1

Is there a way to check if a public IPv4 address/Subnet was obtained through illegitimate means by a webhost?

Also, can outright IPv4 hijacking last for years or only for minutes/hours?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 15 '17 at 5:13
1

To be able to advertise a network, you must have the cooperation of the ISP(s) to which you connect. Most will require you to own the network(s) in question, and they will refuse to advertise networks if you can't prove you own them. If problems are caused by an incorrect route to a network, an ISP will work rapidly to correct the problem because other ISPs to which it connects may cut it off.

Someone using a network that belongs to someone else is only hurting himself because he can't get to the legitimate network.

Based on you question about checking from a web host (client), I think you need to be more concerned about a DNS problem.

Improve this answer
0

You can do a search at ARIN to see who the registered owner is for an IP http://whois.arin.net/ui/

As for hijacking, I assume you mean that someone just picks a public IP at random and starts advertising it for their own purposes.

If their local ISP is accepting any advertisements and not filtering them, the bad routes could potentially get propagated until they are filtered at some point.

Improve this answer
4
  • 2
    Not all IP space is registered in ARIN's database, other parts of the world use other RIR's like RIPE, LAPNIC and AFRINIC. – Teun Vink♦ Nov 1 '16 at 15:29
  • Hijacks can last for a very short or long time. Spammers often hijack for a short time so that afterwards it's hard to find out where the spam was really coming from. – Sander Steffann Nov 1 '16 at 15:32
  • 2
    RIPE NCC has built a very nice lookup page at stat.ripe.net where you can cross-reference what is visible in the routing table vs what is registered in IRRs (Internet Routing Registries) – Sander Steffann Nov 1 '16 at 15:34
  • @Teun that's correct, but ARIN will tell you if it's registered somewhere else. Then you can just do a lookup there. – John K. Nov 1 '16 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.