Summary

  • Sanjaya and LACNIC’s Carlos Martinez presented three July 2025 hijacks of LACNIC address space: roughly 20, 15 and five minutes on 9, 10 and 12 July.
  • An attacker impersonated the legitimate ASN holder with forged letterhead and a lookalike domain to obtain transit; the real holder was another victim.

An undelivered email is a small clue for a large crime. In July 2025, a complaint to LACNIC’s helpdesk led investigators to three brief BGP hijacks of its address space. They began at 19:47 on 9 July, 20:34 on 10 July and 10:13 on 12 July, all UTC−3; they lasted about 20, 15 and five minutes. A thief had enough time to make the Internet take a wrong turn, then disappear before the next coffee break.

Sanjaya of APNIC and Carlos Martinez of LACNIC presented the investigation in February 2026. LACNIC escalated to APNIC; APNIC contacted Indonesia’s APJII/IDNIC. The ASN’s real holder, a small ISP, had ordered no such service. The attacker used its letterhead and a deceptively similar domain to persuade a multinational transit provider to turn up a BGP connection. Once inside, the attacker used the stolen AS as transit and announced short-lived routes from other spoofed origin ASNs.

The jointly authored LACNIC account describes the genuine holder as a victim. Its report to the transit provider ended the fraudulent session; APJII/IDNIC and the holder shared a final investigation with both RIRs. APNIC’s own session report records the cross-region presentation. The public records do not name the provider or measure diverted traffic, so the demonstrated failure is the opening of an unauthorized path, not a quantified loss.

Sanjaya’s case places the first decisive signature on a mundane desk: the one that accepts a new customer. A route can look technically plausible after a provider has accepted a forged corporate identity. The control question is who verified the person asking to speak for an ASN before anyone enabled the session.