Prefix 31.148.149.0/24
is normally announced by AS212463 HE shows belongs to <a href="https://dataline.ua/en/" rel="nofollow">https://dataline.ua/en/</a>
which is a Ukrainian company. <a href="https://bgp.he.net/AS35297" rel="nofollow">https://bgp.he.net/AS35297</a><p>Is now being announced by AS35004 which HE shows is Ukrainian hosting provider <a href="https://netgroup.ua/" rel="nofollow">https://netgroup.ua/</a><p>But the "Country of origin" of the AS is listed as Russian, which is perhaps where the confusion comes from.
<a href="https://bgp.he.net/AS35004" rel="nofollow">https://bgp.he.net/AS35004</a><p>About 95% of new AS35004's traffic goes through this peer: (which is Ukrainian)
<a href="https://bgp.he.net/AS13249" rel="nofollow">https://bgp.he.net/AS13249</a><p>And this peer: (which is Ukrainian)
<a href="https://bgp.he.net/AS3326" rel="nofollow">https://bgp.he.net/AS3326</a><p>Both of which Peer with Cogent.<p>What is interesting is that Cogent today decided to cut service to Russia.
<a href="https://www.reuters.com/technology/us-firm-cogent-cutting-internet-service-russia-2022-03-04/" rel="nofollow">https://www.reuters.com/technology/us-firm-cogent-cutting-in...</a><p>If I was an ISP had networks from UA and RU and my Cogent peering was removed from Russia, I might move some of my traffic through my partner in Ukraine, who does have a peering arrangement with Cogent. I haven't confirmed that is what happened, but you would see this kind of shift I think if they did that.<p>I'm a security guy and not a CCIE so perhaps a Cisco engineer here can weigh in.
It is quite plausible that Russia would try to take down parts of Ukraine internet given everything going on.<p>Alternatively, could simply be someone fat-fingering things, given the insane numbers of blocks that RosKomNadzon has been putting in today (Facebook, Twitter, etc)
Gentle reminder: You can still generate valid TLS certificates for arbitrary domains with BGP hijack. Hide yo logins, hide yo passwords, and hide yo persistent sessions too, they hijackin' errrbudy up in here
This says the prefix being announced by two ASNs is only a /24, which is kind of narrow for a hijack? Considering the countries involved, reporting this as a hijack will inevitably lead to people assuming it is related to the current conflict.