Malicious BGP hijacks: Appearances can be deceiving

Pierre Antoine Vervier, Quentin Jacquemart, Johann Schlamp, Olivier Thonnard, Georg Carle, Guillaume Urvoy-Keller, Ernst Biersack, Marc Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

8 Scopus citations


BGP hijacking is a well known threat to the Internet routing infrastructure. There has been considerable interest in developing tools that detect prefix hijacking but such systems usually identify a large number of events, many of them being due to some benign BGP engineering practice or misconfiguration. Ramachandran et al. [1] and later Hu et al. [2] also correlated suspicious routing events with spam and claimed to have found evidence of spammers temporarily stealing prefixes to send spam. In an effort to study at large scale the existence and the prevalence of malicious BGP hijacks in the Internet we developed a system which (i) identifies hijacks using BGP, traceroute and IRR data and (ii) investigates traffic originating from the reported networks with spam and netflow data. In this paper we present a real case where suspicious BGP announcements coincided with spam and web scam traffic from corresponding networks. Through this case study we show that a correlation of suspicious routing events with malicious activities is insufficient to evidence harmful BGP hijacks. We thus question previously reported cases and conclude that identifying malicious BGP hijacks requires additional data sources as well as feedback from network owners in order to reach decisive conclusions. © 2014 IEEE.
Original languageEnglish (US)
Title of host publication2014 IEEE International Conference on Communications, ICC 2014
PublisherIEEE Computer
Number of pages6
ISBN (Print)9781479920037
StatePublished - Jan 1 2014
Externally publishedYes


Dive into the research topics of 'Malicious BGP hijacks: Appearances can be deceiving'. Together they form a unique fingerprint.

Cite this