DFOH

We report new AS links in near real time (with a five-minutes delay) and observed within the last 24 hours.
We highlight the suspicious cases in red. You can click on a row in the table to see more details about a particular case.
For the live version, we only run DFOH with a confidence level of one and only use RIPE RIS data.

You can use the form below to apply filters on the listed cases.

Attacker

Victim

Show recurrent cases Recurrent cases are links that are recurrently being classified as suspicious.

Show local cases Local cases are observed only from vantage points located in the AS of the attacker.
They account for about 4% of the cases and are likely legitimate cases.

Show cases with invalid origin These cases are not forged-origin hijacks and can be accurately detected with other systems such as ARTEMIS or BGPAlerter. They account for around 13% of the cases. Only show a certain type of hijack

We found 0 new AS links during the last 24 hours among which 0 are suspicious.

ID	Date	AS link	# of AS paths	DFOH inference

DFOH

A System to Detect Forged-Origin BGP Hijacks