ISC-AS-1280 - Internet Systems Consortium, Inc.	AS30133max /48 ISC-F-AS - Internet Systems Consortium, Inc.	arin

Showing 1–10 of 11,219

1 / 1,122

Operational Insights

IRR vs RPKI Coverage

Both RPKI + IRR

762,988

49.2%

RPKI only

313,740

20.2%

IRR only

232,788

15.0%

Neither

241,662

15.6%

Top RPKI-Invalid Offenders

ASN	Name	Invalid Prefixes
🇪🇸AS12715	JAZZNET Orange Espagne SA	7,278
🇭🇰AS9304	HUTCHISON-AS-AP - HGC Global Communications Limited	1,185
🇬🇧AS25160	VORBOSS Vorboss Limited	1,147
🇦🇪AS5384	EMIRATES-INTERNET EMIRATES TELECOMMUNICATIONS GROUP COMPANY (ETISALAT GROUP) PJSC	1,018
AS134773	ChinaNet-Guangdong-Guangzhou-MAN - CHINANET Guangdong province Guangzhou MAN network	625
🇿🇦AS5713	Telkom SA Ltd. - Telkom SA Ltd.	387
🇺🇸AS7011	FRONTIER-AND-CITIZENS - Frontier Communications of America, Inc.	342
🇸🇪AS12552	GlobalConnect-AS12552 GlobalConnect AB	316
🇷🇺AS12389	ROSTELECOM-AS PJSC Rostelecom	308
AS24350	CNGI-BJ-IX4-AS-AP - CERNET2 IX at Beijing University of Posts and Telecommunications	306

Most Deaggregated Networks

ASN	Name	/24 Count	Total Prefixes
🇨🇦AS577	BACOM - Bell Canada	15,626	16,404
🇺🇸AS16509	AMAZON-02 - Amazon.com, Inc.	9,554	15,715
🇨🇳AS9808	CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd.	9,089	14,328
🇩🇪AS31334	KABELDEUTSCHLAND-AS Vodafone GmbH	5,969	6,107
🇲🇽AS8151	AS8151 - UNINET	5,924	13,217
🇹🇷AS47331	TTNET TTNet A.S.

Top Countries by ASN Count

Country	ASNs	Prefixes	IPv4 Addresses
🇺🇸US	18,506	360,045	1,654,534,912
🇧🇷BR	8,761	110,756	129,148,672
🇷🇺RU	5,006	46,590	66,950,912
🇩🇪DE	2,576	38,718	129,329,920
🇬🇧GB	2,272	36,054	96,967,680
🇵🇱PL	2,148	8,869	23,879,936
🇦🇺