On February 24, 2008, Pakistan Telecom read YouTube's real prefix from public routing tables and knocked out 2 hours of site access for much of the world. RIPE NCC and Google Research reconstructed the entire incident from public data, without any special access. The same data that made the attack possible is still available for query today.
BGP routing tables are the most honest infrastructure record on the internet. Organizations cannot hide their IP allocations, hosting relationships, or infrastructure topology from autonomous system records. A practitioner who knows how to query them reconstructs the full external footprint in minutes, without sending a single packet to the target.
BGP Trust Was Designed for Transparency, Not Security
BGP-4 (RFC 1771, 1995; reaffirmed by RFC 4271, 2006) defines no authentication mechanism for prefix announcements. Each UPDATE message is a public claim of IP block ownership, propagated to all peers without cryptographic verification. This is not a design flaw. It is the design.
Every autonomous network on the internet receives an Autonomous System Number (ASN), a unique identifier publicly tied to the organization that holds it. The 5 Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) record every IP and ASN allocation in publicly queryable WHOIS databases, with no authentication required. More than 900,000 routes exist in global routing tables.
The University of Oregon's RouteViews project and RIPE RIS collect and publish this data for free, with continuous history going back to 1997. Any researcher can establish a read-only BGP session with public route collectors and receive the same feed any backbone router receives. RPKI adoption has reached only 45% of global prefixes (MANRS, 2024). The rest operates on reputation-based trust: the same 1995 model, public by default.
The same data that lets routers worldwide agree on who owns which address blocks is the data an OSINT investigator queries to map infrastructure. Transparency is a prerequisite for protocol operation, not an accidental byproduct.
Hijacking Incidents Proved the Data Is Accurate
On February 24, 2008, Pakistan Telecom (AS17557) identified YouTube's real prefix in public tables and announced a more specific route for block 208.65.153.0/24. PCCW Global (AS3491) propagated the announcement globally. The incident caused between 30 minutes and over 2 hours of disruption, depending on the geographic point of observation.
RIPE NCC and Google Research reconstructed every step of the incident using RouteViews and RIPE RIS data. The complete timeline, the AS path, and the affected prefix were fully visible in public collectors. The same dataset that documented the hijack is what OSINT practitioners query in infrastructure investigations.
China Telecom (AS23724) in April 2010 correctly identified roughly 37,000 real prefixes in BGP tables, including US .gov and .mil blocks. The hijack lasted 18 minutes and affected approximately 12% of global routes at the time. In each case, the attacker read the same public tables before acting.
In April 2020, Rostelecom (AS12389) hijacked 8,800 prefixes from Google (AS15169), Amazon (AS16509), Cloudflare (AS13335), Facebook, and Akamai, all located via public ASN queries. The AS path followed was AS12389 to Rascom (AS20764) to Cogent (AS174) to Level3 (AS3356). Knowledge of the victims' infrastructure came from the same open sources any investigator accesses.
One ASN Query Returns Every IP Block an Organization Has Ever Announced
An organization's autonomous system number is the key to its complete IP address inventory. A query to bgp.he.net with the company name returns the ASN, all announced prefixes, the peers, and years of routing history. The stat.ripe.net/data/announced-prefixes endpoint returns programmatically every prefix announced by any ASN, with no authentication.
OWASP Amass automates the full mapping with amass intel -org "Target Corp", querying BGPView, ARIN, RADb, Robtex, and BGPTools in parallel. CAIDA's AS2org dataset maps every ASN to the registered organization, making it possible to aggregate all IP space under a single corporate entity, including subsidiaries and acquisitions with distinct ASNs. The result is an IP ownership graph derived entirely from public records.
OWASP Amass automates this enrichment: amass intel -asn <ASN> returns all announced prefixes, resolves PTRs, and cross-references against declared surface endpoints.
Passive BGP Monitoring Detects Infrastructure Changes Before DNS or Certificates Update
BGP UPDATE messages are broadcast publicly in real time to any subscribed collector. RIPE RIS Live provides a WebSocket stream of UPDATE messages from more than 25 global collectors. Any prefix announcement or withdrawal becomes visible within seconds, without any special access.
RouteViews publishes routing table snapshots every 15 minutes and continuous UPDATE streams from around 200 peer ASes, with a public archive going back to 1997. ARTEMIS (CAIDA, 2018) detects unauthorized prefix announcements within 1 minute using public collector feeds. Qrator Radar offers commercial monitoring over the same open data, with configurable alerts by ASN or prefix. BGP.tools offers the equivalent free alternative, with prefix history and hijack alerts by ASN.
Route changes signal infrastructure movements before DNS propagates. When an organization migrates from owned infrastructure to AWS, the change in AS origination becomes visible in BGP tables before any DNS record update. New AS announcements reveal cloud migrations and address space acquisitions before any public disclosure.
A new prefix originated by a different CDN AS signals a provider switch. A prefix withdrawal followed by a new announcement from another AS signals a datacenter migration. These changes are visible in the passive feed before any TLS certificate is issued for the new address.
45% RPKI Coverage Means the Rest of the Internet Has No Cryptographic Shield Against Attribution
RPKI (Resource Public Key Infrastructure) was designed to validate route origin authenticity, not to conceal ownership. Route Origin Authorizations (ROAs) cryptographically sign which AS can originate a prefix. Cloudflare's July 2023 report shows that only 45% of internet prefixes have ROA coverage (2023-2024 data; check stats.labs.apnic.net/rpki for updated metrics) and only 6.5% of internet users are behind networks with active ROV.
RFC 6811 defines BGP prefix origin validation. Even prefixes with valid RPKI expose their origin publicly: the ASN, the IP block, and the organization record remain visible in all public data. The standard authenticates ownership but does not hide it.
For defenders, any prefix without a valid ROA carries 2 simultaneous risks: it is vulnerable to misattribution in a hijacking and it is an OSINT surface with no technical barrier. The Internet Routing Registry (IRR), which predates RPKI, contains route objects queryable via RADb, RIPE IRR, and ARIN IRR with a longer history. Many organizations have IRR data going back years before any RPKI coverage, making the record even more complete for historical investigation.
Organizations concerned about BGP-based mapping can start by publishing ROAs. That closes the cryptographic gap but does not erase the routing history. The footprint is already exposed.
Limitations: organizations behind CDNs or reverse proxies (Cloudflare, Akamai, Fastly) do not originate their own prefixes publicly; the BGP table shows the CDN's ASNs, not the servers. By Cloudflare's estimates, more than 20% of global web traffic passes through AS13335. For these targets, the right approach is to correlate CDN IP ranges with CT certificate records and origin HTTP headers.
Query the ASN before the scan. A single query to stat.ripe.net, bgp.he.net, or Amass returns every IP block an organization owns, every provider carrying its traffic, and years of routing history, without a single packet sent to the target. BGP routing tables were designed to be public. Every organization has already disclosed its infrastructure.
Top comments (0)