Operations teams everywhere, start writing that playbook for this. On Tue, Dec 9, 2025 at 3:10 PM Christopher Hawker via NANOG <[email protected]> wrote: > > "accidentally reallocated" is a new one to me... You would think that there > would be checks and balances in place to prevent this from happening, such as > looking for any valid ROAs or route objects in ARIN's IRR database, looking > for any existing Whois objects or BGP routes, etc. to make sure the route is > not being used or delegated prior to redelegation. > > Regards, > Christopher Hawker > ________________________________ > From: Chase via NANOG <[email protected]> > Sent: Wednesday, 10 December 2025 5:19 AM > To: nanog <[email protected]> > Cc: Chase <[email protected]> > Subject: Accidental ARIN Reallocation > > Hey NANOG, > > > > After receiving a BGPAlerter notification that one of our subnets > (23.150.164.0/24) had been hijacked, I checked and noticed the prefix in > question was missing RPKI. Assuming I had fat fingered something and > butchered the ROA, I logged into ARIN and found that the prefix was missing > from our resource list entirely, and had been reallocated to another > organization and announced from their network. I created a ticket in ARIN and > called immediately. > > > > They confirmed that our subnet had been accidentally reallocated to another > customer, and that they are currently working on returning it to us. After a > couple hours, they told us the other organization will stop announcing the > prefix, and WHOIS will be returned shortly. > > > > I’m guessing there’s no way to prevent this kind of thing on our side if the > RPKI ROA itself is removed along with the allocation? I’m planning on adding > checks to look for missing ROAs (in addition to invalid/expiring ones), which > I'm guessing would've caught this earlier. > > > > Have any of you had anything like this happen with ARIN or another RIR? I’m > especially curious what might have happened if we’d only noticed and reached > out a few weeks later instead of within a few minutes. > > > > Best, > > Chase Lauer > > GalaxyGate, AS397031 > > https://galaxygate.net > _______________________________________________ > NANOG mailing list > https://lists.nanog.org/archives/list/[email protected]/message/5MCMSACQADNXE65BTK34MQ3PXY4PDETF/ > _______________________________________________ > NANOG mailing list > https://lists.nanog.org/archives/list/[email protected]/message/XDJIYKX5SEQFAXZDGQDZXVM4QDISB45B/
-- - Andrew "lathama" Latham - _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/[email protected]/message/W674NRSOHX5ZXVMLRW4TXUNOKFJAIRG3/
