{"copyright":"This data is Copyright (c) 2021 Georgia Tech Research Corporation. All Rights Reserved.","data":[{"asinfo":{"197540":{"asrank":{"asn":"197540","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"netcup-AS","organization":{"country":{"iso":"DE"},"orgId":"ORG-NG51-RIPE"},"rank":12482},"hegemony":0},"47147":{"asrank":{"asn":"47147","asnDegree":{"customer":63,"peer":1419,"provider":6},"asnName":"AS-ANX","organization":{"country":{"iso":"AT"},"orgId":"ORG-AIG10-RIPE"},"rank":497},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":4,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":4,"name":"outdated-info"},{"count":4,"name":"irr-RADB-all-oldcomer-no-record"},{"count":4,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":4,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":4,"name":"irr-BELL-all-oldcomer-no-record"},{"count":4,"name":"irr-RIPE-all-newcomer-no-record"},{"count":4,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":4,"name":"all-oldcomers-manrs-member"},{"count":4,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":4,"name":"irr-APNIC-all-newcomer-no-record"},{"count":4,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":4,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":4,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":4,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":4,"name":"irr-BBOI-all-newcomer-no-record"},{"count":4,"name":"irr-ARIN-all-newcomer-no-record"},{"count":4,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":4,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":4,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":4,"name":"irr-TC-all-newcomer-no-record"},{"count":4,"name":"all-victims-stub-ases"},{"count":4,"name":"all-newcomers-are-rel-upstream"},{"count":4,"name":"irr-REACH-all-newcomer-no-record"},{"count":4,"name":"all-newcomers-manrs-member"},{"count":4,"name":"oldcomer-newcomer-all-siblings"},{"count":2,"name":"previously-announced-by-all-newcomers"},{"count":4,"name":"some-newcomers-are-rel-neighbor"},{"count":4,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":4,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":4,"name":"irr-REACH-all-oldcomer-no-record"},{"count":4,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":4,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":4,"name":"some-newcomers-are-providers"},{"count":4,"name":"rpki-all-oldcomer-valid-roa"},{"count":4,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":4,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":3,"name":"rpki-some-newcomer-valid-roa"},{"count":3,"name":"rpki-all-newcomer-valid-roa"},{"count":4,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":4,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":4,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":4,"name":"irr-RIPE-all-oldcomer-exact-record"},{"count":4,"name":"all-newcomers-are-providers"},{"count":4,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":4,"name":"some-newcomers-are-rel-upstream"},{"count":4,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":4,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":4,"name":"oldcomer-newcomer-some-siblings"},{"count":4,"name":"irr-BELL-all-newcomer-no-record"},{"count":4,"name":"irr-all-newcomer-no-record"},{"count":4,"name":"irr-TC-all-oldcomer-no-record"},{"count":4,"name":"single-rel-upstream-chain"},{"count":4,"name":"rpki-some-oldcomer-valid-roa"},{"count":4,"name":"irr-PANIX-all-newcomer-no-record"},{"count":4,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":4,"name":"irr-RADB-all-newcomer-no-record"},{"count":4,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":4,"name":"all-newcomers-are-rel-neighbor"},{"count":4,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":4,"name":"some-victims-stub-ases"},{"count":4,"name":"all-newcomers-ris-peer"},{"count":4,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":4,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":2,"name":"not-previously-announced-by-any-newcomer"}],"pfx_events_cnt":4,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0019881725311279297,"proc_time_tagger":2.129741907119751,"total_tags_cnt":69},"event_type":"moas","finished_ts":null,"id":"moas-1776599700-197540_47147","insert_ts":1776601759,"last_modified_ts":1776601759,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"prefix":"152.53.60.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"all-newcomers-ris-peer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":99,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are siblings; potentially forgot to issue correct ROAs for all origins","inference_id":"rpki-all-newcomers-invalid-and-siblings","labels":["misconfig","incident"],"suspicion_level":30}],"prefix":"159.195.140.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"all-newcomers-ris-peer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"prefix":"152.53.200.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"all-newcomers-ris-peer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"prefix":"152.53.104.0/22","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"all-newcomers-ris-peer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["197540","47147"],"attackers":["47147"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are siblings; potentially forgot to issue correct ROAs for all origins","inference_id":"rpki-all-newcomers-invalid-and-siblings","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"Event has prefix events with different inferences that map to different classes.","inference_id":"mixed-legitimate-misconfig","labels":["mixed-class"],"suspicion_level":30}},"newcomers":["47147"],"prefixes":["152.53.104.0/22","152.53.60.0/24","159.195.140.0/24","152.53.200.0/24"],"tags":[{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-manrs-member"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"all-newcomers-ris-peer"}],"tr_worthy":false,"victims":["197540"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599700},{"asinfo":{"202914":{"asrank":{"asn":"202914","asnDegree":{"customer":12,"peer":0,"provider":2},"asnName":"adeodc","organization":{"country":{"iso":"DK"},"orgId":"ORG-ADA25-RIPE"},"rank":2135},"hegemony":0},"211040":{"asrank":{"asn":"211040","asnDegree":{"customer":0,"peer":0,"provider":0},"asnName":"MS2001","organization":{"country":{"iso":"DK"},"orgId":"ORG-MA1841-RIPE"},"rank":null},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-RIPE-all-oldcomer-exact-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005176067352294922,"proc_time_tagger":1.0615262985229492,"total_tags_cnt":53},"event_type":"moas","finished_ts":null,"id":"moas-1776599700-202914_211040","insert_ts":1776601759,"last_modified_ts":1776601759,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"prefix":"87.238.254.0/23","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-victims-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"}]}],"summary":{"ases":["202914","211040"],"attackers":["202914"],"inference_result":{"inferences":[{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"primary_inference":{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}},"newcomers":["202914"],"prefixes":["87.238.254.0/23"],"tags":[{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"}],"tr_worthy":true,"victims":["211040"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[["not-previously-announced-by-any-newcomer","rpki-some-newcomer-invalid-roa","rpki-all-newcomer-invalid-roa"]]},"view_ts":1776599700},{"asinfo":{"45102":{"asrank":{"asn":"45102","asnDegree":{"customer":1,"peer":347,"provider":38},"asnName":"ALIBABA-CN-NET","organization":{"country":{"iso":"CN"},"orgId":"@aut-37963-APNIC"},"rank":7646},"hegemony":0},"45700":{"asrank":{"asn":"45700","asnDegree":{"customer":0,"peer":3,"provider":4},"asnName":"IDNIC-STARLINK-AS-ID","organization":{"country":{"iso":"ID"},"orgId":"@aut-45700-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"outdated-info"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-NTTCOM-some-newcomer-more-specific-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-some-newcomer-no-record"},{"count":1,"name":"irr-ARIN-some-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-routeviews-peer"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-RADB-some-newcomer-more-specific-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-ARIN-some-newcomer-more-specific-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-RADB-some-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"long-prefix"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00079345703125,"proc_time_tagger":1.1324632167816162,"total_tags_cnt":36},"event_type":"moas","finished_ts":null,"id":"moas-1776599700-45102_45700","insert_ts":1776601759,"last_modified_ts":1776601759,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":65,"explanation":"some newcomers are more specific than their IRR records","inference_id":"some-newcomers-more-specific-record","labels":["legitimate"],"suspicion_level":40},{"confidence":74,"explanation":"all newcomers have invalid ROAs (at least one due to AS)","inference_id":"rpki-all-newcomers-invalid","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"prefix":"47.239.187.158/32","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"all-newcomers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-NTTCOM-some-newcomer-more-specific-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-NTTCOM-some-newcomer-no-record"},{"name":"irr-ARIN-some-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-routeviews-peer"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RADB-some-newcomer-more-specific-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-ARIN-some-newcomer-more-specific-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"single-ip"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RADB-some-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"long-prefix"}]}],"summary":{"ases":["45102","45700"],"attackers":["45102","45700"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["45102","45700"],"prefixes":["47.239.187.158/32"],"tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"outdated-info"},{"name":"all-newcomers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-NTTCOM-some-newcomer-more-specific-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-NTTCOM-some-newcomer-no-record"},{"name":"irr-ARIN-some-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-routeviews-peer"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RADB-some-newcomer-more-specific-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-ARIN-some-newcomer-more-specific-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"single-ip"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RADB-some-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"long-prefix"}],"tr_worthy":false,"victims":[]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599700},{"asinfo":{"45102":{"asrank":{"asn":"45102","asnDegree":{"customer":1,"peer":347,"provider":38},"asnName":"ALIBABA-CN-NET","organization":{"country":{"iso":"CN"},"orgId":"@aut-37963-APNIC"},"rank":7646},"hegemony":0},"45700":{"asrank":{"asn":"45700","asnDegree":{"customer":0,"peer":3,"provider":4},"asnName":"IDNIC-STARLINK-AS-ID","organization":{"country":{"iso":"ID"},"orgId":"@aut-45700-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"submoas-causing-moas-subpfx"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-some-newcomer-more-specific-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-some-newcomer-more-specific-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"irr-ARIN-some-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-some-newcomer-more-specific-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"irr-RADB-some-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-some-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.001049041748046875,"proc_time_tagger":1.1025736331939697,"total_tags_cnt":61},"event_type":"submoas","finished_ts":null,"id":"submoas-1776599700-45102=45102_45700","insert_ts":1776601678,"last_modified_ts":1776601678,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":65,"explanation":"some newcomers are more specific than their IRR records","inference_id":"some-newcomers-more-specific-record","labels":["legitimate"],"suspicion_level":40},{"confidence":72,"explanation":"some newcomers have invalid ROAs with at least one due to AS","inference_id":"rpki-some-newcomers-invalid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"47.239.187.158/32","super_pfx":"47.239.0.0/16","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"submoas-causing-moas-subpfx"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-some-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-ARIN-some-newcomer-more-specific-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ARIN-some-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-RADB-some-newcomer-more-specific-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-RADB-some-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-some-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["45700","45102"],"attackers":["45700","45102"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["45700"],"prefixes":["47.239.187.158/32","47.239.0.0/16"],"tags":[{"name":"outdated-info"},{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"submoas-causing-moas-subpfx"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-ARIN-some-newcomer-more-specific-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-RADB-some-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-some-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-ARIN-some-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-RADB-some-newcomer-more-specific-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-some-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["45102"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599700},{"asinfo":{"213541":{"asrank":{"asn":"213541","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"ws-telecom-sdn","organization":{"country":{"iso":"US"},"orgId":"ORG-WTI4-RIPE"},"rank":12482},"hegemony":0},"30058":{"asrank":{"asn":"30058","asnDegree":{"customer":39,"peer":192,"provider":7},"asnName":"FDCSERVERS","organization":{"country":{"iso":"US"},"orgId":"FDCSE-ARIN"},"rank":484},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"outdated-info"},{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"all-victims-stub-ases"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"single-rel-upstream-chain"},{"count":2,"name":"single-ip"},{"count":2,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"single-peer-on-attacker-path"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"rpki-all-newcomer-invalid-roa"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":2,"name":"previously-announced-by-all-newcomers"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-all-newcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-are-rel-upstream"},{"count":2,"name":"some-newcomers-are-providers"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"some-victims-stub-ases"},{"count":2,"name":"some-newcomers-are-rel-neighbor"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-valid-roa"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-providers"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-newcomer-invalid-roa"},{"count":2,"name":"all-newcomers-are-rel-upstream"},{"count":2,"name":"long-prefix"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-rel-neighbor"},{"count":2,"name":"rpki-all-oldcomer-valid-roa"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009922981262207031,"proc_time_tagger":1.1587014198303223,"total_tags_cnt":66},"event_type":"submoas","finished_ts":null,"id":"submoas-1776599700-213541=30058","insert_ts":1776601678,"last_modified_ts":1776601678,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"109.238.200.10/32","super_pfx":"109.238.200.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"109.238.200.100/32","super_pfx":"109.238.200.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["30058","213541"],"attackers":["30058"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["30058"],"prefixes":["109.238.200.0/24","109.238.200.10/32","109.238.200.100/32"],"tags":[{"name":"outdated-info"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["213541"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599700},{"asinfo":{"147003":{"asrank":{"asn":"147003","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"AITPL-AS-AP","organization":{"country":{"iso":"SG"},"orgId":"ORG-AITP4-AP-APNIC"},"rank":12482},"hegemony":0},"51847":{"asrank":{"asn":"51847","asnDegree":{"customer":34,"peer":40,"provider":8},"asnName":"NEAROUTE","organization":{"country":{"iso":"HK"},"orgId":"ORG-NL526-RIPE"},"rank":896},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005269050598144531,"proc_time_tagger":1.1133928298950195,"total_tags_cnt":57},"event_type":"moas","finished_ts":null,"id":"moas-1776599400-147003_51847","insert_ts":1776601677,"last_modified_ts":1776601677,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"prefix":"157.254.179.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"single-rel-upstream-chain"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-victims-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"}]}],"summary":{"ases":["147003","51847"],"attackers":["51847"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["51847"],"prefixes":["157.254.179.0/24"],"tags":[{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"}],"tr_worthy":false,"victims":["147003"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599400},{"asinfo":{"1516":{"asrank":{"asn":"1516","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"DNIC-ASBLK-01513-01518","organization":{"country":{"iso":"US"},"orgId":"HEADQU-3-ARIN"},"rank":12482},"hegemony":0},"1540":{"asrank":{"asn":"1540","asnDegree":{"customer":0,"peer":2,"provider":1},"asnName":"DNIC-ASBLK-01534-01546","organization":{"country":{"iso":"US"},"orgId":"HEADQU-3-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":3,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":3,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":3,"name":"all-newcomers-siblings-with-oldcomers-peers"},{"count":3,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":3,"name":"irr-RADB-all-oldcomer-no-record"},{"count":3,"name":"irr-all-oldcomer-no-record"},{"count":3,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":3,"name":"all-victims-stub-ases"},{"count":3,"name":"irr-RIPE-all-newcomer-no-record"},{"count":3,"name":"some-victims-stub-ases"},{"count":3,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":3,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":3,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":3,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":3,"name":"irr-ARIN-all-newcomer-no-record"},{"count":3,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":3,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":3,"name":"irr-all-newcomer-no-record"},{"count":3,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":3,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":3,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":3,"name":"rpki-some-oldcomer-unknown-roa"},{"count":3,"name":"oldcomer-newcomer-all-siblings"},{"count":3,"name":"some-newcomers-stub-ases"},{"count":3,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":3,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":3,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":3,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":3,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":3,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":3,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":3,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":3,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":3,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":3,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":3,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":3,"name":"some-newcomers-siblings-with-oldcomers-peers"},{"count":3,"name":"irr-RADB-all-newcomer-no-record"},{"count":3,"name":"oldcomer-newcomer-some-siblings"},{"count":3,"name":"all-newcomers-stub-ases"},{"count":3,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":3,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":3,"name":"irr-BBOI-all-newcomer-no-record"},{"count":3,"name":"irr-APNIC-all-newcomer-no-record"},{"count":3,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":3,"name":"rpki-all-oldcomer-unknown-roa"},{"count":3,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":3,"name":"all-origins-same-country"},{"count":3,"name":"rpki-all-newcomer-unknown-roa"},{"count":3,"name":"irr-REACH-all-oldcomer-no-record"},{"count":3,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":3,"name":"irr-BELL-all-newcomer-no-record"},{"count":3,"name":"irr-REACH-all-newcomer-no-record"},{"count":3,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":3,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":3,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":3,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"not-previously-announced-by-any-newcomer"},{"count":3,"name":"irr-TC-all-newcomer-no-record"},{"count":3,"name":"irr-TC-all-oldcomer-no-record"},{"count":3,"name":"irr-PANIX-all-newcomer-no-record"},{"count":3,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"prefix-small-edit-distance"}],"pfx_events_cnt":3,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0013790130615234375,"proc_time_tagger":3.219968557357788,"total_tags_cnt":65},"event_type":"moas","finished_ts":null,"id":"moas-1776599400-1516_1540","insert_ts":1776601677,"last_modified_ts":1776601759,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"prefix":"143.74.37.0/24","tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-stub-ases"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"}]},{"finished_ts":1776599700,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20}],"prefix":"143.74.29.0/24","tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"some-victims-stub-ases"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-stub-ases"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"}]},{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"prefix":"143.74.7.0/24","tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-stub-ases"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"}]}],"summary":{"ases":["1540","1516"],"attackers":["1516"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["1516"],"prefixes":["143.74.37.0/24","143.74.7.0/24","143.74.29.0/24"],"tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"some-victims-stub-ases"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"some-newcomers-stub-ases"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-stub-ases"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"}],"tr_worthy":false,"victims":["1540"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599400},{"asinfo":{"25229":{"asrank":{"asn":"25229","asnDegree":{"customer":2,"peer":0,"provider":1},"asnName":"VOLIA-AS","organization":{"country":{"iso":"UA"},"orgId":"ORG-VI4-RIPE"},"rank":5776},"hegemony":0},"6698":{"asrank":{"asn":"6698","asnDegree":{"customer":3,"peer":13,"provider":4},"asnName":"virtualsystems","organization":{"country":{"iso":"UA"},"orgId":"ORG-VSL22-RIPE"},"rank":2781},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009150505065917969,"proc_time_tagger":1.0234520435333252,"total_tags_cnt":55},"event_type":"submoas","finished_ts":null,"id":"submoas-1776599400-6698=25229","insert_ts":1776601597,"last_modified_ts":1776601597,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"176.97.112.135/32","super_pfx":"176.97.112.0/23","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["6698","25229"],"attackers":["25229"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["25229"],"prefixes":["176.97.112.0/23","176.97.112.135/32"],"tags":[{"name":"outdated-info"},{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["6698"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599400},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010035037994384766,"proc_time_tagger":1.062762975692749,"total_tags_cnt":71},"event_type":"submoas","finished_ts":null,"id":"submoas-1776599400-4601=210312","insert_ts":1776601597,"last_modified_ts":1776601597,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d07::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3d07::/48","2a0d:3dc0::/29"],"tags":[{"name":"outdated-info"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776599400},{"asinfo":{"34909":{"asrank":{"asn":"34909","asnDegree":{"customer":0,"peer":0,"provider":2},"asnName":"MAXCOM-AS","organization":{"country":{"iso":"BG"},"orgId":"ORG-ML430-RIPE"},"rank":12482},"hegemony":0},"41366":{"asrank":{"asn":"41366","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"KOMAX","organization":{"country":{"iso":"BG"},"orgId":"ORG-KO54-RIPE"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-exact-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004513263702392578,"proc_time_tagger":1.0820081233978271,"total_tags_cnt":57},"event_type":"moas","finished_ts":null,"id":"moas-1776598800-34909_41366","insert_ts":1776601362,"last_modified_ts":1776601362,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"prefix":"185.207.232.0/22","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"}]}],"summary":{"ases":["41366","34909"],"attackers":["34909"],"inference_result":{"inferences":[{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"primary_inference":{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}},"newcomers":["34909"],"prefixes":["185.207.232.0/22"],"tags":[{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"oldcomer-path-prepending"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"}],"tr_worthy":false,"victims":["41366"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776598800},{"asinfo":{"26615":{"asrank":{"asn":"26615","asnDegree":{"customer":72,"peer":30,"provider":6},"asnName":"","organization":{"country":{"iso":"BR"},"orgId":"@aut-26615-LACNIC"},"rank":73},"hegemony":0},"749":{"asrank":{"asn":"749","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"DNIC-AS-00749","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":3,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":3,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":3,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":3,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":3,"name":"all-victims-stub-ases"},{"count":3,"name":"newcomer-more-specific"},{"count":3,"name":"irr-BBOI-all-newcomer-no-record"},{"count":3,"name":"irr-RADB-all-newcomer-no-record"},{"count":3,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":3,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":3,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":3,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":3,"name":"single-peer-on-attacker-path"},{"count":3,"name":"irr-ARIN-all-newcomer-no-record"},{"count":3,"name":"rpki-all-newcomer-unknown-roa"},{"count":3,"name":"irr-APNIC-all-newcomer-no-record"},{"count":3,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":3,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":3,"name":"previously-announced-by-some-newcomers"},{"count":3,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":3,"name":"rpki-some-oldcomer-unknown-roa"},{"count":3,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":3,"name":"irr-PANIX-all-newcomer-no-record"},{"count":3,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":3,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":3,"name":"previously-announced-by-all-newcomers"},{"count":3,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":3,"name":"irr-all-newcomer-no-record"},{"count":3,"name":"irr-all-oldcomer-no-record"},{"count":3,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":3,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":3,"name":"irr-RIPE-all-newcomer-no-record"},{"count":3,"name":"irr-BELL-all-oldcomer-no-record"},{"count":3,"name":"irr-RADB-all-oldcomer-no-record"},{"count":3,"name":"irr-TC-all-newcomer-no-record"},{"count":3,"name":"some-victims-stub-ases"},{"count":3,"name":"rpki-some-newcomer-unknown-roa"},{"count":3,"name":"irr-REACH-all-newcomer-no-record"},{"count":3,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":3,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":3,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":3,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":3,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":3,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":3,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":3,"name":"irr-TC-all-oldcomer-no-record"},{"count":3,"name":"irr-REACH-all-oldcomer-no-record"},{"count":3,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":3,"name":"irr-BELL-all-newcomer-no-record"},{"count":3,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":3,"name":"prefix-small-edit-distance"},{"count":3,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":3,"name":"rpki-all-oldcomer-unknown-roa"},{"count":3,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":3,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":3,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.004235744476318359,"proc_time_tagger":1.7052440643310547,"total_tags_cnt":55},"event_type":"submoas","finished_ts":null,"id":"submoas-1776598800-749=26615","insert_ts":1776601364,"last_modified_ts":1776601365,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":89,"explanation":"The ASNs of the potential attacker previously announced similar prefix, this is more likely to be caused by a misconfiguration","inference_id":"misconfig-fatfinger-prefix","labels":["misconfig","fatfinger","incident"],"suspicion_level":20}],"sub_pfx":"11.194.11.0/24","super_pfx":"11.0.0.0/8","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":89,"explanation":"The ASNs of the potential attacker previously announced similar prefix, this is more likely to be caused by a misconfiguration","inference_id":"misconfig-fatfinger-prefix","labels":["misconfig","fatfinger","incident"],"suspicion_level":20}],"sub_pfx":"11.200.11.0/24","super_pfx":"11.0.0.0/8","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":89,"explanation":"The ASNs of the potential attacker previously announced similar prefix, this is more likely to be caused by a misconfiguration","inference_id":"misconfig-fatfinger-prefix","labels":["misconfig","fatfinger","incident"],"suspicion_level":20}],"sub_pfx":"11.195.11.0/24","super_pfx":"11.0.0.0/8","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["749","26615"],"attackers":["26615"],"inference_result":{"inferences":[{"confidence":89,"explanation":"The ASNs of the potential attacker previously announced similar prefix, this is more likely to be caused by a misconfiguration","inference_id":"misconfig-fatfinger-prefix","labels":["misconfig","fatfinger","incident"],"suspicion_level":20}],"primary_inference":{"confidence":89,"explanation":"The ASNs of the potential attacker previously announced similar prefix, this is more likely to be caused by a misconfiguration","inference_id":"misconfig-fatfinger-prefix","labels":["misconfig","fatfinger","incident"],"suspicion_level":20}},"newcomers":["26615"],"prefixes":["11.195.11.0/24","11.200.11.0/24","11.0.0.0/8","11.194.11.0/24"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["749"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776598800},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006830692291259766,"proc_time_tagger":1.1173508167266846,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776598800-4601=210312","insert_ts":1776601365,"last_modified_ts":1776601365,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d06::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3d06::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776598800},{"asinfo":{"16509":{"asrank":{"asn":"16509","asnDegree":{"customer":72,"peer":332,"provider":18},"asnName":"AMAZON-02","organization":{"country":{"iso":"US"},"orgId":"AMAZON-4-ARIN"},"rank":510},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-ris-peer"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-oldcomers-manrs-member"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005967617034912109,"proc_time_tagger":1.5799341201782227,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776598500-16509=52468","insert_ts":1776601286,"last_modified_ts":1776601286,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"3.76.57.90/32","super_pfx":"3.64.0.0/12","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["16509","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["3.76.57.90/32","3.64.0.0/12"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["16509"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776598500},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009679794311523438,"proc_time_tagger":1.1623518466949463,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776598200-4601=210312","insert_ts":1776600982,"last_modified_ts":1776600982,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d05::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3d05::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776598200},{"asinfo":{"27064":{"asrank":{"asn":"27064","asnDegree":{"customer":71,"peer":0,"provider":1},"asnName":"DNIC-ASBLK-27032-27159","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":586},"hegemony":0},"367":{"asrank":{"asn":"367","asnDegree":{"customer":0,"peer":10,"provider":2},"asnName":"DNIC-ASBLK-00306-00371","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004940032958984375,"proc_time_tagger":1.3008201122283936,"total_tags_cnt":71},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597900-27064=367","insert_ts":1776600691,"last_modified_ts":1776600691,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"132.7.149.0/24","super_pfx":"132.7.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["27064","367"],"attackers":["367"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["367"],"prefixes":["132.7.149.0/24","132.7.0.0/16"],"tags":[{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["27064"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597900},{"asinfo":{"152194":{"asrank":{"asn":"152194","asnDegree":{"customer":2,"peer":207,"provider":6},"asnName":"CTGSERVERLIMITED-AS-AP","organization":{"country":{"iso":"HK"},"orgId":"ORG-CSL17-AP-APNIC"},"rank":5776},"hegemony":0},"64050":{"asrank":{"asn":"64050","asnDegree":{"customer":16,"peer":211,"provider":10},"asnName":"BGNL-HK","organization":{"country":{"iso":"HK"},"orgId":"ORG-BCPL4-AP-APNIC"},"rank":1168},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":5,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":5,"name":"oldcomer-path-prepending"},{"count":5,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":5,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":5,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":5,"name":"all-newcomers-next-to-an-oldcomer"},{"count":5,"name":"newcomer-more-specific"},{"count":5,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":5,"name":"irr-BBOI-all-newcomer-no-record"},{"count":5,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":5,"name":"single-ip"},{"count":5,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":5,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":5,"name":"single-peer-on-attacker-path"},{"count":5,"name":"irr-ARIN-all-newcomer-no-record"},{"count":5,"name":"rpki-all-newcomer-invalid-roa"},{"count":5,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":5,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":5,"name":"previously-announced-by-some-newcomers"},{"count":5,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":5,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":5,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":5,"name":"irr-PANIX-all-newcomer-no-record"},{"count":5,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":5,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":5,"name":"previously-announced-by-all-newcomers"},{"count":5,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":5,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":5,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":5,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":5,"name":"irr-RIPE-all-newcomer-no-record"},{"count":5,"name":"irr-BELL-all-oldcomer-no-record"},{"count":5,"name":"irr-RADB-all-oldcomer-no-record"},{"count":5,"name":"irr-TC-all-newcomer-no-record"},{"count":5,"name":"some-newcomers-are-rel-upstream"},{"count":5,"name":"some-newcomers-are-providers"},{"count":5,"name":"all-origins-same-country"},{"count":5,"name":"some-newcomers-are-rel-neighbor"},{"count":5,"name":"irr-REACH-all-newcomer-no-record"},{"count":5,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":5,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":5,"name":"rpki-some-oldcomer-valid-roa"},{"count":5,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":5,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":5,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":5,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":5,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":5,"name":"irr-TC-all-oldcomer-no-record"},{"count":5,"name":"all-newcomers-are-providers"},{"count":5,"name":"irr-APNIC-all-newcomer-more-specific-record"},{"count":5,"name":"irr-REACH-all-oldcomer-no-record"},{"count":5,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":5,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":5,"name":"irr-BELL-all-newcomer-no-record"},{"count":5,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":5,"name":"rpki-some-newcomer-invalid-roa"},{"count":5,"name":"all-newcomers-are-rel-upstream"},{"count":5,"name":"long-prefix"},{"count":5,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":5,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":5,"name":"all-newcomers-are-rel-neighbor"},{"count":5,"name":"rpki-all-oldcomer-valid-roa"},{"count":5,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":5,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.008953571319580078,"proc_time_tagger":1.0904719829559326,"total_tags_cnt":63},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597900-152194=64050","insert_ts":1776600691,"last_modified_ts":1776600691,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"118.107.9.202/32","super_pfx":"118.107.9.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"118.107.9.131/32","super_pfx":"118.107.9.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"118.107.9.139/32","super_pfx":"118.107.9.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"118.107.9.244/32","super_pfx":"118.107.9.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"118.107.9.44/32","super_pfx":"118.107.9.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["152194","64050"],"attackers":["64050"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["64050"],"prefixes":["118.107.9.0/24","118.107.9.244/32","118.107.9.131/32","118.107.9.139/32","118.107.9.44/32","118.107.9.202/32"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["152194"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597900},{"asinfo":{"202412":{"asrank":{"asn":"202412","asnDegree":{"customer":0,"peer":0,"provider":2},"asnName":"OMEGATECH-AS","organization":{"country":{"iso":"SC"},"orgId":"ORG-OL329-RIPE"},"rank":12482},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006351470947265625,"proc_time_tagger":0.048052310943603516,"total_tags_cnt":57},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597900-202412=52468","insert_ts":1776600691,"last_modified_ts":1776600691,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"178.16.55.226/32","super_pfx":"178.16.55.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["202412","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["178.16.55.226/32","178.16.55.0/24"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["202412"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597900},{"asinfo":{"8371":{"asrank":{"asn":"8371","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"Vimpelcom-NN","organization":{"country":{"iso":"RU"},"orgId":"ORG-ES15-RIPE"},"rank":12482},"hegemony":0},"8402":{"asrank":{"asn":"8402","asnDegree":{"customer":10,"peer":6,"provider":2},"asnName":"CORBINA-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-CTAM1-RIPE"},"rank":2419},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009887218475341797,"proc_time_tagger":1.0178170204162598,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597900-8371=8402","insert_ts":1776600691,"last_modified_ts":1776600691,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"95.31.49.17/32","super_pfx":"95.31.49.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["8371","8402"],"attackers":["8402"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["8402"],"prefixes":["95.31.49.0/24","95.31.49.17/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["8371"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597900},{"asinfo":{"136787":{"asrank":{"asn":"136787","asnDegree":{"customer":1,"peer":0,"provider":14},"asnName":"PACKETHUBSA-AS-AP","organization":{"country":{"iso":"PA"},"orgId":"ORG-PS10-AP-APNIC"},"rank":7646},"hegemony":0},"9009":{"asrank":{"asn":"9009","asnDegree":{"customer":130,"peer":433,"provider":13},"asnName":"M247","organization":{"country":{"iso":"RO"},"orgId":"ORG-MES6-RIPE"},"rank":349},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"blacklist-asn"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00032782554626464844,"proc_time_tagger":1.106555700302124,"total_tags_cnt":63},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597900-136787=9009","insert_ts":1776600691,"last_modified_ts":1776600691,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":60,"explanation":"the AS was reported for malicious behaviors before","inference_id":"suspicious-blacklist-asn","labels":["suspicious","incident"],"suspicion_level":70},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"45.155.40.186/32","super_pfx":"45.155.40.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"blacklist-asn"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["9009","136787"],"attackers":["9009"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["9009"],"prefixes":["45.155.40.186/32","45.155.40.0/24"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"blacklist-asn"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["136787"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597900},{"asinfo":{"150716":{"asrank":{"asn":"150716","asnDegree":{"customer":0,"peer":0,"provider":4},"asnName":"ANCTSC-AS-AP","organization":{"country":{"iso":"LA"},"orgId":"ORG-ANC1-AP-APNIC"},"rank":12482},"hegemony":0},"154047":{"asrank":{"asn":"154047","asnDegree":{"customer":0,"peer":0,"provider":2},"asnName":"IT2-AS-AP","organization":{"country":{"iso":"BD"},"orgId":"ORG-INH4-AP-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-exact-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-invalid-roa"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-invalid-roa"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"rpki-oldcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-APNIC-all-newcomer-exact-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.000278472900390625,"proc_time_tagger":1.0586230754852295,"total_tags_cnt":53},"event_type":"moas","finished_ts":null,"id":"moas-1776597600-150716_154047","insert_ts":1776600385,"last_modified_ts":1776600385,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"prefix":"203.33.238.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-invalid-roa"},{"name":"irr-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-invalid-roa"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"rpki-oldcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-victims-stub-ases"},{"name":"all-newcomers-stub-ases"},{"name":"irr-APNIC-all-newcomer-exact-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"}]}],"summary":{"ases":["154047","150716"],"attackers":["154047"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["154047"],"prefixes":["203.33.238.0/24"],"tags":[{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-invalid-roa"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"rpki-oldcomer-invalid-roa-due-to-as"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-exact-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-invalid-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"}],"tr_worthy":false,"victims":["150716"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597600},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010628700256347656,"proc_time_tagger":1.0916287899017334,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597600-4601=210312","insert_ts":1776600387,"last_modified_ts":1776600387,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d04::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3d04::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597600},{"asinfo":{"215152":{"asrank":{"asn":"215152","asnDegree":{"customer":0,"peer":0,"provider":3},"asnName":"ORG-CUL21-RIPE","organization":{"country":{"iso":"GB"},"orgId":"ORG-CUL21-RIPE"},"rank":12482},"hegemony":0},"286":{"asrank":{"asn":"286","asnDegree":{"customer":777,"peer":661,"provider":0},"asnName":"KPN","organization":{"country":{"iso":"US"},"orgId":"ORG-GCI2-RIPE"},"rank":12482},"hegemony":0},"3257":{"asrank":{"asn":"3257","asnDegree":{"customer":1800,"peer":37,"provider":0},"asnName":"GTT-BACKBONE","organization":{"country":{"iso":"US"},"orgId":"ORG-GCI2-RIPE"},"rank":3},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"some-oldcomers-ris-peer"},{"count":1,"name":"some-oldcomers-manrs-member"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-some-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-oldcomers-routeviews-peer"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-all-siblings"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-some-siblings"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-some-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"prefix-small-edit-distance"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0003173351287841797,"proc_time_tagger":1.08829927444458,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597600-286_3257=215152","insert_ts":1776600387,"last_modified_ts":1776600387,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":89,"explanation":"The ASNs of the potential attacker previously announced similar prefix, this is more likely to be caused by a misconfiguration","inference_id":"misconfig-fatfinger-prefix","labels":["misconfig","fatfinger","incident"],"suspicion_level":20},{"confidence":68,"explanation":"all newcomer(s) are downstream customer(s) of the oldcomer(s)","inference_id":"all-newcomers-customers-rel-downstream","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"212.134.249.0/24","super_pfx":"212.134.0.0/15","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"some-oldcomers-ris-peer"},{"name":"some-oldcomers-manrs-member"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-some-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-oldcomers-routeviews-peer"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"oldcomer-all-siblings"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"oldcomer-some-siblings"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-RIPE-some-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["3257","215152","286"],"attackers":["215152"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["215152"],"prefixes":["212.134.249.0/24","212.134.0.0/15"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"some-oldcomers-ris-peer"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-some-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-oldcomers-routeviews-peer"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"oldcomer-all-siblings"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-RIPE-some-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-oldcomers-manrs-member"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"oldcomer-some-siblings"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["3257","286"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597600},{"asinfo":{"138968":{"asrank":{"asn":"138968","asnDegree":{"customer":1,"peer":17,"provider":4},"asnName":"RAINBOWIDC-AS-AP","organization":{"country":{"iso":"JP"},"orgId":"ORG-RNL4-AP-APNIC"},"rank":7646},"hegemony":0},"55933":{"asrank":{"asn":"55933","asnDegree":{"customer":20,"peer":25,"provider":5},"asnName":"CLOUDIE-AS-AP","organization":{"country":{"iso":"HK"},"orgId":"ORG-CL18-AP-APNIC"},"rank":1332},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"spamhaus-asn-drop"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006513595581054688,"proc_time_tagger":1.0553112030029297,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597600-55933=138968","insert_ts":1776600387,"last_modified_ts":1776600387,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"103.115.64.52/32","super_pfx":"103.115.64.0/23","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-customers"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["55933","138968"],"attackers":["138968"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["138968"],"prefixes":["103.115.64.52/32","103.115.64.0/23"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-customers"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["55933"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597600},{"asinfo":{"45102":{"asrank":{"asn":"45102","asnDegree":{"customer":1,"peer":347,"provider":38},"asnName":"ALIBABA-CN-NET","organization":{"country":{"iso":"CN"},"orgId":"@aut-37963-APNIC"},"rank":7646},"hegemony":0},"45700":{"asrank":{"asn":"45700","asnDegree":{"customer":0,"peer":3,"provider":4},"asnName":"IDNIC-STARLINK-AS-ID","organization":{"country":{"iso":"ID"},"orgId":"@aut-45700-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0015463829040527344,"proc_time_tagger":0.8382604122161865,"total_tags_cnt":58},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597300-45102=45700","insert_ts":1776600079,"last_modified_ts":1776600079,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"8.210.118.73/32","super_pfx":"8.210.0.0/17","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["45700","45102"],"attackers":["45700"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["45700"],"prefixes":["8.210.0.0/17","8.210.118.73/32"],"tags":[{"name":"outdated-info"},{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["45102"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597300},{"asinfo":{"401696":{"asrank":{"asn":"401696","asnDegree":{"customer":1,"peer":0,"provider":1},"asnName":"COGNETCLOUD","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":7646},"hegemony":0},"401701":{"asrank":{"asn":"401701","asnDegree":{"customer":0,"peer":0,"provider":3},"asnName":"COGNETCLOUD-2","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"prefix-small-edit-distance"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"spamhaus-asn-drop"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0013887882232666016,"proc_time_tagger":1.0432233810424805,"total_tags_cnt":65},"event_type":"moas","finished_ts":null,"id":"moas-1776597000-401696_401701","insert_ts":1776600080,"last_modified_ts":1776600080,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"prefix":"149.88.71.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"prefix-small-edit-distance"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-customers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["401701","401696"],"attackers":["401701"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["401701"],"prefixes":["149.88.71.0/24"],"tags":[{"name":"previously-announced-by-some-newcomers"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"prefix-small-edit-distance"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"all-newcomers-are-customers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-all-newcomers"},{"name":"some-newcomers-are-customers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"}],"tr_worthy":false,"victims":["401696"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597000},{"asinfo":{"138968":{"asrank":{"asn":"138968","asnDegree":{"customer":1,"peer":17,"provider":4},"asnName":"RAINBOWIDC-AS-AP","organization":{"country":{"iso":"JP"},"orgId":"ORG-RNL4-AP-APNIC"},"rank":7646},"hegemony":0},"55933":{"asrank":{"asn":"55933","asnDegree":{"customer":20,"peer":25,"provider":5},"asnName":"CLOUDIE-AS-AP","organization":{"country":{"iso":"HK"},"orgId":"ORG-CL18-AP-APNIC"},"rank":1332},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"spamhaus-asn-drop"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0015044212341308594,"proc_time_tagger":0.9845776557922363,"total_tags_cnt":59},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597000-55933=138968","insert_ts":1776599941,"last_modified_ts":1776599941,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"24.233.3.31/32","super_pfx":"24.233.0.0/20","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-are-customers"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["55933","138968"],"attackers":["138968"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["138968"],"prefixes":["24.233.3.31/32","24.233.0.0/20"],"tags":[{"name":"outdated-info"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-customers"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["55933"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597000},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.002023935317993164,"proc_time_tagger":1.1651697158813477,"total_tags_cnt":71},"event_type":"submoas","finished_ts":null,"id":"submoas-1776597000-4601=210312","insert_ts":1776599941,"last_modified_ts":1776599941,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d03::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc0::/29","2a0d:3dc1:3d03::/48"],"tags":[{"name":"outdated-info"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776597000},{"asinfo":{"35807":{"asrank":{"asn":"35807","asnDegree":{"customer":7,"peer":380,"provider":3},"asnName":"AS-SKYNET-SPB","organization":{"country":{"iso":"RU"},"orgId":"ORG-SA582-RIPE"},"rank":2998},"hegemony":0},"60470":{"asrank":{"asn":"60470","asnDegree":{"customer":0,"peer":0,"provider":0},"asnName":"AS-SKYNET-COUNTRY","organization":{"country":{"iso":"RU"},"orgId":"ORG-SA582-RIPE"},"rank":null},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0003504753112792969,"proc_time_tagger":1.0824902057647705,"total_tags_cnt":62},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596700-35807=60470","insert_ts":1776599863,"last_modified_ts":1776599863,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"185.88.157.216/32","super_pfx":"185.88.156.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["35807","60470"],"attackers":["60470"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["60470"],"prefixes":["185.88.157.216/32","185.88.156.0/22"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"}],"tr_worthy":false,"victims":["35807"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596700},{"asinfo":{"45102":{"asrank":{"asn":"45102","asnDegree":{"customer":1,"peer":347,"provider":38},"asnName":"ALIBABA-CN-NET","organization":{"country":{"iso":"CN"},"orgId":"@aut-37963-APNIC"},"rank":7646},"hegemony":0},"45700":{"asrank":{"asn":"45700","asnDegree":{"customer":0,"peer":3,"provider":4},"asnName":"IDNIC-STARLINK-AS-ID","organization":{"country":{"iso":"ID"},"orgId":"@aut-45700-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005433559417724609,"proc_time_tagger":1.0407564640045166,"total_tags_cnt":57},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596700-45102=45700","insert_ts":1776599863,"last_modified_ts":1776599863,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"47.83.123.15/32","super_pfx":"47.83.0.0/17","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["45700","45102"],"attackers":["45700"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["45700"],"prefixes":["47.83.123.15/32","47.83.0.0/17"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["45102"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596700},{"asinfo":{"213038":{"asrank":{"asn":"213038","asnDegree":{"customer":0,"peer":0,"provider":5},"asnName":"DREAMVPS","organization":{"country":{"iso":"IL"},"orgId":"ORG-LSSL4-RIPE"},"rank":12482},"hegemony":0},"40676":{"asrank":{"asn":"40676","asnDegree":{"customer":61,"peer":424,"provider":6},"asnName":"AS40676","organization":{"country":{"iso":"US"},"orgId":"PS-184-ARIN"},"rank":546},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"due-to-dps-asn"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-dps-asn"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-RIPE-all-oldcomer-exact-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-dps-asn"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-exact-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006108283996582031,"proc_time_tagger":1.1959741115570068,"total_tags_cnt":56},"event_type":"moas","finished_ts":null,"id":"moas-1776596400-213038_40676","insert_ts":1776599783,"last_modified_ts":1776599783,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":60,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and the event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"rpki-all-newcomers-invalid-dps-asn","labels":["misconfig","incident"],"suspicion_level":30}],"prefix":"82.38.103.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-victims-stub-ases"},{"name":"single-peer-on-attacker-path"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"}]}],"summary":{"ases":["40676","213038"],"attackers":["40676"],"inference_result":{"inferences":[{"confidence":60,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and the event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"rpki-all-newcomers-invalid-dps-asn","labels":["misconfig","incident"],"suspicion_level":30}],"primary_inference":{"confidence":60,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and the event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"rpki-all-newcomers-invalid-dps-asn","labels":["misconfig","incident"],"suspicion_level":30}},"newcomers":["40676"],"prefixes":["82.38.103.0/24"],"tags":[{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"single-peer-on-attacker-path"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"}],"tr_worthy":false,"victims":["213038"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"401696":{"asrank":{"asn":"401696","asnDegree":{"customer":1,"peer":0,"provider":1},"asnName":"COGNETCLOUD","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":7646},"hegemony":0},"401701":{"asrank":{"asn":"401701","asnDegree":{"customer":0,"peer":0,"provider":3},"asnName":"COGNETCLOUD-2","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"spamhaus-asn-drop"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005996227264404297,"proc_time_tagger":1.0673139095306396,"total_tags_cnt":61},"event_type":"moas","finished_ts":null,"id":"moas-1776596400-401696_401701","insert_ts":1776599783,"last_modified_ts":1776599783,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"prefix":"103.149.91.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"all-victims-stub-ases"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"single-peer-on-attacker-path"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"}]}],"summary":{"ases":["401701","401696"],"attackers":["401696"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["401696"],"prefixes":["103.149.91.0/24"],"tags":[{"name":"previously-announced-by-some-newcomers"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"some-newcomers-are-rel-upstream"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"}],"tr_worthy":false,"victims":["401701"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"150044":{"asrank":{"asn":"150044","asnDegree":{"customer":0,"peer":0,"provider":2},"asnName":"MIEUXTECH-AS-IN","organization":{"country":{"iso":"IN"},"orgId":"@aut-150044-APNIC"},"rank":12482},"hegemony":0},"198949":{"asrank":{"asn":"198949","asnDegree":{"customer":162,"peer":46,"provider":23},"asnName":"Radware","organization":{"country":{"iso":"IL"},"orgId":"ORG-RL239-RIPE"},"rank":283},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-exact-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"due-to-dps-asn"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"single-peer-on-victim-path"},{"count":1,"name":"all-newcomers-dps-asn"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-dps-asn"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004467964172363281,"proc_time_tagger":1.1115844249725342,"total_tags_cnt":55},"event_type":"moas","finished_ts":null,"id":"moas-1776596400-150044_198949","insert_ts":1776599783,"last_modified_ts":1776599783,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10}],"prefix":"163.227.93.0/24","tags":[{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-exact-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"single-peer-on-victim-path"},{"name":"all-newcomers-dps-asn"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-victims-stub-ases"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"}]}],"summary":{"ases":["198949","150044"],"attackers":["198949"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["198949"],"prefixes":["163.227.93.0/24"],"tags":[{"name":"irr-APNIC-all-oldcomer-exact-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"single-peer-on-victim-path"},{"name":"all-newcomers-dps-asn"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"some-victims-stub-ases"}],"tr_worthy":false,"victims":["150044"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"3356":{"asrank":{"asn":"3356","asnDegree":{"customer":6478,"peer":75,"provider":0},"asnName":"LEVEL3","organization":{"country":{"iso":"US"},"orgId":"LPL-141-ARIN"},"rank":1},"hegemony":0},"3549":{"asrank":{"asn":"3549","asnDegree":{"customer":295,"peer":55,"provider":2},"asnName":"LVLT-3549","organization":{"country":{"iso":"US"},"orgId":"LPL-141-ARIN"},"rank":139},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":7,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":7,"name":"all-newcomers-manrs-member"},{"count":7,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":7,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":7,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":7,"name":"all-newcomers-dps-asn"},{"count":7,"name":"newcomer-more-specific"},{"count":7,"name":"irr-BBOI-all-newcomer-no-record"},{"count":7,"name":"irr-RADB-all-newcomer-no-record"},{"count":7,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":7,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":7,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":7,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":7,"name":"single-peer-on-attacker-path"},{"count":7,"name":"irr-ARIN-all-newcomer-no-record"},{"count":7,"name":"rpki-all-newcomer-unknown-roa"},{"count":7,"name":"irr-APNIC-all-newcomer-no-record"},{"count":7,"name":"oldcomer-newcomer-all-siblings"},{"count":7,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":6,"name":"previously-announced-by-some-newcomers"},{"count":7,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":7,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":7,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":7,"name":"rpki-some-oldcomer-unknown-roa"},{"count":7,"name":"rpki-all-oldcomer-unknown-roa"},{"count":7,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":7,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":7,"name":"irr-PANIX-all-newcomer-no-record"},{"count":7,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":7,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":6,"name":"previously-announced-by-all-newcomers"},{"count":7,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":7,"name":"all-oldcomers-routeviews-peer"},{"count":7,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":7,"name":"irr-all-newcomer-no-record"},{"count":7,"name":"irr-all-oldcomer-no-record"},{"count":7,"name":"some-newcomers-dps-asn"},{"count":7,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":7,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":7,"name":"irr-RIPE-all-newcomer-no-record"},{"count":7,"name":"irr-BELL-all-oldcomer-no-record"},{"count":7,"name":"irr-RADB-all-oldcomer-no-record"},{"count":7,"name":"irr-TC-all-newcomer-no-record"},{"count":7,"name":"some-newcomers-are-rel-upstream"},{"count":7,"name":"all-oldcomers-manrs-member"},{"count":7,"name":"all-origins-same-country"},{"count":7,"name":"some-newcomers-are-providers"},{"count":7,"name":"some-newcomers-are-rel-neighbor"},{"count":7,"name":"rpki-some-newcomer-unknown-roa"},{"count":7,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":7,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":7,"name":"irr-REACH-all-newcomer-no-record"},{"count":7,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":7,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":7,"name":"due-to-dps-asn"},{"count":7,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":7,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":7,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":7,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":7,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":7,"name":"has-dps-asn"},{"count":7,"name":"irr-TC-all-oldcomer-no-record"},{"count":7,"name":"all-newcomers-routeviews-peer"},{"count":7,"name":"all-newcomers-are-providers"},{"count":7,"name":"irr-REACH-all-oldcomer-no-record"},{"count":7,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":7,"name":"irr-BELL-all-newcomer-no-record"},{"count":7,"name":"oldcomer-newcomer-some-siblings"},{"count":7,"name":"all-newcomers-are-rel-upstream"},{"count":7,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":7,"name":"all-oldcomers-ris-peer"},{"count":7,"name":"long-prefix"},{"count":7,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":7,"name":"all-newcomers-are-rel-neighbor"},{"count":7,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":7,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":5,"name":"single-ip"},{"count":1,"name":"not-previously-announced-by-any-newcomer"}],"pfx_events_cnt":7,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.008277654647827148,"proc_time_tagger":1.8239526748657227,"total_tags_cnt":78},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-3549=3356","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"66.162.170.32/29","super_pfx":"66.162.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-providers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"64.215.159.12/32","super_pfx":"64.215.128.0/17","tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"all-newcomers-manrs-member"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"single-ip"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"64.211.21.115/32","super_pfx":"64.211.0.0/17","tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"all-newcomers-manrs-member"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"single-ip"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"64.215.153.234/32","super_pfx":"64.215.128.0/17","tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"all-newcomers-manrs-member"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"single-ip"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}]},{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"174.47.45.240/28","super_pfx":"174.46.0.0/15","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-providers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"206.41.7.38/32","super_pfx":"206.41.0.0/19","tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"all-newcomers-manrs-member"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"single-ip"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"67.16.224.238/32","super_pfx":"67.16.0.0/15","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-providers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["3549","3356"],"attackers":["3356"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"Event has prefix events with different inferences, but they all map to the same class.","inference_id":"mixed-legitimate","labels":["legitimate"],"suspicion_level":9}},"newcomers":["3356"],"prefixes":["64.215.128.0/17","66.162.170.32/29","64.211.0.0/17","174.47.45.240/28","206.41.0.0/19","64.215.153.234/32","174.46.0.0/15","206.41.7.38/32","67.16.0.0/15","67.16.224.238/32","66.162.0.0/16","64.211.21.115/32","64.215.159.12/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"all-newcomers-manrs-member"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"single-ip"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["3549"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"18678":{"asrank":{"asn":"18678","asnDegree":{"customer":105,"peer":168,"provider":5},"asnName":"","organization":{"country":{"iso":"CO"},"orgId":"@aut-18678-LACNIC"},"rank":58},"hegemony":0},"262589":{"asrank":{"asn":"262589","asnDegree":{"customer":167,"peer":34,"provider":8},"asnName":"","organization":{"country":{"iso":"BR"},"orgId":"@aut-28329-LACNIC"},"rank":96},"hegemony":0},"273957":{"asrank":{"asn":"273957","asnDegree":{"customer":0,"peer":0,"provider":0},"asnName":"","organization":{"country":{"iso":"CO"},"orgId":"@aut-273957-LACNIC"},"rank":null},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"some-newcomer-announced-no-pfxs"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"submoas-causing-moas-superpfx"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010557174682617188,"proc_time_tagger":1.097815752029419,"total_tags_cnt":58},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-18678_262589=273957","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"2800:310:f64::/48","super_pfx":"2800:310::/33","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"some-newcomer-announced-no-pfxs"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"submoas-causing-moas-superpfx"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"}]}],"summary":{"ases":["18678","262589","273957"],"attackers":["273957"],"inference_result":{"inferences":[{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"primary_inference":{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}},"newcomers":["18678","262589","273957"],"prefixes":["2800:310::/33","2800:310:f64::/48"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"some-newcomer-announced-no-pfxs"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"submoas-causing-moas-superpfx"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["18678","262589"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"401696":{"asrank":{"asn":"401696","asnDegree":{"customer":1,"peer":0,"provider":1},"asnName":"COGNETCLOUD","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":7646},"hegemony":0},"401701":{"asrank":{"asn":"401701","asnDegree":{"customer":0,"peer":0,"provider":3},"asnName":"COGNETCLOUD-2","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":10,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":10,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":10,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":10,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":10,"name":"all-victims-stub-ases"},{"count":10,"name":"irr-BBOI-all-newcomer-no-record"},{"count":10,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":10,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":10,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":10,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":10,"name":"single-peer-on-attacker-path"},{"count":10,"name":"irr-ARIN-all-newcomer-no-record"},{"count":9,"name":"rpki-all-newcomer-unknown-roa"},{"count":10,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":10,"name":"irr-APNIC-all-newcomer-no-record"},{"count":10,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":10,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":10,"name":"previously-announced-by-some-newcomers"},{"count":10,"name":"oldcomer-newcomer-all-siblings"},{"count":10,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":9,"name":"rpki-all-oldcomer-unknown-roa"},{"count":9,"name":"rpki-some-oldcomer-unknown-roa"},{"count":10,"name":"spamhaus-asn-drop"},{"count":10,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":10,"name":"irr-PANIX-all-newcomer-no-record"},{"count":10,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":10,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":10,"name":"previously-announced-by-all-newcomers"},{"count":10,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":10,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":10,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":10,"name":"irr-RIPE-all-newcomer-no-record"},{"count":10,"name":"irr-BELL-all-oldcomer-no-record"},{"count":10,"name":"irr-TC-all-newcomer-no-record"},{"count":10,"name":"some-newcomers-are-rel-upstream"},{"count":10,"name":"some-newcomers-are-providers"},{"count":10,"name":"all-origins-same-country"},{"count":10,"name":"some-victims-stub-ases"},{"count":10,"name":"some-newcomers-are-rel-neighbor"},{"count":9,"name":"rpki-some-newcomer-unknown-roa"},{"count":10,"name":"irr-REACH-all-newcomer-no-record"},{"count":10,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":10,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":10,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":10,"name":"newcomer-less-specific"},{"count":10,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":10,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":10,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":10,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":10,"name":"irr-TC-all-oldcomer-no-record"},{"count":10,"name":"all-newcomers-are-providers"},{"count":10,"name":"irr-REACH-all-oldcomer-no-record"},{"count":10,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":10,"name":"irr-BELL-all-newcomer-no-record"},{"count":10,"name":"oldcomer-newcomer-some-siblings"},{"count":10,"name":"all-newcomers-are-rel-upstream"},{"count":10,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":7,"name":"prefix-small-edit-distance"},{"count":10,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":10,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":10,"name":"all-newcomers-are-rel-neighbor"},{"count":10,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":10,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"}],"pfx_events_cnt":10,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0164642333984375,"proc_time_tagger":1.3788032531738281,"total_tags_cnt":67},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-401696=401701","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"149.88.64.0/24","super_pfx":"149.88.64.0/21","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"45.207.198.0/24","super_pfx":"45.207.196.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"154.12.29.0/24","super_pfx":"154.12.24.0/21","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"154.12.87.0/24","super_pfx":"154.12.84.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"154.12.90.0/24","super_pfx":"154.12.90.0/23","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"149.88.67.0/24","super_pfx":"149.88.64.0/21","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"114.134.185.0/24","super_pfx":"114.134.184.0/23","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"154.12.21.0/24","super_pfx":"154.12.16.0/21","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"154.12.84.0/24","super_pfx":"154.12.84.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"154.12.83.0/24","super_pfx":"154.12.80.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["401696","401701"],"attackers":["401696"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"Event has prefix events with different inferences, but they all map to the same class.","inference_id":"mixed-legitimate","labels":["legitimate"],"suspicion_level":2}},"newcomers":["401696"],"prefixes":["149.88.67.0/24","154.12.80.0/22","149.88.64.0/24","154.12.84.0/22","114.134.184.0/23","154.12.21.0/24","45.207.198.0/24","154.12.90.0/23","154.12.90.0/24","154.12.87.0/24","149.88.64.0/21","154.12.29.0/24","114.134.185.0/24","154.12.83.0/24","45.207.196.0/22","154.12.24.0/21","154.12.16.0/21","154.12.84.0/24"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["401701"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"18734":{"asrank":{"asn":"18734","asnDegree":{"customer":88,"peer":7,"provider":9},"asnName":"","organization":{"country":{"iso":"MX"},"orgId":"@aut-13440-LACNIC"},"rank":452},"hegemony":0},"278":{"asrank":{"asn":"278","asnDegree":{"customer":1,"peer":3,"provider":4},"asnName":"","organization":{"country":{"iso":"MX"},"orgId":"@aut-278-LACNIC"},"rank":7646},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":5,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":5,"name":"all-newcomers-manrs-member"},{"count":5,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":5,"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"count":5,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":5,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":5,"name":"newcomer-more-specific"},{"count":5,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":5,"name":"irr-RADB-all-newcomer-no-record"},{"count":5,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":5,"name":"irr-BBOI-all-newcomer-no-record"},{"count":5,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":5,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":5,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":5,"name":"single-peer-on-attacker-path"},{"count":5,"name":"irr-ARIN-all-newcomer-no-record"},{"count":5,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":5,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":5,"name":"rpki-all-newcomer-invalid-roa"},{"count":5,"name":"irr-APNIC-all-newcomer-no-record"},{"count":5,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":5,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":5,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":5,"name":"some-newcomers-are-customers"},{"count":5,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":5,"name":"irr-PANIX-all-newcomer-no-record"},{"count":5,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":5,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":5,"name":"all-newcomers-are-rel-downstream"},{"count":5,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":5,"name":"irr-all-newcomer-no-record"},{"count":5,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":5,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":5,"name":"irr-RIPE-all-newcomer-no-record"},{"count":5,"name":"irr-BELL-all-oldcomer-no-record"},{"count":5,"name":"irr-TC-all-newcomer-no-record"},{"count":5,"name":"all-origins-same-country"},{"count":5,"name":"some-newcomers-are-rel-neighbor"},{"count":5,"name":"irr-REACH-all-newcomer-no-record"},{"count":5,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":5,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":5,"name":"rpki-some-oldcomer-valid-roa"},{"count":5,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":5,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":5,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":5,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":5,"name":"all-newcomers-are-customers"},{"count":5,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":5,"name":"irr-TC-all-oldcomer-no-record"},{"count":5,"name":"not-previously-announced-by-any-newcomer"},{"count":5,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":5,"name":"irr-REACH-all-oldcomer-no-record"},{"count":5,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":5,"name":"irr-BELL-all-newcomer-no-record"},{"count":5,"name":"some-newcomers-are-rel-downstream"},{"count":5,"name":"rpki-some-newcomer-invalid-roa"},{"count":5,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":5,"name":"long-prefix"},{"count":5,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":5,"name":"all-newcomers-next-to-an-oldcomer"},{"count":5,"name":"all-newcomers-are-rel-neighbor"},{"count":5,"name":"rpki-all-oldcomer-valid-roa"}],"pfx_events_cnt":5,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0026397705078125,"proc_time_tagger":1.317047357559204,"total_tags_cnt":62},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-18734=278","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":90,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are customers","inference_id":"rpki-all-newcomers-invalid-and-customers","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":80,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"rpki-all-newcomers-invalid-and-oldcomer-on-paths","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"189.202.152.108/31","super_pfx":"189.202.128.0/17","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":90,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are customers","inference_id":"rpki-all-newcomers-invalid-and-customers","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":80,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"rpki-all-newcomers-invalid-and-oldcomer-on-paths","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"189.202.154.232/29","super_pfx":"189.202.128.0/17","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":90,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are customers","inference_id":"rpki-all-newcomers-invalid-and-customers","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":80,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"rpki-all-newcomers-invalid-and-oldcomer-on-paths","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"189.202.152.164/31","super_pfx":"189.202.128.0/17","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":90,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are customers","inference_id":"rpki-all-newcomers-invalid-and-customers","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":80,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"rpki-all-newcomers-invalid-and-oldcomer-on-paths","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"189.202.158.232/29","super_pfx":"189.202.128.0/17","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":90,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are customers","inference_id":"rpki-all-newcomers-invalid-and-customers","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":80,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"rpki-all-newcomers-invalid-and-oldcomer-on-paths","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"189.202.153.4/31","super_pfx":"189.202.128.0/17","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"}]}],"summary":{"ases":["278","18734"],"attackers":["278"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}],"primary_inference":{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}},"newcomers":["278"],"prefixes":["189.202.152.108/31","189.202.153.4/31","189.202.158.232/29","189.202.152.164/31","189.202.154.232/29","189.202.128.0/17"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["18734"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-valid-roa"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"single-rel-upstream-chain"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-all-siblings"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"some-newcomers-are-customers"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"all-newcomers-are-rel-downstream"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"some-newcomers-stub-ases"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":2,"name":"all-newcomers-stub-ases"},{"count":2,"name":"some-newcomers-are-rel-neighbor"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-valid-roa"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-customers"},{"count":2,"name":"rpki-some-newcomer-valid-roa"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-some-siblings"},{"count":2,"name":"some-newcomers-are-rel-downstream"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-rel-neighbor"},{"count":2,"name":"rpki-all-oldcomer-valid-roa"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"all-newcomers-ris-peer"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0014882087707519531,"proc_time_tagger":1.1198558807373047,"total_tags_cnt":77},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-4601=210312","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d02::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"147.189.218.0/24","super_pfx":"147.189.216.0/21","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3d02::/48","147.189.216.0/21","147.189.218.0/24","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"647":{"asrank":{"asn":"647","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"DNIC-ASBLK-00616-00665","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":12482},"hegemony":0},"721":{"asrank":{"asn":"721","asnDegree":{"customer":3,"peer":0,"provider":1},"asnName":"DNIC-ASBLK-00721-00726","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":431},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"oldcomer-path-prepending"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-unknown-roa"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-all-siblings"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-unknown-roa"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":2,"name":"previously-announced-by-all-newcomers"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"all-newcomers-are-rel-downstream"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-stub-ases"},{"count":2,"name":"irr-all-oldcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"all-newcomers-stub-ases"},{"count":2,"name":"rpki-some-newcomer-unknown-roa"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-some-siblings"},{"count":2,"name":"some-newcomers-are-rel-downstream"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"prefix-small-edit-distance"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-oldcomer-unknown-roa"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0007300376892089844,"proc_time_tagger":2.3540749549865723,"total_tags_cnt":65},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-721=647","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"205.60.244.0/24","super_pfx":"205.56.0.0/13","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"205.60.240.0/22","super_pfx":"205.56.0.0/13","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["721","647"],"attackers":["647"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["647"],"prefixes":["205.56.0.0/13","205.60.244.0/24","205.60.240.0/22"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["721"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"14080":{"asrank":{"asn":"14080","asnDegree":{"customer":26,"peer":7,"provider":6},"asnName":"","organization":{"country":{"iso":"CO"},"orgId":"@aut-27864-LACNIC"},"rank":1195},"hegemony":0},"26611":{"asrank":{"asn":"26611","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"","organization":{"country":{"iso":"CO"},"orgId":"@aut-26611-LACNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-valid-roa"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-more-specific-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"all-victims-stub-ases"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"single-rel-upstream-chain"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"no-origins-prev-view"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-are-rel-upstream"},{"count":2,"name":"some-newcomers-are-providers"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"all-newcomers"},{"count":2,"name":"some-victims-stub-ases"},{"count":2,"name":"some-newcomers-are-rel-neighbor"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-valid-roa"},{"count":2,"name":"all-newcomer-pfxs"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"newcomer-less-specific"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"rpki-some-newcomer-valid-roa"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-providers"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-rel-upstream"},{"count":2,"name":"single-peer-on-victim-path"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-rel-neighbor"},{"count":2,"name":"rpki-all-oldcomer-valid-roa"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.002507925033569336,"proc_time_tagger":1.1462104320526123,"total_tags_cnt":63},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-26611=14080","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":91,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s). Probably, they are providing services to their customers (e.g., blackholing)","inference_id":"all-newcomers-providers","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2800:800:420::/44","super_pfx":"2800:800:400::/40","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-newcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"single-peer-on-victim-path"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"}]},{"finished_ts":null,"inferences":[{"confidence":91,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s). Probably, they are providing services to their customers (e.g., blackholing)","inference_id":"all-newcomers-providers","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2800:800:430::/44","super_pfx":"2800:800:400::/40","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-newcomer-more-specific-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"single-peer-on-victim-path"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"}]}],"summary":{"ases":["26611","14080"],"attackers":["14080"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["26611","14080"],"prefixes":["2800:800:400::/40","2800:800:420::/44","2800:800:430::/44"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"single-peer-on-victim-path"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-newcomer-more-specific-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"all-newcomers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["26611"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"137409":{"asrank":{"asn":"137409","asnDegree":{"customer":183,"peer":4353,"provider":6},"asnName":"GSLNETWORKS-AS-AP","organization":{"country":{"iso":"AU"},"orgId":"ORG-GNPL1-AP-APNIC"},"rank":54},"hegemony":0},"7578":{"asrank":{"asn":"7578","asnDegree":{"customer":0,"peer":1,"provider":1},"asnName":"GSL","organization":{"country":{"iso":"AU"},"orgId":"ORG-GNPL1-AP-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-dps-asn"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"all-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"anycast-prefix"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-dps-asn"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-exact-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"due-to-dps-asn"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0007047653198242188,"proc_time_tagger":0.021297216415405273,"total_tags_cnt":72},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-7578=137409","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"206.148.22.2/32","super_pfx":"206.148.22.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"anycast-prefix"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["7578","137409"],"attackers":["137409"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["137409"],"prefixes":["206.148.22.0/24","206.148.22.2/32"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"anycast-prefix"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["7578"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"209":{"asrank":{"asn":"209","asnDegree":{"customer":406,"peer":24,"provider":0},"asnName":"CENTURYLINK-US-LEGACY-QWEST","organization":{"country":{"iso":"US"},"orgId":"CCL-534-ARIN"},"rank":135},"hegemony":0},"3356":{"asrank":{"asn":"3356","asnDegree":{"customer":6478,"peer":75,"provider":0},"asnName":"LEVEL3","organization":{"country":{"iso":"US"},"orgId":"LPL-141-ARIN"},"rank":1},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-manrs-member"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-dps-asn"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-peers"},{"count":2,"name":"single-peer-on-attacker-path"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-unknown-roa"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-all-siblings"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-more-specific-record"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-unknown-roa"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-oldcomer-unknown-roa"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-are-peers"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"all-oldcomers-routeviews-peer"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-dps-asn"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"some-newcomers-are-rel-neighbor"},{"count":2,"name":"rpki-some-newcomer-unknown-roa"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"due-to-dps-asn"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"has-dps-asn"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-some-siblings"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-routeviews-peer"},{"count":2,"name":"long-prefix"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-rel-neighbor"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0015561580657958984,"proc_time_tagger":0.47293591499328613,"total_tags_cnt":71},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-209=3356","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"67.135.240.40/29","super_pfx":"67.128.0.0/13","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-peers"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-more-specific-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-are-peers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"208.45.230.128/26","super_pfx":"208.44.0.0/14","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-peers"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-more-specific-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-are-peers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["3356","209"],"attackers":["3356"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}],"primary_inference":{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}},"newcomers":["3356"],"prefixes":["208.45.230.128/26","67.135.240.40/29","67.128.0.0/13","208.44.0.0/14"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-more-specific-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-peers"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-are-peers"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["209"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"209605":{"asrank":{"asn":"209605","asnDegree":{"customer":2,"peer":4,"provider":3},"asnName":"hostbaltic","organization":{"country":{"iso":"LT"},"orgId":"ORG-UHB3-RIPE"},"rank":5776},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00048089027404785156,"proc_time_tagger":3.9733221530914307,"total_tags_cnt":55},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-209605=52468","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"141.98.10.115/32","super_pfx":"141.98.10.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["209605","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["141.98.10.0/24","141.98.10.115/32"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["209605"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"26615":{"asrank":{"asn":"26615","asnDegree":{"customer":72,"peer":30,"provider":6},"asnName":"","organization":{"country":{"iso":"BR"},"orgId":"@aut-26615-LACNIC"},"rank":73},"hegemony":0},"749":{"asrank":{"asn":"749","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"DNIC-AS-00749","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00048232078552246094,"proc_time_tagger":1.296994686126709,"total_tags_cnt":54},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-749=26615","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":55,"explanation":"All newcomers already announced the prefix in the past","inference_id":"previously-announced-by-all-newcomers","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"11.193.11.0/24","super_pfx":"11.0.0.0/8","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["749","26615"],"attackers":["26615"],"inference_result":{"inferences":[{"confidence":55,"explanation":"All newcomers already announced the prefix in the past","inference_id":"previously-announced-by-all-newcomers","labels":["legitimate"],"suspicion_level":20}],"primary_inference":{"confidence":55,"explanation":"All newcomers already announced the prefix in the past","inference_id":"previously-announced-by-all-newcomers","labels":["legitimate"],"suspicion_level":20}},"newcomers":["26615"],"prefixes":["11.193.11.0/24","11.0.0.0/8"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["749"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"17494":{"asrank":{"asn":"17494","asnDegree":{"customer":58,"peer":652,"provider":8},"asnName":"BTTB-AS-AP","organization":{"country":{"iso":"BD"},"orgId":"ORG-BTTB1-AP-APNIC"},"rank":202},"hegemony":0},"36040":{"asrank":{"asn":"36040","asnDegree":{"customer":0,"peer":26,"provider":32},"asnName":"YOUTUBE","organization":{"country":{"iso":"US"},"orgId":"GOGL-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005140304565429688,"proc_time_tagger":1.1322507858276367,"total_tags_cnt":57},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-17494=36040","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":80,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"rpki-all-newcomers-invalid-and-oldcomer-on-paths","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"114.130.224.128/28","super_pfx":"114.130.224.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["36040","17494"],"attackers":["36040"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}],"primary_inference":{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}},"newcomers":["36040"],"prefixes":["114.130.224.128/28","114.130.224.0/24"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"}],"tr_worthy":false,"victims":["17494"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"22561":{"asrank":{"asn":"22561","asnDegree":{"customer":13,"peer":0,"provider":1},"asnName":"CENTURYLINK-LEGACY-LIGHTCORE","organization":{"country":{"iso":"US"},"orgId":"CCL-534-ARIN"},"rank":2030},"hegemony":0},"3356":{"asrank":{"asn":"3356","asnDegree":{"customer":6478,"peer":75,"provider":0},"asnName":"LEVEL3","organization":{"country":{"iso":"US"},"orgId":"LPL-141-ARIN"},"rank":1},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-dps-asn"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-dps-asn"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"due-to-dps-asn"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004994869232177734,"proc_time_tagger":0.2356109619140625,"total_tags_cnt":69},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-22561=3356","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"64.91.48.208/28","super_pfx":"64.91.48.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-more-specific-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["3356","22561"],"attackers":["3356"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}],"primary_inference":{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}},"newcomers":["3356"],"prefixes":["64.91.48.0/22","64.91.48.208/28"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-more-specific-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"has-dps-asn"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["22561"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"24634":{"asrank":{"asn":"24634","asnDegree":{"customer":3,"peer":0,"provider":2},"asnName":"Cyberia-AS","organization":{"country":{"iso":"LB"},"orgId":"ORG-CS13-RIPE"},"rank":4753},"hegemony":0},"9051":{"asrank":{"asn":"9051","asnDegree":{"customer":14,"peer":0,"provider":2},"asnName":"","organization":{"country":{"iso":"LB"},"orgId":"ORG-IA38-RIPE"},"rank":1938},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"oldcomer-path-prepending"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-valid-roa"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"single-peer-on-attacker-path"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"some-newcomers-are-customers"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"previously-announced-by-all-newcomers"},{"count":2,"name":"all-newcomers-are-rel-downstream"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-all-newcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"some-newcomers-are-rel-neighbor"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-valid-roa"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-customers"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"rpki-some-newcomer-valid-roa"},{"count":2,"name":"irr-RIPE-all-oldcomer-exact-record"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-are-rel-downstream"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-rel-neighbor"},{"count":2,"name":"rpki-all-oldcomer-valid-roa"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0013124942779541016,"proc_time_tagger":1.1106765270233154,"total_tags_cnt":59},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-9051=24634","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"sub_pfx":"212.36.210.0/24","super_pfx":"212.36.192.0/19","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"sub_pfx":"193.227.182.0/24","super_pfx":"193.227.160.0/19","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["24634","9051"],"attackers":["24634"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["24634"],"prefixes":["212.36.192.0/19","193.227.160.0/19","212.36.210.0/24","193.227.182.0/24"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["9051"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"5580":{"asrank":{"asn":"5580","asnDegree":{"customer":32,"peer":92,"provider":3},"asnName":"GTT-ASIA","organization":{"country":{"iso":"NL"},"orgId":"ORG-ICNB1-RIPE"},"rank":180},"hegemony":0},"63927":{"asrank":{"asn":"63927","asnDegree":{"customer":45,"peer":2137,"provider":4},"asnName":"RISE-HK","organization":{"country":{"iso":"HK"},"orgId":"ORG-RATL1-AP-APNIC"},"rank":571},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"all-newcomers-are-peers"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"some-newcomers-are-peers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-peers"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-peers"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-manrs-member"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009808540344238281,"proc_time_tagger":0.10894083976745605,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-63927=5580","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"2401:da80:4000:2::/112","super_pfx":"2401:da80::/32","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"all-newcomers-are-peers"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"some-newcomers-are-peers"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-manrs-member"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["5580","63927"],"attackers":["5580"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["5580","63927"],"prefixes":["2401:da80:4000:2::/112","2401:da80::/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-manrs-member"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-peers"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"some-newcomers-are-peers"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["63927"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"137074":{"asrank":{"asn":"137074","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"RISE-AS-AP","organization":{"country":{"iso":"PH"},"orgId":"ORG-RISE1-AP-APNIC"},"rank":12482},"hegemony":0},"5580":{"asrank":{"asn":"5580","asnDegree":{"customer":32,"peer":92,"provider":3},"asnName":"GTT-ASIA","organization":{"country":{"iso":"NL"},"orgId":"ORG-ICNB1-RIPE"},"rank":180},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0008952617645263672,"proc_time_tagger":0.040246009826660156,"total_tags_cnt":57},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-137074=5580","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"103.43.212.52/30","super_pfx":"103.43.212.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["137074","5580"],"attackers":["5580"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}],"primary_inference":{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}},"newcomers":["5580"],"prefixes":["103.43.212.0/22","103.43.212.52/30"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["137074"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0},"8447":{"asrank":{"asn":"8447","asnDegree":{"customer":130,"peer":162,"provider":5},"asnName":"A1TELEKOM-AT","organization":{"country":{"iso":"AT"},"orgId":"ORG-TAA1-RIPE"},"rank":181},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-ris-peer"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0014820098876953125,"proc_time_tagger":0.04663872718811035,"total_tags_cnt":57},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-8447=52468","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"88.117.244.197/32","super_pfx":"88.116.0.0/15","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["8447","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["88.116.0.0/15","88.117.244.197/32"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["8447"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"27064":{"asrank":{"asn":"27064","asnDegree":{"customer":71,"peer":0,"provider":1},"asnName":"DNIC-ASBLK-27032-27159","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":586},"hegemony":0},"367":{"asrank":{"asn":"367","asnDegree":{"customer":0,"peer":10,"provider":2},"asnName":"DNIC-ASBLK-00306-00371","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"prefix-small-edit-distance"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004203319549560547,"proc_time_tagger":1.3748993873596191,"total_tags_cnt":73},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-27064=367","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"132.7.47.0/24","super_pfx":"132.7.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["27064","367"],"attackers":["367"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["367"],"prefixes":["132.7.47.0/24","132.7.0.0/16"],"tags":[{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["27064"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"266520":{"asrank":{"asn":"266520","asnDegree":{"customer":28,"peer":27,"provider":2},"asnName":"","organization":{"country":{"iso":"BR"},"orgId":"@aut-266520-LACNIC"},"rank":1113},"hegemony":0},"53153":{"asrank":{"asn":"53153","asnDegree":{"customer":4,"peer":12,"provider":22},"asnName":"","organization":{"country":{"iso":"BR"},"orgId":"@aut-53153-LACNIC"},"rank":4097},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-ALTDB-all-oldcomer-more-specific-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0003769397735595703,"proc_time_tagger":1.0660111904144287,"total_tags_cnt":63},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-266520=53153","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":90,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are customers","inference_id":"rpki-all-newcomers-invalid-and-customers","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":80,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"rpki-all-newcomers-invalid-and-oldcomer-on-paths","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"170.245.94.216/31","super_pfx":"170.245.94.0/24","tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-more-specific-record"}]}],"summary":{"ases":["53153","266520"],"attackers":["53153"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}],"primary_inference":{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}},"newcomers":["53153"],"prefixes":["170.245.94.0/24","170.245.94.216/31"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-more-specific-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["266520"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0},"7713":{"asrank":{"asn":"7713","asnDegree":{"customer":536,"peer":3087,"provider":10},"asnName":"telkomnet-as-ap","organization":{"country":{"iso":"ID"},"orgId":"ORG-TI10-AP-APNIC"},"rank":88},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-are-peers"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-peers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-peers"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-peers"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005595684051513672,"proc_time_tagger":0.06734991073608398,"total_tags_cnt":63},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-7713=52468","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"36.67.234.41/32","super_pfx":"36.67.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"all-newcomers-are-peers"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-are-peers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["7713","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["36.67.0.0/16","36.67.234.41/32"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"all-newcomers-are-peers"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-are-peers"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["7713"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"42675":{"asrank":{"asn":"42675","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"OBEHOSTING","organization":{"country":{"iso":"SE"},"orgId":"ORG-OA1026-RIPE"},"rank":12482},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004754066467285156,"proc_time_tagger":0.04646492004394531,"total_tags_cnt":57},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-42675=52468","insert_ts":1776599844,"last_modified_ts":1776599844,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"217.64.148.122/32","super_pfx":"217.64.148.0/23","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["42675","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["217.64.148.122/32","217.64.148.0/23"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["42675"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"16509":{"asrank":{"asn":"16509","asnDegree":{"customer":72,"peer":332,"provider":18},"asnName":"AMAZON-02","organization":{"country":{"iso":"US"},"orgId":"AMAZON-4-ARIN"},"rank":510},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-ris-peer"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-oldcomers-manrs-member"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005290508270263672,"proc_time_tagger":0.031533241271972656,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-16509=52468","insert_ts":1776599844,"last_modified_ts":1776599845,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"3.126.16.103/32","super_pfx":"3.124.0.0/14","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["16509","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["3.124.0.0/14","3.126.16.103/32"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["16509"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"401696":{"asrank":{"asn":"401696","asnDegree":{"customer":1,"peer":0,"provider":1},"asnName":"COGNETCLOUD","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":7646},"hegemony":0},"401701":{"asrank":{"asn":"401701","asnDegree":{"customer":0,"peer":0,"provider":3},"asnName":"COGNETCLOUD-2","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":12482},"hegemony":0},"53808":{"asrank":{"asn":"53808","asnDegree":{"customer":2,"peer":0,"provider":5},"asnName":"MOEDOVE-N2","organization":{"country":{"iso":"US"},"orgId":"ML-1454-ARIN"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"spamhaus-asn-drop"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"prefix-small-edit-distance"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006439685821533203,"proc_time_tagger":0.03684496879577637,"total_tags_cnt":61},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-401696=401701_53808","insert_ts":1776599844,"last_modified_ts":1776599845,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":91,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s). Probably, they are providing services to their customers (e.g., blackholing)","inference_id":"all-newcomers-providers","labels":["legitimate"],"suspicion_level":20},{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"45.207.217.0/24","super_pfx":"45.207.216.0/23","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["53808","401701","401696"],"attackers":["401696"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["401696"],"prefixes":["45.207.217.0/24","45.207.216.0/23"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["53808","401701"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"393398":{"asrank":{"asn":"393398","asnDegree":{"customer":3,"peer":14,"provider":6},"asnName":"ASN-DIS","organization":{"country":{"iso":"US"},"orgId":"RDPL-2-ARIN"},"rank":4753},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0002410411834716797,"proc_time_tagger":0.04529309272766113,"total_tags_cnt":54},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-393398=52468","insert_ts":1776599844,"last_modified_ts":1776599845,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"38.135.35.85/32","super_pfx":"38.135.32.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["52468","393398"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["38.135.35.85/32","38.135.32.0/22"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["393398"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"1540":{"asrank":{"asn":"1540","asnDegree":{"customer":0,"peer":2,"provider":1},"asnName":"DNIC-ASBLK-01534-01546","organization":{"country":{"iso":"US"},"orgId":"HEADQU-3-ARIN"},"rank":12482},"hegemony":0},"747":{"asrank":{"asn":"747","asnDegree":{"customer":0,"peer":1,"provider":1},"asnName":"DNIC-AS-00747","organization":{"country":{"iso":"US"},"orgId":"HEADQU-3-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-peers"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-peers"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00025391578674316406,"proc_time_tagger":1.1228594779968262,"total_tags_cnt":64},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-747=1540","insert_ts":1776599844,"last_modified_ts":1776599845,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"sub_pfx":"143.86.128.0/23","super_pfx":"143.86.128.0/20","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["747","1540"],"attackers":["1540"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["1540"],"prefixes":["143.86.128.0/20","143.86.128.0/23"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["747"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"136510":{"asrank":{"asn":"136510","asnDegree":{"customer":1,"peer":1,"provider":1},"asnName":"STREAMLINESERVERS-AS-AP","organization":{"country":{"iso":"AU"},"orgId":"ORG-SSPL15-AP-APNIC"},"rank":7646},"hegemony":0},"64199":{"asrank":{"asn":"64199","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"TCPSHIELD","organization":{"country":{"iso":"CA"},"orgId":"DE-316-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-exact-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00036644935607910156,"proc_time_tagger":0.881375789642334,"total_tags_cnt":53},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-136510=64199","insert_ts":1776599844,"last_modified_ts":1776599845,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9},{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"sub_pfx":"198.178.119.30/31","super_pfx":"198.178.119.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-exact-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["64199","136510"],"attackers":["64199"],"inference_result":{"inferences":[{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}],"primary_inference":{"confidence":99,"explanation":"Prefix more specific than a /24 or a /48 (unlikely to be propagated). It could be blackholing (e.g., for DoS mitigation)","inference_id":"blackholed-prefix","labels":["legitimate"],"suspicion_level":9}},"newcomers":["64199"],"prefixes":["198.178.119.30/31","198.178.119.0/24"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-exact-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["136510"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"2152":{"asrank":{"asn":"2152","asnDegree":{"customer":87,"peer":59,"provider":3},"asnName":"CENIC-2152","organization":{"country":{"iso":"US"},"orgId":"CENIC-ARIN"},"rank":329},"hegemony":0},"46750":{"asrank":{"asn":"46750","asnDegree":{"customer":0,"peer":1,"provider":1},"asnName":"STANFORD-INTERNET-ACCESS2","organization":{"country":{"iso":"US"},"orgId":"STANFO-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-routeviews-peer"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-manrs-member"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00032210350036621094,"proc_time_tagger":1.1727380752563477,"total_tags_cnt":71},"event_type":"submoas","finished_ts":null,"id":"submoas-1776596400-2152=46750","insert_ts":1776599844,"last_modified_ts":1776599845,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"2607:f380:1::118:9a41:7b20/123","super_pfx":"2607:f380::/32","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"some-newcomers-routeviews-peer"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"some-newcomers-manrs-member"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["46750","2152"],"attackers":["46750"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["46750","2152"],"prefixes":["2607:f380::/32","2607:f380:1::118:9a41:7b20/123"],"tags":[{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"some-newcomers-manrs-member"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["2152"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776596400},{"asinfo":{"8371":{"asrank":{"asn":"8371","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"Vimpelcom-NN","organization":{"country":{"iso":"RU"},"orgId":"ORG-ES15-RIPE"},"rank":12482},"hegemony":0},"8402":{"asrank":{"asn":"8402","asnDegree":{"customer":10,"peer":6,"provider":2},"asnName":"CORBINA-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-CTAM1-RIPE"},"rank":2419},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004975795745849609,"proc_time_tagger":1.0587010383605957,"total_tags_cnt":62},"event_type":"submoas","finished_ts":null,"id":"submoas-1776595800-8371=8402","insert_ts":1776598590,"last_modified_ts":1776598590,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"92.242.70.250/32","super_pfx":"92.242.64.0/19","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["8371","8402"],"attackers":["8402"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["8402"],"prefixes":["92.242.70.250/32","92.242.64.0/19"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["8371"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776595800},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010132789611816406,"proc_time_tagger":1.096411943435669,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776595800-4601=210312","insert_ts":1776598590,"last_modified_ts":1776598590,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d01::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc0::/29","2a0d:3dc1:3d01::/48"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776595800},{"asinfo":{"12741":{"asrank":{"asn":"12741","asnDegree":{"customer":426,"peer":711,"provider":3},"asnName":"AS-NETIA","organization":{"country":{"iso":"PL"},"orgId":"ORG-NTS2-RIPE"},"rank":108},"hegemony":0},"12887":{"asrank":{"asn":"12887","asnDegree":{"customer":1,"peer":0,"provider":1},"asnName":"NETIA-AS2","organization":{"country":{"iso":"PL"},"orgId":"ORG-NTS2-RIPE"},"rank":7646},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009682178497314453,"proc_time_tagger":1.0889906883239746,"total_tags_cnt":67},"event_type":"submoas","finished_ts":null,"id":"submoas-1776595800-12887=12741","insert_ts":1776598590,"last_modified_ts":1776598590,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"93.159.28.28/32","super_pfx":"93.159.28.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["12887","12741"],"attackers":["12741"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["12741"],"prefixes":["93.159.28.0/24","93.159.28.28/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["12887"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776595800},{"asinfo":{"8371":{"asrank":{"asn":"8371","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"Vimpelcom-NN","organization":{"country":{"iso":"RU"},"orgId":"ORG-ES15-RIPE"},"rank":12482},"hegemony":0},"8402":{"asrank":{"asn":"8402","asnDegree":{"customer":10,"peer":6,"provider":2},"asnName":"CORBINA-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-CTAM1-RIPE"},"rank":2419},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004210472106933594,"proc_time_tagger":1.0881528854370117,"total_tags_cnt":62},"event_type":"submoas","finished_ts":null,"id":"submoas-1776595200-8371=8402","insert_ts":1776597986,"last_modified_ts":1776597986,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"92.242.70.137/32","super_pfx":"92.242.64.0/19","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["8371","8402"],"attackers":["8402"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["8402"],"prefixes":["92.242.64.0/19","92.242.70.137/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["8371"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776595200},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009038448333740234,"proc_time_tagger":1.0255296230316162,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776595200-4601=210312","insert_ts":1776597986,"last_modified_ts":1776597986,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3d00::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3d00::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776595200},{"asinfo":{"135089":{"asrank":{"asn":"135089","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"CHINANET-Guangzhou-Southbase-IDC","organization":{"country":{"iso":"CN"},"orgId":"ORG-CT1-AP-APNIC"},"rank":12482},"hegemony":0},"4134":{"asrank":{"asn":"4134","asnDegree":{"customer":145,"peer":148,"provider":6},"asnName":"CHINANET-BACKBONE","organization":{"country":{"iso":"CN"},"orgId":"@aut-4134-APNIC"},"rank":125},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-manrs-member"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"all-victims-stub-ases"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"single-rel-upstream-chain"},{"count":2,"name":"rpki-all-oldcomer-invalid-roa"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"count":2,"name":"single-peer-on-attacker-path"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-unknown-roa"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-ris-peer"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-all-siblings"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-invalid-roa"},{"count":2,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":2,"name":"previously-announced-by-all-newcomers"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-all-oldcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-are-rel-upstream"},{"count":2,"name":"some-newcomers-are-providers"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"some-victims-stub-ases"},{"count":2,"name":"some-newcomers-are-rel-neighbor"},{"count":2,"name":"rpki-oldcomer-invalid-roa-due-to-as"},{"count":2,"name":"rpki-some-newcomer-unknown-roa"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"newcomer-less-specific"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-providers"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-some-siblings"},{"count":2,"name":"all-newcomers-are-rel-upstream"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"prefix-small-edit-distance"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":2,"name":"all-newcomers-are-rel-neighbor"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.112548828125,"proc_time_tagger":1.4522204399108887,"total_tags_cnt":71},"event_type":"submoas","finished_ts":null,"id":"submoas-1776594600-4134=135089","insert_ts":1776597411,"last_modified_ts":1776597412,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"121.14.201.0/24","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"rpki-all-oldcomer-invalid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-invalid-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-oldcomer-invalid-roa-due-to-as"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"121.14.203.0/24","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"rpki-all-oldcomer-invalid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-invalid-roa"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-oldcomer-invalid-roa-due-to-as"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["135089","4134"],"attackers":["4134"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["4134"],"prefixes":["121.14.201.0/24","121.14.0.0/16","121.14.203.0/24"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"rpki-all-oldcomer-invalid-roa"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-oldcomer-invalid-roa-due-to-as"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-invalid-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["135089"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776594600},{"asinfo":{"134763":{"asrank":{"asn":"134763","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"CT-DongGuan-IDC","organization":{"country":{"iso":"CN"},"orgId":"@family-34979"},"rank":12482},"hegemony":0},"4134":{"asrank":{"asn":"4134","asnDegree":{"customer":145,"peer":148,"provider":6},"asnName":"CHINANET-BACKBONE","organization":{"country":{"iso":"CN"},"orgId":"@aut-4134-APNIC"},"rank":125},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":6,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":6,"name":"all-newcomers-manrs-member"},{"count":6,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":6,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":6,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":6,"name":"all-victims-stub-ases"},{"count":6,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":6,"name":"irr-BBOI-all-newcomer-no-record"},{"count":6,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":6,"name":"single-rel-upstream-chain"},{"count":6,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":6,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":6,"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"count":6,"name":"single-peer-on-attacker-path"},{"count":6,"name":"irr-ARIN-all-newcomer-no-record"},{"count":6,"name":"rpki-all-newcomer-unknown-roa"},{"count":6,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":6,"name":"all-newcomers-ris-peer"},{"count":6,"name":"irr-APNIC-all-newcomer-no-record"},{"count":6,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":6,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":6,"name":"previously-announced-by-some-newcomers"},{"count":6,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":6,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":6,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":6,"name":"irr-PANIX-all-newcomer-no-record"},{"count":6,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":6,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":6,"name":"previously-announced-by-all-newcomers"},{"count":6,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":6,"name":"irr-all-oldcomer-no-record"},{"count":6,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":6,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":6,"name":"irr-RIPE-all-newcomer-no-record"},{"count":6,"name":"irr-BELL-all-oldcomer-no-record"},{"count":6,"name":"irr-RADB-all-oldcomer-no-record"},{"count":6,"name":"irr-TC-all-newcomer-no-record"},{"count":6,"name":"some-newcomers-are-rel-upstream"},{"count":6,"name":"some-newcomers-are-providers"},{"count":6,"name":"all-origins-same-country"},{"count":6,"name":"some-victims-stub-ases"},{"count":6,"name":"some-newcomers-are-rel-neighbor"},{"count":6,"name":"rpki-some-newcomer-unknown-roa"},{"count":6,"name":"irr-REACH-all-newcomer-no-record"},{"count":6,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":6,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":6,"name":"rpki-some-oldcomer-valid-roa"},{"count":6,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":6,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":6,"name":"newcomer-less-specific"},{"count":6,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":6,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":6,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":6,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":6,"name":"irr-TC-all-oldcomer-no-record"},{"count":6,"name":"all-newcomers-are-providers"},{"count":6,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":6,"name":"irr-REACH-all-oldcomer-no-record"},{"count":6,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":6,"name":"irr-BELL-all-newcomer-no-record"},{"count":6,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":6,"name":"all-newcomers-are-rel-upstream"},{"count":6,"name":"prefix-small-edit-distance"},{"count":6,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":6,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":6,"name":"all-newcomers-are-rel-neighbor"},{"count":6,"name":"rpki-all-oldcomer-valid-roa"},{"count":6,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":6,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.32735252380371094,"proc_time_tagger":0.7364952564239502,"total_tags_cnt":68},"event_type":"submoas","finished_ts":null,"id":"submoas-1776594600-4134=134763","insert_ts":1776597411,"last_modified_ts":1776597412,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"121.14.136.0/22","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"121.14.140.0/22","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"121.14.144.0/22","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"121.14.128.0/21","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"121.14.148.0/22","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"121.14.152.0/21","super_pfx":"121.14.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["134763","4134"],"attackers":["4134"],"inference_result":{"inferences":[{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"primary_inference":{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}},"newcomers":["4134"],"prefixes":["121.14.144.0/22","121.14.128.0/21","121.14.136.0/22","121.14.0.0/16","121.14.140.0/22","121.14.148.0/22","121.14.152.0/21"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-Tier-1-upstream-on-subpaths-1-hop"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["134763"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776594600},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.000759124755859375,"proc_time_tagger":1.0076112747192383,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776594600-4601=210312","insert_ts":1776597412,"last_modified_ts":1776597412,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cff::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cff::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776594600},{"asinfo":{"29802":{"asrank":{"asn":"29802","asnDegree":{"customer":65,"peer":125,"provider":18},"asnName":"HVC-AS","organization":{"country":{"iso":"US"},"orgId":"HVC-3-ARIN"},"rank":522},"hegemony":0},"32748":{"asrank":{"asn":"32748","asnDegree":{"customer":6,"peer":19,"provider":3},"asnName":"STEADFAST","organization":{"country":{"iso":"US"},"orgId":"SNL-74-ARIN"},"rank":2998},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-more-specific-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-ALTDB-all-newcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006468296051025391,"proc_time_tagger":1.061070203781128,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776594600-29802=32748","insert_ts":1776597412,"last_modified_ts":1776597412,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"208.66.172.53/32","super_pfx":"208.66.168.0/21","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"irr-ALTDB-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["32748","29802"],"attackers":["32748"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["32748"],"prefixes":["208.66.168.0/21","208.66.172.53/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-ARIN-all-newcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-ALTDB-all-newcomer-more-specific-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["29802"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776594600},{"asinfo":{"7725":{"asrank":{"asn":"7725","asnDegree":{"customer":66,"peer":0,"provider":2},"asnName":"COMCAST-7725","organization":{"country":{"iso":"US"},"orgId":"CCCS-ARIN"},"rank":654},"hegemony":0},"7922":{"asrank":{"asn":"7922","asnDegree":{"customer":111,"peer":59,"provider":3},"asnName":"COMCAST-7922","organization":{"country":{"iso":"US"},"orgId":"CCCS-ARIN"},"rank":39},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-exact-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0003516674041748047,"proc_time_tagger":1.1132514476776123,"total_tags_cnt":66},"event_type":"submoas","finished_ts":null,"id":"submoas-1776594600-7922=7725","insert_ts":1776597412,"last_modified_ts":1776597412,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:559:59e::/48","super_pfx":"2001:558::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-exact-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["7725","7922"],"attackers":["7725"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["7725","7922"],"prefixes":["2001:559:59e::/48","2001:558::/29"],"tags":[{"name":"all-newcomers-manrs-member"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-exact-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["7922"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776594600},{"asinfo":{"1540":{"asrank":{"asn":"1540","asnDegree":{"customer":0,"peer":2,"provider":1},"asnName":"DNIC-ASBLK-01534-01546","organization":{"country":{"iso":"US"},"orgId":"HEADQU-3-ARIN"},"rank":12482},"hegemony":0},"721":{"asrank":{"asn":"721","asnDegree":{"customer":3,"peer":0,"provider":1},"asnName":"DNIC-ASBLK-00721-00726","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":431},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"oldcomer-path-prepending"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-unknown-roa"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-all-siblings"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-unknown-roa"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"all-newcomers-are-rel-downstream"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-stub-ases"},{"count":2,"name":"irr-all-oldcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"all-newcomers-stub-ases"},{"count":2,"name":"rpki-some-newcomer-unknown-roa"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"oldcomer-newcomer-some-siblings"},{"count":2,"name":"some-newcomers-are-rel-downstream"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"prefix-small-edit-distance"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-oldcomer-unknown-roa"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"previously-announced-by-all-newcomers"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0015876293182373047,"proc_time_tagger":1.6241819858551025,"total_tags_cnt":66},"event_type":"submoas","finished_ts":null,"id":"submoas-1776594300-721=1540","insert_ts":1776597086,"last_modified_ts":1776597086,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"143.74.8.0/24","super_pfx":"143.74.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"143.74.29.0/24","super_pfx":"143.74.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["721","1540"],"attackers":["1540"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["1540"],"prefixes":["143.74.29.0/24","143.74.0.0/16","143.74.8.0/24"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["721"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776594300},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0017023086547851562,"proc_time_tagger":1.0805785655975342,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776594000-4601=210312","insert_ts":1776596785,"last_modified_ts":1776596785,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cfe::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cfe::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776594000},{"asinfo":{"3216":{"asrank":{"asn":"3216","asnDegree":{"customer":886,"peer":1109,"provider":9},"asnName":"SOVAM-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-ES15-RIPE"},"rank":27},"hegemony":0},"8402":{"asrank":{"asn":"8402","asnDegree":{"customer":10,"peer":6,"provider":2},"asnName":"CORBINA-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-CTAM1-RIPE"},"rank":2419},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-victim-path"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010287761688232422,"proc_time_tagger":1.0615575313568115,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776593400-3216=8402","insert_ts":1776596187,"last_modified_ts":1776596187,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"195.14.46.41/32","super_pfx":"195.14.46.0/26","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"single-peer-on-victim-path"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["8402","3216"],"attackers":["8402"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["8402"],"prefixes":["195.14.46.0/26","195.14.46.41/32"],"tags":[{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-oldcomers-routeviews-peer"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"single-peer-on-victim-path"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["3216"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776593400},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010480880737304688,"proc_time_tagger":1.1030681133270264,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776593400-4601=210312","insert_ts":1776596187,"last_modified_ts":1776596187,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cfd::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cfd::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776593400},{"asinfo":{"198949":{"asrank":{"asn":"198949","asnDegree":{"customer":162,"peer":46,"provider":23},"asnName":"Radware","organization":{"country":{"iso":"IL"},"orgId":"ORG-RL239-RIPE"},"rank":283},"hegemony":0},"25773":{"asrank":{"asn":"25773","asnDegree":{"customer":1,"peer":12,"provider":10},"asnName":"RADWARE-CLOUD-SERVICES","organization":{"country":{"iso":"US"},"orgId":"RADWA-8-ARIN"},"rank":7646},"hegemony":0}},"debug":{},"duration":3000,"event_metrics":{"per_tag_cnt":[{"count":3,"name":"some-newcomers-are-rel-neighbor"},{"count":3,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":3,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":3,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":3,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":3,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":3,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"previously-announced-by-all-newcomers"},{"count":3,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":3,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":3,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":3,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":3,"name":"irr-ARIN-all-newcomer-no-record"},{"count":3,"name":"has-dps-asn"},{"count":3,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":3,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":3,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":3,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-unknown-roa"},{"count":3,"name":"oldcomer-newcomer-all-siblings"},{"count":3,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":3,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":3,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":3,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":3,"name":"some-newcomers-are-customers"},{"count":3,"name":"all-newcomers-are-customers"},{"count":3,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":3,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":3,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":3,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":3,"name":"all-newcomers-are-rel-neighbor"},{"count":3,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":3,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":3,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":3,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":3,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":3,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":3,"name":"oldcomer-newcomer-some-siblings"},{"count":3,"name":"irr-RADB-all-oldcomer-exact-record"},{"count":3,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":3,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":3,"name":"irr-BBOI-all-newcomer-no-record"},{"count":3,"name":"some-newcomers-are-rel-downstream"},{"count":3,"name":"irr-APNIC-all-newcomer-no-record"},{"count":3,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":3,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":3,"name":"all-newcomers-are-rel-downstream"},{"count":3,"name":"all-newcomers-next-to-an-oldcomer"},{"count":2,"name":"rpki-all-oldcomer-unknown-roa"},{"count":3,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":3,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":2,"name":"rpki-all-newcomer-unknown-roa"},{"count":3,"name":"irr-REACH-all-oldcomer-no-record"},{"count":3,"name":"irr-BELL-all-newcomer-no-record"},{"count":3,"name":"irr-RADB-all-newcomer-exact-record"},{"count":3,"name":"irr-REACH-all-newcomer-no-record"},{"count":3,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":3,"name":"irr-BELL-all-oldcomer-no-record"},{"count":3,"name":"irr-TC-all-newcomer-no-record"},{"count":3,"name":"irr-TC-all-oldcomer-no-record"},{"count":3,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":2,"name":"prefix-small-edit-distance"},{"count":1,"name":"not-previously-announced-by-any-newcomer"}],"pfx_events_cnt":3,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0013232231140136719,"proc_time_tagger":2.3392374515533447,"total_tags_cnt":69},"event_type":"moas","finished_ts":1776596100,"id":"moas-1776593100-198949_25773","insert_ts":1776595981,"last_modified_ts":1776598900,"pfx_events":[{"finished_ts":1776596100,"inferences":[{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"prefix":"176.100.190.0/24","tags":[{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"all-newcomers-are-customers"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-rel-downstream"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"}]},{"finished_ts":1776596100,"inferences":[{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10},{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"prefix":"167.17.156.0/24","tags":[{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"all-newcomers-are-customers"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-rel-downstream"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"}]},{"finished_ts":1776596100,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"prefix":"66.6.31.0/24","tags":[{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"all-newcomers-are-customers"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-rel-downstream"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"}]}],"summary":{"ases":["25773","198949"],"attackers":["25773"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"Event has prefix events with different inferences, but they all map to the same class.","inference_id":"mixed-legitimate","labels":["legitimate"],"suspicion_level":2}},"newcomers":["25773"],"prefixes":["66.6.31.0/24","176.100.190.0/24","167.17.156.0/24"],"tags":[{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-are-customers"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"all-newcomers-are-rel-downstream"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"previously-announced-by-all-newcomers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"}],"tr_worthy":false,"victims":["198949"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776593100},{"asinfo":{"401696":{"asrank":{"asn":"401696","asnDegree":{"customer":1,"peer":0,"provider":1},"asnName":"COGNETCLOUD","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":7646},"hegemony":0},"401701":{"asrank":{"asn":"401701","asnDegree":{"customer":0,"peer":0,"provider":3},"asnName":"COGNETCLOUD-2","organization":{"country":{"iso":"US"},"orgId":"COGNE-7-ARIN"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"spamhaus-asn-drop"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"prefix-small-edit-distance"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0011179447174072266,"proc_time_tagger":1.0899584293365479,"total_tags_cnt":67},"event_type":"submoas","finished_ts":null,"id":"submoas-1776593100-401696=401701","insert_ts":1776595982,"last_modified_ts":1776595982,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"103.149.91.0/24","super_pfx":"103.149.90.0/23","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"spamhaus-asn-drop"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["401696","401701"],"attackers":["401701"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["401701"],"prefixes":["103.149.90.0/23","103.149.91.0/24"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["401696"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776593100},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006697177886962891,"proc_time_tagger":1.1240472793579102,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776592800-4601=210312","insert_ts":1776595905,"last_modified_ts":1776595905,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cfc::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cfc::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776592800},{"asinfo":{"152194":{"asrank":{"asn":"152194","asnDegree":{"customer":2,"peer":207,"provider":6},"asnName":"CTGSERVERLIMITED-AS-AP","organization":{"country":{"iso":"HK"},"orgId":"ORG-CSL17-AP-APNIC"},"rank":5776},"hegemony":0},"64050":{"asrank":{"asn":"64050","asnDegree":{"customer":16,"peer":211,"provider":10},"asnName":"BGNL-HK","organization":{"country":{"iso":"HK"},"orgId":"ORG-BCPL4-AP-APNIC"},"rank":1168},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":7,"name":"outdated-info"},{"count":7,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":7,"name":"oldcomer-path-prepending"},{"count":7,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":7,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":7,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":7,"name":"newcomer-more-specific"},{"count":7,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":7,"name":"irr-BBOI-all-newcomer-no-record"},{"count":7,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":7,"name":"single-ip"},{"count":7,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":7,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":7,"name":"single-peer-on-attacker-path"},{"count":7,"name":"irr-ARIN-all-newcomer-no-record"},{"count":7,"name":"rpki-all-newcomer-invalid-roa"},{"count":7,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":7,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":7,"name":"previously-announced-by-some-newcomers"},{"count":7,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":7,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":7,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":7,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":7,"name":"irr-PANIX-all-newcomer-no-record"},{"count":7,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":7,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":7,"name":"previously-announced-by-all-newcomers"},{"count":7,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":7,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":7,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":7,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":7,"name":"irr-RIPE-all-newcomer-no-record"},{"count":7,"name":"irr-BELL-all-oldcomer-no-record"},{"count":7,"name":"rpki-all-oldcomer-valid-roa"},{"count":7,"name":"irr-RADB-all-oldcomer-no-record"},{"count":7,"name":"irr-TC-all-newcomer-no-record"},{"count":7,"name":"some-newcomers-are-rel-upstream"},{"count":7,"name":"some-newcomers-are-providers"},{"count":7,"name":"all-origins-same-country"},{"count":7,"name":"some-newcomers-are-rel-neighbor"},{"count":7,"name":"irr-REACH-all-newcomer-no-record"},{"count":7,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":7,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":7,"name":"rpki-some-oldcomer-valid-roa"},{"count":7,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":7,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":7,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":7,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":7,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":7,"name":"irr-TC-all-oldcomer-no-record"},{"count":7,"name":"all-newcomers-are-providers"},{"count":7,"name":"irr-APNIC-all-newcomer-more-specific-record"},{"count":7,"name":"irr-REACH-all-oldcomer-no-record"},{"count":7,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":7,"name":"irr-BELL-all-newcomer-no-record"},{"count":7,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":7,"name":"rpki-some-newcomer-invalid-roa"},{"count":7,"name":"all-newcomers-are-rel-upstream"},{"count":7,"name":"long-prefix"},{"count":7,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":7,"name":"all-newcomers-next-to-an-oldcomer"},{"count":7,"name":"all-newcomers-are-rel-neighbor"},{"count":7,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":7,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":7,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0067958831787109375,"proc_time_tagger":1.179699420928955,"total_tags_cnt":64},"event_type":"submoas","finished_ts":null,"id":"submoas-1776592200-152194=64050","insert_ts":1776594394,"last_modified_ts":1776594394,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"27.124.12.72/32","super_pfx":"27.124.12.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"27.124.12.78/32","super_pfx":"27.124.12.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"27.124.12.222/32","super_pfx":"27.124.12.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"27.124.12.214/32","super_pfx":"27.124.12.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"27.124.12.116/32","super_pfx":"27.124.12.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"27.124.12.37/32","super_pfx":"27.124.12.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"27.124.12.202/32","super_pfx":"27.124.12.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["152194","64050"],"attackers":["64050"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["64050"],"prefixes":["27.124.12.37/32","27.124.12.202/32","27.124.12.214/32","27.124.12.72/32","27.124.12.78/32","27.124.12.116/32","27.124.12.222/32","27.124.12.0/24"],"tags":[{"name":"outdated-info"},{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["152194"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776592200},{"asinfo":{"1929":{"asrank":{"asn":"1929","asnDegree":{"customer":0,"peer":1,"provider":1},"asnName":"UMASSNET-NET","organization":{"country":{"iso":"US"},"orgId":"UNIVER-6-ARIN"},"rank":12482},"hegemony":0},"1968":{"asrank":{"asn":"1968","asnDegree":{"customer":9,"peer":1,"provider":4},"asnName":"UMASSNET-AS1968","organization":{"country":{"iso":"US"},"orgId":"UMAP-ARIN"},"rank":2588},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":2,"name":"outdated-info"},{"count":2,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":2,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":2,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":2,"name":"newcomer-more-specific"},{"count":2,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"irr-RADB-all-newcomer-no-record"},{"count":2,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":2,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":2,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":2,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-unknown-roa"},{"count":2,"name":"irr-APNIC-all-newcomer-no-record"},{"count":2,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":2,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ARIN-all-newcomer-more-specific-record"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"previously-announced-by-some-newcomers"},{"count":2,"name":"some-newcomers-are-customers"},{"count":2,"name":"rpki-some-oldcomer-unknown-roa"},{"count":2,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":2,"name":"rpki-all-oldcomer-unknown-roa"},{"count":2,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":2,"name":"no-origins-prev-view"},{"count":2,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":2,"name":"all-newcomers-are-rel-downstream"},{"count":2,"name":"some-newcomers-stub-ases"},{"count":2,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":2,"name":"irr-RIPE-all-newcomer-no-record"},{"count":2,"name":"irr-BELL-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":2,"name":"irr-TC-all-newcomer-no-record"},{"count":2,"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"count":2,"name":"all-origins-same-country"},{"count":2,"name":"all-newcomers"},{"count":2,"name":"all-newcomers-stub-ases"},{"count":2,"name":"some-newcomers-are-rel-neighbor"},{"count":2,"name":"rpki-some-newcomer-unknown-roa"},{"count":2,"name":"irr-REACH-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":2,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"all-newcomer-pfxs"},{"count":2,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"newcomer-less-specific"},{"count":2,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":2,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":2,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-customers"},{"count":2,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":2,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":2,"name":"irr-TC-all-oldcomer-no-record"},{"count":2,"name":"irr-REACH-all-oldcomer-no-record"},{"count":2,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":2,"name":"irr-BELL-all-newcomer-no-record"},{"count":2,"name":"some-newcomers-are-rel-downstream"},{"count":2,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":2,"name":"all-newcomers-are-rel-neighbor"},{"count":2,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":2,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":2,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.001665353775024414,"proc_time_tagger":0.9234890937805176,"total_tags_cnt":66},"event_type":"submoas","finished_ts":null,"id":"submoas-1776592200-1968=1929","insert_ts":1776594394,"last_modified_ts":1776594394,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:48e8:6402::/48","super_pfx":"2001:48e8::/29","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-more-specific-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:48e8:6400::/48","super_pfx":"2001:48e8::/29","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-more-specific-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["1929","1968"],"attackers":["1929"],"inference_result":{"inferences":[{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"primary_inference":{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}},"newcomers":["1968","1929"],"prefixes":["2001:48e8:6400::/48","2001:48e8:6402::/48","2001:48e8::/29"],"tags":[{"name":"outdated-info"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-more-specific-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-more-specific-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["1968"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776592200},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006532669067382812,"proc_time_tagger":1.0361196994781494,"total_tags_cnt":71},"event_type":"submoas","finished_ts":null,"id":"submoas-1776592200-4601=210312","insert_ts":1776594394,"last_modified_ts":1776594395,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cfb::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cfb::/48","2a0d:3dc0::/29"],"tags":[{"name":"outdated-info"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776592200},{"asinfo":{"20804":{"asrank":{"asn":"20804","asnDegree":{"customer":275,"peer":714,"provider":4},"asnName":"ASN-TELENERGO","organization":{"country":{"iso":"PL"},"orgId":"ORG-TS16-RIPE"},"rank":117},"hegemony":0},"49633":{"asrank":{"asn":"49633","asnDegree":{"customer":0,"peer":8,"provider":2},"asnName":"MGK-AS","organization":{"country":{"iso":"PL"},"orgId":"ORG-MRC11-RIPE"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-dps-asn"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-dps-asn"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"due-to-dps-asn"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0003116130828857422,"proc_time_tagger":0.8870353698730469,"total_tags_cnt":67},"event_type":"submoas","finished_ts":null,"id":"submoas-1776592200-49633=20804","insert_ts":1776594394,"last_modified_ts":1776594395,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"92.63.42.110/32","super_pfx":"92.63.32.0/20","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["20804","49633"],"attackers":["20804"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["20804"],"prefixes":["92.63.42.110/32","92.63.32.0/20"],"tags":[{"name":"outdated-info"},{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["49633"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776592200},{"asinfo":{"45102":{"asrank":{"asn":"45102","asnDegree":{"customer":1,"peer":347,"provider":38},"asnName":"ALIBABA-CN-NET","organization":{"country":{"iso":"CN"},"orgId":"@aut-37963-APNIC"},"rank":7646},"hegemony":0},"45700":{"asrank":{"asn":"45700","asnDegree":{"customer":0,"peer":3,"provider":4},"asnName":"IDNIC-STARLINK-AS-ID","organization":{"country":{"iso":"ID"},"orgId":"@aut-45700-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009491443634033203,"proc_time_tagger":1.0493204593658447,"total_tags_cnt":58},"event_type":"submoas","finished_ts":null,"id":"submoas-1776591900-45102=45700","insert_ts":1776594236,"last_modified_ts":1776594236,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"47.84.205.172/32","super_pfx":"47.84.128.0/17","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["45700","45102"],"attackers":["45700"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["45700"],"prefixes":["47.84.205.172/32","47.84.128.0/17"],"tags":[{"name":"outdated-info"},{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["45102"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776591900},{"asinfo":{"138968":{"asrank":{"asn":"138968","asnDegree":{"customer":1,"peer":17,"provider":4},"asnName":"RAINBOWIDC-AS-AP","organization":{"country":{"iso":"JP"},"orgId":"ORG-RNL4-AP-APNIC"},"rank":7646},"hegemony":0},"24544":{"asrank":{"asn":"24544","asnDegree":{"customer":0,"peer":1,"provider":3},"asnName":"Overcasts-AS-AP","organization":{"country":{"iso":"HK"},"orgId":"ORG-CL18-AP-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"spamhaus-asn-drop"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-victim-path"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-more-specific-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0017590522766113281,"proc_time_tagger":1.056701898574829,"total_tags_cnt":54},"event_type":"submoas","finished_ts":null,"id":"submoas-1776591600-24544=138968","insert_ts":1776594161,"last_modified_ts":1776594161,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":80,"explanation":"the AS was on spamhaus asn-drop list","inference_id":"suspicious-spamhaus-asn","labels":["suspicious","incident"],"suspicion_level":80},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"45.116.78.161/32","super_pfx":"45.116.78.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"single-peer-on-victim-path"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["24544","138968"],"attackers":["138968"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["138968"],"prefixes":["45.116.78.0/24","45.116.78.161/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"single-peer-on-victim-path"},{"name":"long-prefix"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"spamhaus-asn-drop"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["24544"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776591600},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0007593631744384766,"proc_time_tagger":1.0573101043701172,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776591600-4601=210312","insert_ts":1776594161,"last_modified_ts":1776594161,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cfa::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cfa::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776591600},{"asinfo":{"16509":{"asrank":{"asn":"16509","asnDegree":{"customer":72,"peer":332,"provider":18},"asnName":"AMAZON-02","organization":{"country":{"iso":"US"},"orgId":"AMAZON-4-ARIN"},"rank":510},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-ris-peer"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-oldcomers-manrs-member"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010309219360351562,"proc_time_tagger":13.502516031265259,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776591300-16509=52468","insert_ts":1776594100,"last_modified_ts":1776594100,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"95.40.209.127/32","super_pfx":"95.40.0.0/15","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["16509","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["95.40.0.0/15","95.40.209.127/32"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["16509"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776591300},{"asinfo":{"213541":{"asrank":{"asn":"213541","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"ws-telecom-sdn","organization":{"country":{"iso":"US"},"orgId":"ORG-WTI4-RIPE"},"rank":12482},"hegemony":0},"30058":{"asrank":{"asn":"30058","asnDegree":{"customer":39,"peer":192,"provider":7},"asnName":"FDCSERVERS","organization":{"country":{"iso":"US"},"orgId":"FDCSE-ARIN"},"rank":484},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"single-ip"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00035071372985839844,"proc_time_tagger":1.0150818824768066,"total_tags_cnt":65},"event_type":"submoas","finished_ts":null,"id":"submoas-1776591300-213541=30058","insert_ts":1776594100,"last_modified_ts":1776594100,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"158.46.163.23/32","super_pfx":"158.46.162.0/23","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["30058","213541"],"attackers":["30058"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["30058"],"prefixes":["158.46.162.0/23","158.46.163.23/32"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["213541"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776591300},{"asinfo":{"16509":{"asrank":{"asn":"16509","asnDegree":{"customer":72,"peer":332,"provider":18},"asnName":"AMAZON-02","organization":{"country":{"iso":"US"},"orgId":"AMAZON-4-ARIN"},"rank":510},"hegemony":0},"52468":{"asrank":{"asn":"52468","asnDegree":{"customer":806,"peer":44,"provider":13},"asnName":"","organization":{"country":{"iso":"PA"},"orgId":"@aut-52245-LACNIC"},"rank":44},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"rpki-all-newcomer-invalid-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-ris-peer"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"all-oldcomers-routeviews-peer"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-oldcomers-manrs-member"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-invalid-roa"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0009746551513671875,"proc_time_tagger":1.0731656551361084,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776591000-16509=52468","insert_ts":1776593785,"last_modified_ts":1776593785,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":85,"explanation":"all newcomers have invalid ROAs (at least one due to AS) while oldcomers have all valid ROAs or are siblings of each other and at least one has a valid ROA","inference_id":"rpki-all-newcomers-invalid-all-oldcomers-valid","labels":["suspicious","incident"],"suspicion_level":80}],"sub_pfx":"52.28.254.75/32","super_pfx":"52.28.0.0/16","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["16509","52468"],"attackers":["52468"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["52468"],"prefixes":["52.28.254.75/32","52.28.0.0/16"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"all-oldcomers-routeviews-peer"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-oldcomers-manrs-member"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-oldcomers-ris-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"}],"tr_worthy":false,"victims":["16509"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776591000},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006692409515380859,"proc_time_tagger":1.0733668804168701,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776591000-4601=210312","insert_ts":1776593785,"last_modified_ts":1776593785,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cf9::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cf9::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776591000},{"asinfo":{"21483":{"asrank":{"asn":"21483","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"TEL-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-ES15-RIPE"},"rank":12482},"hegemony":0},"3216":{"asrank":{"asn":"3216","asnDegree":{"customer":886,"peer":1109,"provider":9},"asnName":"SOVAM-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-ES15-RIPE"},"rank":27},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010950565338134766,"proc_time_tagger":1.2850091457366943,"total_tags_cnt":65},"event_type":"submoas","finished_ts":null,"id":"submoas-1776590700-21483=3216","insert_ts":1776593507,"last_modified_ts":1776593507,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"195.222.183.191/32","super_pfx":"195.222.183.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["21483","3216"],"attackers":["3216"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["3216"],"prefixes":["195.222.183.0/24","195.222.183.191/32"],"tags":[{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["21483"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776590700},{"asinfo":{"1299":{"asrank":{"asn":"1299","asnDegree":{"customer":2527,"peer":65,"provider":0},"asnName":"TWELVE99","organization":{"country":{"iso":"SE"},"orgId":"ORG-TCA32-RIPE"},"rank":2},"hegemony":0},"21334":{"asrank":{"asn":"21334","asnDegree":{"customer":18,"peer":8,"provider":3},"asnName":"ASN-ONE-HU","organization":{"country":{"iso":"HU"},"orgId":"ORG-VCL1-RIPE"},"rank":1576},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-manrs-member"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-dps-asn"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-ris-peer"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-dps-asn"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"due-to-dps-asn"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"has-dps-asn"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"all-newcomers-routeviews-peer"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00046372413635253906,"proc_time_tagger":1.0353875160217285,"total_tags_cnt":64},"event_type":"submoas","finished_ts":null,"id":"submoas-1776590400-21334=1299","insert_ts":1776593186,"last_modified_ts":1776593186,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":60,"explanation":"The event is caused by ASNs performing DoS Protection Services (DPS)","inference_id":"dps-asn","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"130.43.211.0/24","super_pfx":"130.43.192.0/18","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-manrs-member"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"has-dps-asn"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["1299","21334"],"attackers":["1299"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["1299"],"prefixes":["130.43.211.0/24","130.43.192.0/18"],"tags":[{"name":"oldcomer-path-prepending"},{"name":"all-newcomers-manrs-member"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"all-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"all-newcomers-routeviews-peer"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-dps-asn"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-dps-asn"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"due-to-dps-asn"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["21334"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776590400},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0010600090026855469,"proc_time_tagger":1.154634952545166,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776590400-4601=210312","insert_ts":1776593186,"last_modified_ts":1776593186,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cf8::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cf8::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776590400},{"asinfo":{"135905":{"asrank":{"asn":"135905","asnDegree":{"customer":44,"peer":0,"provider":1},"asnName":"VNPT-AS-VN","organization":{"country":{"iso":"VN"},"orgId":"@aut-135905-APNIC"},"rank":799},"hegemony":0},"56160":{"asrank":{"asn":"56160","asnDegree":{"customer":0,"peer":0,"provider":2},"asnName":"VIETNIX-AS-VN","organization":{"country":{"iso":"VN"},"orgId":"@aut-56160-APNIC"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"single-peer-on-attacker-path"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-next-to-an-oldcomer"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0003466606140136719,"proc_time_tagger":1.0592854022979736,"total_tags_cnt":65},"event_type":"submoas","finished_ts":null,"id":"submoas-1776590100-135905=56160","insert_ts":1776592896,"last_modified_ts":1776592896,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20},{"confidence":92,"explanation":"all newcomers are customers and all the traffic goes through the oldcomers","inference_id":"all-newcomers-customers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"103.90.224.90/32","super_pfx":"103.90.224.0/24","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["56160","135905"],"attackers":["56160"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["56160"],"prefixes":["103.90.224.90/32","103.90.224.0/24"],"tags":[{"name":"outdated-info"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-next-to-an-oldcomer"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["135905"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776590100},{"asinfo":{"637":{"asrank":{"asn":"637","asnDegree":{"customer":0,"peer":1,"provider":3},"asnName":"DNIC-ASBLK-00616-00665","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":12482},"hegemony":0},"721":{"asrank":{"asn":"721","asnDegree":{"customer":3,"peer":0,"provider":1},"asnName":"DNIC-ASBLK-00721-00726","organization":{"country":{"iso":"US"},"orgId":"USDDD-ARIN"},"rank":431},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"outdated-info"},{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-path-prepending"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"oldcomers-always-on-newcomer-originated-paths"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"prefix-small-edit-distance"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0005338191986083984,"proc_time_tagger":1.234217643737793,"total_tags_cnt":66},"event_type":"submoas","finished_ts":null,"id":"submoas-1776590100-721=637","insert_ts":1776592896,"last_modified_ts":1776592896,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":93,"explanation":"The ASNs of (at least one) newcomer AS and (at least one) oldcomer AS are siblings/friends and previously announced similar prefixes. This event is likely benign and probably not a misconfiguration","inference_id":"sibling-close-prefix","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"old origins are always on the paths of the new origins, traffic flow through old origins first","inference_id":"oldcomer-on-paths","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"214.45.249.0/24","super_pfx":"214.0.0.0/8","tags":[{"name":"outdated-info"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"oldcomer-path-prepending"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["637","721"],"attackers":["637"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["637"],"prefixes":["214.0.0.0/8","214.45.249.0/24"],"tags":[{"name":"outdated-info"},{"name":"oldcomer-path-prepending"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"oldcomers-always-on-newcomer-originated-paths"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"prefix-small-edit-distance"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["721"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776590100},{"asinfo":{"8371":{"asrank":{"asn":"8371","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"Vimpelcom-NN","organization":{"country":{"iso":"RU"},"orgId":"ORG-ES15-RIPE"},"rank":12482},"hegemony":0},"8402":{"asrank":{"asn":"8402","asnDegree":{"customer":10,"peer":6,"provider":2},"asnName":"CORBINA-AS","organization":{"country":{"iso":"RU"},"orgId":"ORG-CTAM1-RIPE"},"rank":2419},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-ip"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-unknown-roa"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"rpki-some-oldcomer-unknown-roa"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-providers"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"rpki-some-newcomer-unknown-roa"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"long-prefix"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-oldcomer-unknown-roa"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0003135204315185547,"proc_time_tagger":1.063452959060669,"total_tags_cnt":61},"event_type":"submoas","finished_ts":null,"id":"submoas-1776589800-8371=8402","insert_ts":1776592827,"last_modified_ts":1776592827,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":87,"explanation":"all newcomer origins are siblings with at least one provider of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-provider","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"sub_pfx":"92.242.70.177/32","super_pfx":"92.242.64.0/19","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["8371","8402"],"attackers":["8402"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["8402"],"prefixes":["92.242.70.177/32","92.242.64.0/19"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-upstream"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-providers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["8371"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589800},{"asinfo":{"210312":{"asrank":{"asn":"210312","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"BGP-CLOCK","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":12482},"hegemony":0},"4601":{"asrank":{"asn":"4601","asnDegree":{"customer":2,"peer":111,"provider":1},"asnName":"DNET","organization":{"country":{"iso":"GR"},"orgId":"ORG-AAC10-RIPE"},"rank":5776},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"single-rel-upstream-chain"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":1,"name":"some-newcomers-ris-peer"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-are-customers"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"no-origins-prev-view"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":1,"name":"all-newcomers-are-rel-downstream"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"some-newcomers-stub-ases"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"irr-RIPE-all-newcomer-more-specific-record"},{"count":1,"name":"all-newcomers"},{"count":1,"name":"all-newcomers-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"all-newcomer-pfxs"},{"count":1,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-customers"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-downstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0006854534149169922,"proc_time_tagger":1.1022872924804688,"total_tags_cnt":70},"event_type":"submoas","finished_ts":null,"id":"submoas-1776589800-4601=210312","insert_ts":1776592827,"last_modified_ts":1776592827,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":92,"explanation":"all newcomer(s) are customer(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-customers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"All origins in the event are in a single customer-provider chain","inference_id":"customer-provider-single-chain","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2a0d:3dc1:3cf7::/48","super_pfx":"2a0d:3dc0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["4601","210312"],"attackers":["210312"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["4601","210312"],"prefixes":["2a0d:3dc1:3cf7::/48","2a0d:3dc0::/29"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"some-newcomers-ris-peer"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"irr-RIPE-all-newcomer-more-specific-record"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["4601"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589800},{"asinfo":{"19871":{"asrank":{"asn":"19871","asnDegree":{"customer":0,"peer":0,"provider":3},"asnName":"NETWORK-SOLUTIONS-HOSTING","organization":{"country":{"iso":"US"},"orgId":"NETWO-59-ARIN"},"rank":12482},"hegemony":0},"26337":{"asrank":{"asn":"26337","asnDegree":{"customer":4,"peer":0,"provider":2},"asnName":"OIS1","organization":{"country":{"iso":"US"},"orgId":"OGISL-ARIN"},"rank":4097},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"all-victims-stub-ases"},{"count":1,"name":"newcomer-more-specific"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-some-newcomers"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":1,"name":"previously-announced-by-all-newcomers"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-all-newcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0004432201385498047,"proc_time_tagger":1.009199857711792,"total_tags_cnt":59},"event_type":"submoas","finished_ts":null,"id":"submoas-1776589800-19871=26337","insert_ts":1776592827,"last_modified_ts":1776592827,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":92,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s) and have advertised the prefix in the past","inference_id":"all-newcomers-providers-announced-prefix","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"sub_pfx":"192.185.67.0/24","super_pfx":"192.185.64.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["26337","19871"],"attackers":["26337"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["26337"],"prefixes":["192.185.64.0/22","192.185.67.0/24"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-victims-stub-ases"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["19871"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589800},{"asinfo":{"19905":{"asrank":{"asn":"19905","asnDegree":{"customer":37,"peer":2,"provider":8},"asnName":"SECURITYSERVICES","organization":{"country":{"iso":"US"},"orgId":"SSL-1134-ARIN"},"rank":969},"hegemony":0},"26777":{"asrank":{"asn":"26777","asnDegree":{"customer":0,"peer":0,"provider":0},"asnName":"CBC-COMPANIES-INC","organization":{"country":{"iso":"US"},"orgId":"CBCCOM-ARIN"},"rank":null},"hegemony":0}},"debug":{},"duration":3600,"event_metrics":{"per_tag_cnt":[{"count":4,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":4,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":4,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-no-record"},{"count":4,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":4,"name":"irr-RIPE-all-newcomer-no-record"},{"count":4,"name":"previously-announced-by-all-newcomers"},{"count":2,"name":"rpki-some-oldcomer-valid-roa"},{"count":4,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":4,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":4,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":4,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":4,"name":"has-dps-asn"},{"count":4,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":2,"name":"rpki-some-newcomer-valid-roa"},{"count":4,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":4,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":4,"name":"previously-announced-by-some-newcomers"},{"count":4,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":4,"name":"some-newcomers-stub-ases"},{"count":2,"name":"irr-ARIN-all-oldcomer-exact-record"},{"count":4,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":4,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":4,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":4,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":4,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":4,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":2,"name":"rpki-all-newcomer-valid-roa"},{"count":4,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":4,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":4,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":4,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":4,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":4,"name":"all-newcomers-stub-ases"},{"count":4,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":4,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":4,"name":"irr-BBOI-all-newcomer-no-record"},{"count":2,"name":"rpki-all-oldcomer-valid-roa"},{"count":4,"name":"irr-APNIC-all-newcomer-no-record"},{"count":4,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":2,"name":"irr-ARIN-all-newcomer-exact-record"},{"count":4,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":4,"name":"all-origins-same-country"},{"count":4,"name":"some-newcomer-announced-no-pfxs"},{"count":4,"name":"irr-REACH-all-oldcomer-no-record"},{"count":4,"name":"irr-BELL-all-newcomer-no-record"},{"count":4,"name":"irr-RADB-all-newcomer-exact-record"},{"count":4,"name":"irr-REACH-all-newcomer-no-record"},{"count":4,"name":"all-newcomer-announced-no-pfxs"},{"count":4,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":4,"name":"irr-BELL-all-oldcomer-no-record"},{"count":4,"name":"irr-TC-all-newcomer-no-record"},{"count":4,"name":"irr-TC-all-oldcomer-no-record"},{"count":4,"name":"irr-PANIX-all-newcomer-no-record"},{"count":2,"name":"irr-ARIN-all-newcomer-no-record"},{"count":2,"name":"rpki-some-oldcomer-unknown-roa"},{"count":2,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":2,"name":"irr-RADB-all-oldcomer-exact-record"},{"count":2,"name":"rpki-all-oldcomer-unknown-roa"},{"count":2,"name":"rpki-all-newcomer-unknown-roa"},{"count":2,"name":"rpki-some-newcomer-unknown-roa"}],"pfx_events_cnt":4,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0019261837005615234,"proc_time_tagger":2.286970853805542,"total_tags_cnt":61},"event_type":"moas","finished_ts":1776592800,"id":"moas-1776589200-19905_26777","insert_ts":1776592589,"last_modified_ts":1776595894,"pfx_events":[{"finished_ts":1776592800,"inferences":[{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"prefix":"204.13.136.0/24","tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-exact-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-exact-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomer-announced-no-pfxs"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomer-announced-no-pfxs"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"}]},{"finished_ts":1776592800,"inferences":[{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1}],"prefix":"12.51.26.0/24","tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"some-newcomer-announced-no-pfxs"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomer-announced-no-pfxs"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"}]},{"finished_ts":1776591300,"inferences":[{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"prefix":"204.13.137.0/24","tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-exact-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-exact-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomer-announced-no-pfxs"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomer-announced-no-pfxs"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"}]},{"finished_ts":1776591300,"inferences":[{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1}],"prefix":"68.22.157.0/24","tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"some-newcomer-announced-no-pfxs"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomer-announced-no-pfxs"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"}]}],"summary":{"ases":["26777","19905"],"attackers":["26777"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"Event has prefix events with different inferences, but they all map to the same class.","inference_id":"mixed-legitimate","labels":["legitimate"],"suspicion_level":2}},"newcomers":["26777"],"prefixes":["204.13.137.0/24","12.51.26.0/24","68.22.157.0/24","204.13.136.0/24"],"tags":[{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"has-dps-asn"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-exact-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"all-origins-same-country"},{"name":"some-newcomer-announced-no-pfxs"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-stub-ases"},{"name":"irr-ARIN-all-oldcomer-exact-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"all-newcomers-stub-ases"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-ARIN-all-newcomer-exact-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-exact-record"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"all-newcomer-announced-no-pfxs"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"}],"tr_worthy":false,"victims":["19905"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589200},{"asinfo":{"25019":{"asrank":{"asn":"25019","asnDegree":{"customer":38,"peer":3,"provider":1},"asnName":"SAUDINETSTC-AS","organization":{"country":{"iso":"SA"},"orgId":"ORG-SSTC1-RIPE"},"rank":937},"hegemony":0},"39386":{"asrank":{"asn":"39386","asnDegree":{"customer":55,"peer":708,"provider":6},"asnName":"STC-IGW-AS","organization":{"country":{"iso":"SA"},"orgId":"ORG-SSTC1-RIPE"},"rank":268},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":14,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":14,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":14,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":14,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":14,"name":"newcomer-more-specific"},{"count":14,"name":"irr-BBOI-all-newcomer-no-record"},{"count":14,"name":"irr-RADB-all-newcomer-no-record"},{"count":14,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":14,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":14,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":14,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":14,"name":"irr-ARIN-all-newcomer-no-record"},{"count":14,"name":"rpki-all-newcomer-unknown-roa"},{"count":14,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":14,"name":"irr-APNIC-all-newcomer-no-record"},{"count":14,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":14,"name":"previously-announced-by-some-newcomers"},{"count":14,"name":"oldcomer-newcomer-all-siblings"},{"count":14,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":14,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":14,"name":"some-newcomers-are-customers"},{"count":14,"name":"rpki-some-oldcomer-unknown-roa"},{"count":14,"name":"rpki-all-oldcomer-unknown-roa"},{"count":14,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":14,"name":"no-origins-prev-view"},{"count":14,"name":"irr-PANIX-all-newcomer-no-record"},{"count":14,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":14,"name":"all-newcomers-are-rel-downstream"},{"count":14,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":14,"name":"irr-all-newcomer-no-record"},{"count":14,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":14,"name":"some-newcomers-siblings-with-oldcomers-peers"},{"count":14,"name":"irr-RIPE-all-newcomer-no-record"},{"count":14,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":14,"name":"all-newcomers-siblings-with-oldcomers-peers"},{"count":14,"name":"irr-RADB-all-oldcomer-no-record"},{"count":14,"name":"irr-BELL-all-oldcomer-no-record"},{"count":14,"name":"irr-TC-all-newcomer-no-record"},{"count":14,"name":"all-origins-same-country"},{"count":14,"name":"all-newcomers"},{"count":14,"name":"some-newcomers-are-rel-neighbor"},{"count":14,"name":"rpki-some-newcomer-unknown-roa"},{"count":14,"name":"irr-REACH-all-newcomer-no-record"},{"count":14,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":14,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":14,"name":"all-newcomer-pfxs"},{"count":14,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":14,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":14,"name":"newcomer-less-specific"},{"count":14,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":14,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":14,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":14,"name":"all-newcomers-are-customers"},{"count":14,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":14,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":14,"name":"irr-TC-all-oldcomer-no-record"},{"count":14,"name":"irr-REACH-all-oldcomer-no-record"},{"count":14,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":14,"name":"irr-BELL-all-newcomer-no-record"},{"count":14,"name":"oldcomer-newcomer-some-siblings"},{"count":14,"name":"some-newcomers-are-rel-downstream"},{"count":14,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":14,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":14,"name":"all-newcomers-are-rel-neighbor"},{"count":14,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":14,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":14,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.008188009262084961,"proc_time_tagger":1.7930879592895508,"total_tags_cnt":66},"event_type":"submoas","finished_ts":null,"id":"submoas-1776589200-39386=25019","insert_ts":1776592674,"last_modified_ts":1776592674,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2:3000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a0:4000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a0::/40","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2:1000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a0:8000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a0:1000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2:b000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2:a000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a0:3000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a0:2000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2:2000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2:9000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all newcomers are customers of victims","inference_id":"all-newcomers-customers","labels":["legitimate"],"suspicion_level":20},{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"2001:16a2:8000::/36","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"all-newcomers-are-customers"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["25019","39386"],"attackers":["25019"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["25019","39386"],"prefixes":["2001:16a2:3000::/36","2001:16a0:1000::/36","2001:16a0::/29","2001:16a0:8000::/36","2001:16a0:2000::/36","2001:16a2:8000::/36","2001:16a2:2000::/36","2001:16a0:4000::/36","2001:16a2:1000::/36","2001:16a2:a000::/36","2001:16a2::/36","2001:16a2:9000::/36","2001:16a2:b000::/36","2001:16a0::/40","2001:16a0:3000::/36"],"tags":[{"name":"all-newcomers-are-rel-neighbor"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"all-newcomers-are-customers"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"some-newcomers-are-customers"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["39386"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589200},{"asinfo":{"136038":{"asrank":{"asn":"136038","asnDegree":{"customer":3,"peer":0,"provider":3},"asnName":"HDTIDCCLOUD-AS-AP","organization":{"country":{"iso":"HK"},"orgId":"ORG-HL1-AP-APNIC"},"rank":4753},"hegemony":0},"205960":{"asrank":{"asn":"205960","asnDegree":{"customer":1,"peer":0,"provider":2},"asnName":"KIDC","organization":{"country":{"iso":"HK"},"orgId":"ORG-HL172-RIPE"},"rank":7646},"hegemony":0},"212921":{"asrank":{"asn":"212921","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"HDT","organization":{"country":{"iso":"HK"},"orgId":"ORG-HL172-RIPE"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":1,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":1,"name":"rpki-all-newcomer-valid-roa"},{"count":1,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":1,"name":"irr-BBOI-all-newcomer-no-record"},{"count":1,"name":"irr-RADB-all-newcomer-no-record"},{"count":1,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":1,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":1,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":1,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ARIN-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-all-siblings"},{"count":1,"name":"irr-APNIC-all-newcomer-no-record"},{"count":1,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":1,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":1,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":1,"name":"irr-PANIX-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":1,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":1,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":1,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":1,"name":"irr-BELL-all-oldcomer-no-record"},{"count":1,"name":"oldcomer-all-siblings"},{"count":1,"name":"irr-RADB-all-oldcomer-no-record"},{"count":1,"name":"irr-TC-all-newcomer-no-record"},{"count":1,"name":"oldcomer-some-siblings"},{"count":1,"name":"some-newcomers-are-rel-upstream"},{"count":1,"name":"some-newcomers-are-providers"},{"count":1,"name":"all-origins-same-country"},{"count":1,"name":"some-victims-stub-ases"},{"count":1,"name":"some-newcomers-are-rel-neighbor"},{"count":1,"name":"irr-REACH-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":1,"name":"rpki-some-oldcomer-valid-roa"},{"count":1,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":1,"name":"newcomer-less-specific"},{"count":1,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":1,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":1,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":1,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":1,"name":"rpki-some-newcomer-valid-roa"},{"count":1,"name":"irr-RIPE-all-oldcomer-exact-record"},{"count":1,"name":"irr-TC-all-oldcomer-no-record"},{"count":1,"name":"not-previously-announced-by-any-newcomer"},{"count":1,"name":"all-newcomers-are-providers"},{"count":1,"name":"irr-REACH-all-oldcomer-no-record"},{"count":1,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":1,"name":"irr-RIPE-all-newcomer-exact-record"},{"count":1,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":1,"name":"irr-BELL-all-newcomer-no-record"},{"count":1,"name":"oldcomer-newcomer-some-siblings"},{"count":1,"name":"all-newcomers-are-rel-upstream"},{"count":1,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":1,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":1,"name":"all-newcomers-are-rel-neighbor"},{"count":1,"name":"rpki-all-oldcomer-valid-roa"},{"count":1,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":1,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.00036907196044921875,"proc_time_tagger":0.9869098663330078,"total_tags_cnt":60},"event_type":"submoas","finished_ts":null,"id":"submoas-1776589200-136038=205960_212921","insert_ts":1776592674,"last_modified_ts":1776592674,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":91,"explanation":"all newcomer(s) are provider(s) of the oldcomer(s). Probably, they are providing services to their customers (e.g., blackholing)","inference_id":"all-newcomers-providers","labels":["legitimate"],"suspicion_level":20},{"confidence":80,"explanation":"all newcomers have exact IRR records","inference_id":"all-newcomers-exact-irr-record","labels":["legitimate"],"suspicion_level":1},{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"91.204.225.0/24","super_pfx":"91.204.224.0/22","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"oldcomer-all-siblings"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"oldcomer-some-siblings"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-exact-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["136038","205960","212921"],"attackers":["136038"],"inference_result":{"inferences":[{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}],"primary_inference":{"confidence":99,"explanation":"all newcomers have valid ROAs","inference_id":"all-newcomers-rpki-valid","labels":["legitimate"],"suspicion_level":2}},"newcomers":["136038"],"prefixes":["91.204.225.0/24","91.204.224.0/22"],"tags":[{"name":"rpki-all-newcomer-valid-roa"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"oldcomer-all-siblings"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-victims-stub-ases"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-newcomer-valid-roa"},{"name":"irr-RIPE-all-oldcomer-exact-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-RIPE-all-newcomer-exact-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"oldcomer-some-siblings"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["205960","212921"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589200},{"asinfo":{"38732":{"asrank":{"asn":"38732","asnDegree":{"customer":17,"peer":0,"provider":1},"asnName":"CMCTELECOM-VN","organization":{"country":{"iso":"VN"},"orgId":"@aut-38733-APNIC"},"rank":1639},"hegemony":0},"45903":{"asrank":{"asn":"45903","asnDegree":{"customer":100,"peer":159,"provider":13},"asnName":"CMCTELECOM-VN","organization":{"country":{"iso":"VN"},"orgId":"@aut-38733-APNIC"},"rank":304},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":41,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":41,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":41,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":41,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":41,"name":"newcomer-more-specific"},{"count":41,"name":"irr-BBOI-all-newcomer-no-record"},{"count":31,"name":"irr-RADB-all-newcomer-no-record"},{"count":41,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":41,"name":"single-rel-upstream-chain"},{"count":41,"name":"single-ip"},{"count":32,"name":"rpki-newcomer-invalid-roa-due-to-as"},{"count":41,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":41,"name":"single-peer-on-attacker-path"},{"count":41,"name":"irr-ARIN-all-newcomer-no-record"},{"count":37,"name":"irr-RADB-all-oldcomer-more-specific-record"},{"count":41,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":41,"name":"rpki-all-newcomer-invalid-roa"},{"count":31,"name":"irr-APNIC-all-newcomer-no-record"},{"count":41,"name":"oldcomer-newcomer-all-siblings"},{"count":41,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":41,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":41,"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"count":41,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":41,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":41,"name":"newcomers-always-on-oldcomer-originated-paths"},{"count":41,"name":"irr-PANIX-all-newcomer-no-record"},{"count":41,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":41,"name":"irr-RIPE-all-oldcomer-no-record"},{"count":41,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":31,"name":"irr-all-newcomer-no-record"},{"count":37,"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"count":41,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":41,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":41,"name":"irr-RIPE-all-newcomer-no-record"},{"count":41,"name":"irr-BELL-all-oldcomer-no-record"},{"count":41,"name":"irr-TC-all-newcomer-no-record"},{"count":41,"name":"some-newcomers-are-rel-upstream"},{"count":41,"name":"some-newcomers-are-providers"},{"count":41,"name":"all-origins-same-country"},{"count":41,"name":"some-newcomers-are-rel-neighbor"},{"count":41,"name":"irr-REACH-all-newcomer-no-record"},{"count":41,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":41,"name":"rpki-some-oldcomer-valid-roa"},{"count":41,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":41,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":41,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":41,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":41,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":41,"name":"irr-TC-all-oldcomer-no-record"},{"count":41,"name":"all-newcomers-are-providers"},{"count":22,"name":"not-previously-announced-by-any-newcomer"},{"count":41,"name":"irr-REACH-all-oldcomer-no-record"},{"count":31,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":41,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":41,"name":"irr-BELL-all-newcomer-no-record"},{"count":41,"name":"oldcomer-newcomer-some-siblings"},{"count":41,"name":"rpki-some-newcomer-invalid-roa"},{"count":41,"name":"all-newcomers-are-rel-upstream"},{"count":41,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":41,"name":"long-prefix"},{"count":41,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":41,"name":"all-newcomers-are-rel-neighbor"},{"count":41,"name":"rpki-all-oldcomer-valid-roa"},{"count":41,"name":"irr-LACNIC-all-oldcomer-no-record"},{"count":19,"name":"previously-announced-by-some-newcomers"},{"count":19,"name":"previously-announced-by-all-newcomers"},{"count":10,"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"count":9,"name":"rpki-newcomer-invalid-roa-due-to-length"},{"count":4,"name":"irr-RADB-all-oldcomer-no-record"},{"count":4,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":10,"name":"irr-APNIC-all-newcomer-more-specific-record"},{"count":10,"name":"irr-RADB-all-newcomer-more-specific-record"}],"pfx_events_cnt":41,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.027720928192138672,"proc_time_tagger":2.0129759311676025,"total_tags_cnt":72},"event_type":"submoas","finished_ts":null,"id":"submoas-1776589200-38732=45903","insert_ts":1776592674,"last_modified_ts":1776592674,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.151.0/32","super_pfx":"103.21.151.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.151.223/32","super_pfx":"103.21.151.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.125.0/32","super_pfx":"115.146.125.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.126.0/32","super_pfx":"115.146.126.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.123.0/32","super_pfx":"115.146.123.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.0.0/32","super_pfx":"124.158.0.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.123.76/32","super_pfx":"115.146.123.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.3.0/32","super_pfx":"124.158.3.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.127.231/32","super_pfx":"115.146.127.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.2.0/32","super_pfx":"124.158.2.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"203.205.4.153/32","super_pfx":"203.205.4.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"203.205.8.0/32","super_pfx":"203.205.8.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"103.63.109.0/32","super_pfx":"103.63.109.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.4.0/32","super_pfx":"124.158.4.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.124.0/32","super_pfx":"115.146.124.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.125.188/32","super_pfx":"115.146.125.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.120.0/32","super_pfx":"115.146.120.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.122.0/32","super_pfx":"115.146.122.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"101.99.3.0/32","super_pfx":"101.99.3.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":75,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and all newcomers announce more specific prefixes than their IRR records","inference_id":"rpki-all-newcomers-invalid-more-specific-irr-record","labels":["misconfig","incident"],"suspicion_level":30},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"45.122.253.0/32","super_pfx":"45.122.253.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.148.0/32","super_pfx":"103.21.148.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"203.205.8.207/32","super_pfx":"203.205.8.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"203.205.4.0/32","super_pfx":"203.205.4.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.148.221/32","super_pfx":"103.21.148.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.149.0/32","super_pfx":"103.21.149.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"183.91.14.0/32","super_pfx":"183.91.14.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.5.0/32","super_pfx":"124.158.5.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"103.63.108.0/32","super_pfx":"103.63.108.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.121.0/32","super_pfx":"115.146.121.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":73,"explanation":"all newcomers have invalid ROAs due to max length","inference_id":"rpki-all-newcomers-invalid-roa-due-to-length","labels":["misconfig","incident"],"suspicion_level":20},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":75,"explanation":"all newcomers are more specific than their IRR records","inference_id":"all-newcomers-more-specific-irr-record","labels":["legitimate"],"suspicion_level":20},{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":92,"explanation":"all newcomers are providers and all the traffic towards the oldcomers goes through the newcomers","inference_id":"all-newcomers-providers-traffic-safe","labels":["legitimate"],"suspicion_level":10}],"sub_pfx":"203.205.4.91/32","super_pfx":"203.205.4.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.151.217/32","super_pfx":"103.21.151.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.151.17/32","super_pfx":"103.21.151.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.127.98/32","super_pfx":"115.146.127.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.6.0/32","super_pfx":"124.158.6.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.1.0/32","super_pfx":"124.158.1.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.6.174/32","super_pfx":"124.158.6.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"103.21.150.0/32","super_pfx":"103.21.150.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"115.146.127.0/32","super_pfx":"115.146.127.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.7.0/32","super_pfx":"124.158.7.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.0.53/32","super_pfx":"124.158.0.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":91,"explanation":"all newcomers have invalid ROAs (at least one due to AS) and are providers","inference_id":"rpki-all-newcomers-invalid-and-providers","labels":["misconfig","incident"],"suspicion_level":30}],"sub_pfx":"124.158.1.24/32","super_pfx":"124.158.1.0/24","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-rel-upstream-chain"},{"name":"single-ip"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"some-newcomers-are-providers"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"long-prefix"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"all-newcomers-are-rel-neighbor"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["45903","38732"],"attackers":["45903"],"inference_result":{"inferences":[{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}],"primary_inference":{"confidence":99,"explanation":"/32 or longer than /64 prefix is probably blackholed (e.g., for DoS mitigation)","inference_id":"blackholed-address","labels":["legitimate"],"suspicion_level":5}},"newcomers":["45903"],"prefixes":["115.146.126.0/24","45.122.253.0/32","103.63.108.0/32","124.158.6.0/32","115.146.123.76/32","115.146.121.0/32","115.146.124.0/32","103.21.149.0/32","103.21.151.217/32","115.146.123.0/32","124.158.0.0/24","115.146.120.0/32","115.146.127.231/32","124.158.0.0/32","103.21.148.0/32","124.158.3.0/32","103.21.151.0/24","115.146.125.0/24","115.146.120.0/24","124.158.2.0/24","101.99.3.0/32","115.146.127.0/32","124.158.1.0/24","103.21.150.0/24","124.158.7.0/24","124.158.0.53/32","183.91.14.0/32","124.158.2.0/32","103.63.108.0/24","124.158.6.0/24","203.205.8.0/32","103.63.109.0/32","115.146.122.0/32","203.205.8.207/32","203.205.4.153/32","115.146.126.0/32","124.158.1.24/32","103.21.148.0/24","115.146.121.0/24","45.122.253.0/24","124.158.1.0/32","124.158.4.0/32","124.158.6.174/32","115.146.127.0/24","115.146.125.188/32","103.21.148.221/32","103.21.149.0/24","124.158.7.0/32","124.158.5.0/24","103.21.151.17/32","203.205.8.0/24","103.63.109.0/24","183.91.14.0/24","203.205.4.91/32","124.158.5.0/32","124.158.4.0/24","115.146.125.0/32","103.21.151.223/32","124.158.3.0/24","115.146.123.0/24","115.146.122.0/24","203.205.4.0/32","115.146.127.98/32","103.21.150.0/32","101.99.3.0/24","103.21.151.0/32","115.146.124.0/24","203.205.4.0/24"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"single-rel-upstream-chain"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-as"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-more-specific-record"},{"name":"rpki-all-newcomer-invalid-roa"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-more-specific-record"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-no-record"},{"name":"previously-announced-by-all-newcomers"},{"name":"irr-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"some-newcomers-are-rel-upstream"},{"name":"all-origins-same-country"},{"name":"some-newcomers-are-rel-neighbor"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-APNIC-all-newcomer-more-specific-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"rpki-some-newcomer-invalid-roa"},{"name":"all-newcomers-are-rel-upstream"},{"name":"long-prefix"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"rpki-all-oldcomer-valid-roa"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"single-ip"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"single-peer-on-attacker-path"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-more-specific-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"newcomers-always-on-oldcomer-originated-paths"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"rpki-newcomer-invalid-roa-due-to-length"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"some-newcomers-are-providers"},{"name":"rpki-some-oldcomer-valid-roa"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"all-newcomers-are-providers"},{"name":"not-previously-announced-by-any-newcomer"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"irr-RADB-all-newcomer-more-specific-record"},{"name":"all-newcomers-are-rel-neighbor"}],"tr_worthy":false,"victims":["38732"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589200},{"asinfo":{"39386":{"asrank":{"asn":"39386","asnDegree":{"customer":55,"peer":708,"provider":6},"asnName":"STC-IGW-AS","organization":{"country":{"iso":"SA"},"orgId":"ORG-SSTC1-RIPE"},"rank":268},"hegemony":0},"39891":{"asrank":{"asn":"39891","asnDegree":{"customer":0,"peer":0,"provider":1},"asnName":"ALJAWWALSTC-AS","organization":{"country":{"iso":"SA"},"orgId":"ORG-SSTC1-RIPE"},"rank":12482},"hegemony":0}},"debug":{},"duration":null,"event_metrics":{"per_tag_cnt":[{"count":24,"name":"irr-ALTDB-all-oldcomer-no-record"},{"count":24,"name":"irr-OPENFACE-all-oldcomer-no-record"},{"count":24,"name":"irr-CANARIE-all-newcomer-no-record"},{"count":24,"name":"irr-JPIRR-all-oldcomer-no-record"},{"count":24,"name":"newcomer-more-specific"},{"count":24,"name":"irr-BBOI-all-newcomer-no-record"},{"count":24,"name":"irr-RADB-all-newcomer-no-record"},{"count":24,"name":"irr-CANARIE-all-oldcomer-no-record"},{"count":24,"name":"irr-WCGDB-all-newcomer-no-record"},{"count":24,"name":"irr-BBOI-all-oldcomer-no-record"},{"count":24,"name":"irr-APNIC-all-oldcomer-no-record"},{"count":24,"name":"irr-ARIN-all-newcomer-no-record"},{"count":24,"name":"rpki-all-newcomer-unknown-roa"},{"count":24,"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"count":24,"name":"irr-APNIC-all-newcomer-no-record"},{"count":24,"name":"oldcomer-newcomer-all-siblings"},{"count":24,"name":"previously-announced-by-some-newcomers"},{"count":24,"name":"irr-IDNIC-all-oldcomer-no-record"},{"count":24,"name":"some-newcomers-siblings-with-oldcomers-customers"},{"count":24,"name":"irr-AFRINIC-all-oldcomer-no-record"},{"count":24,"name":"irr-NESTEGG-all-oldcomer-no-record"},{"count":24,"name":"rpki-some-oldcomer-unknown-roa"},{"count":24,"name":"irr-ALTDB-all-newcomer-no-record"},{"count":24,"name":"no-origins-prev-view"},{"count":24,"name":"irr-PANIX-all-newcomer-no-record"},{"count":24,"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"count":24,"name":"all-newcomers-siblings-with-oldcomers-customers"},{"count":24,"name":"all-newcomers-are-rel-downstream"},{"count":24,"name":"irr-ARIN-all-oldcomer-no-record"},{"count":24,"name":"irr-all-newcomer-no-record"},{"count":24,"name":"some-newcomers-stub-ases"},{"count":24,"name":"irr-IDNIC-all-newcomer-no-record"},{"count":24,"name":"some-newcomers-siblings-with-oldcomers-peers"},{"count":24,"name":"irr-RIPE-all-newcomer-no-record"},{"count":24,"name":"irr-LACNIC-all-newcomer-no-record"},{"count":24,"name":"all-newcomers-siblings-with-oldcomers-peers"},{"count":24,"name":"irr-RADB-all-oldcomer-no-record"},{"count":24,"name":"irr-BELL-all-oldcomer-no-record"},{"count":24,"name":"irr-TC-all-newcomer-no-record"},{"count":24,"name":"all-origins-same-country"},{"count":24,"name":"all-newcomers"},{"count":24,"name":"all-newcomers-stub-ases"},{"count":24,"name":"rpki-some-newcomer-unknown-roa"},{"count":24,"name":"irr-REACH-all-newcomer-no-record"},{"count":24,"name":"irr-LEVEL3-all-newcomer-no-record"},{"count":24,"name":"irr-NTTCOM-all-oldcomer-no-record"},{"count":24,"name":"all-newcomer-pfxs"},{"count":24,"name":"irr-NESTEGG-all-newcomer-no-record"},{"count":24,"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":24,"name":"newcomer-less-specific"},{"count":24,"name":"irr-JPIRR-all-newcomer-no-record"},{"count":24,"name":"irr-AFRINIC-all-newcomer-no-record"},{"count":24,"name":"irr-LEVEL3-all-oldcomer-no-record"},{"count":24,"name":"irr-OPENFACE-all-newcomer-no-record"},{"count":24,"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"count":24,"name":"irr-TC-all-oldcomer-no-record"},{"count":24,"name":"irr-REACH-all-oldcomer-no-record"},{"count":24,"name":"irr-PANIX-all-oldcomer-no-record"},{"count":24,"name":"irr-BELL-all-newcomer-no-record"},{"count":24,"name":"oldcomer-newcomer-some-siblings"},{"count":24,"name":"some-newcomers-are-rel-downstream"},{"count":24,"name":"irr-WCGDB-all-oldcomer-no-record"},{"count":24,"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"count":24,"name":"rpki-all-oldcomer-unknown-roa"},{"count":24,"name":"irr-NTTCOM-all-newcomer-no-record"},{"count":24,"name":"irr-LACNIC-all-oldcomer-no-record"}],"pfx_events_cnt":24,"pfx_events_with_tr_cnt":0,"proc_time_driver":0.0,"proc_time_inference":0.0227963924407959,"proc_time_tagger":3.931330919265747,"total_tags_cnt":66},"event_type":"submoas","finished_ts":null,"id":"submoas-1776589200-39386=39891","insert_ts":1776592674,"last_modified_ts":1776592675,"pfx_events":[{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:51e::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:ae::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:51a::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:a2::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:440::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:344::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:a4::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:a6::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:442::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:518::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:ac::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:446::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:34e::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:340::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:a0::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:346::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:444::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:342::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:a8::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:34c::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:51c::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:34a::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:aa::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]},{"finished_ts":null,"inferences":[{"confidence":90,"explanation":"all origins are newcomers: 1) MOAS: the prefix was not announced before or the oldcomer disappeared and (at least) 2 new origins appeared at the same time; 2) subMOAS: similarly, all origins responsible for the subMOAS are newcomers","inference_id":"all-newcomers","labels":["legitimate"],"suspicion_level":3},{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1},{"confidence":95,"explanation":"less specific prefix cannot attract traffic","inference_id":"newcomer-less-specific","labels":["legitimate"],"suspicion_level":10},{"confidence":87,"explanation":"all newcomer origins are siblings with at least one customer of a potential victim","inference_id":"all-newcomers-siblings-with-oldcomers-customer","labels":["legitimate"],"suspicion_level":20}],"sub_pfx":"2001:16a4:348::/47","super_pfx":"2001:16a0::/29","tags":[{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-origins-same-country"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"some-newcomers-are-rel-downstream"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"}]}],"summary":{"ases":["39891","39386"],"attackers":["39891"],"inference_result":{"inferences":[{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}],"primary_inference":{"confidence":99,"explanation":"All ASes involved are siblings","inference_id":"sibling-origins","labels":["legitimate"],"suspicion_level":1}},"newcomers":["39891","39386"],"prefixes":["2001:16a0::/29","2001:16a4:34a::/47","2001:16a4:51a::/47","2001:16a4:51c::/47","2001:16a4:a4::/47","2001:16a4:ae::/47","2001:16a4:444::/47","2001:16a4:518::/47","2001:16a4:aa::/47","2001:16a4:340::/47","2001:16a4:51e::/47","2001:16a4:348::/47","2001:16a4:34c::/47","2001:16a4:346::/47","2001:16a4:442::/47","2001:16a4:a6::/47","2001:16a4:446::/47","2001:16a4:ac::/47","2001:16a4:344::/47","2001:16a4:34e::/47","2001:16a4:440::/47","2001:16a4:a2::/47","2001:16a4:342::/47","2001:16a4:a0::/47","2001:16a4:a8::/47"],"tags":[{"name":"irr-CANARIE-all-newcomer-no-record"},{"name":"irr-JPIRR-all-oldcomer-no-record"},{"name":"newcomer-more-specific"},{"name":"irr-WCGDB-all-newcomer-no-record"},{"name":"irr-APNIC-all-oldcomer-no-record"},{"name":"irr-ARIN-all-newcomer-no-record"},{"name":"irr-NESTEGG-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-oldcomer-no-record"},{"name":"rpki-some-oldcomer-unknown-roa"},{"name":"irr-PANIX-all-newcomer-no-record"},{"name":"all-newcomers-are-rel-downstream"},{"name":"irr-all-newcomer-no-record"},{"name":"some-newcomers-stub-ases"},{"name":"irr-LACNIC-all-newcomer-no-record"},{"name":"irr-RIPE-all-newcomer-no-record"},{"name":"irr-RADB-all-oldcomer-no-record"},{"name":"all-origins-same-country"},{"name":"rpki-some-newcomer-unknown-roa"},{"name":"irr-REACH-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"irr-TC-all-oldcomer-no-record"},{"name":"irr-REACH-all-oldcomer-no-record"},{"name":"irr-PANIX-all-oldcomer-no-record"},{"name":"irr-BELL-all-newcomer-no-record"},{"name":"irr-NTTCOM-all-newcomer-no-record"},{"name":"irr-RIPE-all-oldcomer-more-specific-record"},{"name":"irr-LACNIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-newcomer-no-record"},{"name":"irr-RADB-all-newcomer-no-record"},{"name":"irr-CANARIE-all-oldcomer-no-record"},{"name":"irr-BBOI-all-oldcomer-no-record"},{"name":"rpki-all-newcomer-unknown-roa"},{"name":"irr-APNIC-all-newcomer-no-record"},{"name":"oldcomer-newcomer-all-siblings"},{"name":"previously-announced-by-some-newcomers"},{"name":"some-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-AFRINIC-all-oldcomer-no-record"},{"name":"irr-ALTDB-all-newcomer-no-record"},{"name":"no-origins-prev-view"},{"name":"irr-RIPE-NONAUTH-all-newcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-customers"},{"name":"irr-ARIN-all-oldcomer-no-record"},{"name":"irr-IDNIC-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-BELL-all-oldcomer-no-record"},{"name":"all-newcomers-siblings-with-oldcomers-peers"},{"name":"irr-TC-all-newcomer-no-record"},{"name":"all-newcomers"},{"name":"all-newcomers-stub-ases"},{"name":"all-newcomer-pfxs"},{"name":"irr-NESTEGG-all-newcomer-no-record"},{"name":"newcomer-less-specific"},{"name":"irr-JPIRR-all-newcomer-no-record"},{"name":"irr-AFRINIC-all-newcomer-no-record"},{"name":"irr-LEVEL3-all-oldcomer-no-record"},{"name":"irr-OPENFACE-all-newcomer-no-record"},{"name":"some-newcomers-siblings-with-oldcomers-rel-downstream"},{"name":"some-newcomers-are-rel-downstream"},{"name":"oldcomer-newcomer-some-siblings"},{"name":"irr-WCGDB-all-oldcomer-no-record"},{"name":"irr-RIPE-NONAUTH-all-oldcomer-no-record"},{"name":"rpki-all-oldcomer-unknown-roa"}],"tr_worthy":false,"victims":["39386"]},"tr_metrics":{"max_event_ases":3,"max_pfx_events":2,"max_vps_per_event_as":10,"selected_event_as_cnt":0,"selected_pfx_event_cnt":0,"selected_unique_vp_cnt":0,"selected_vp_cnt":0,"total_event_as_cnt":0,"tr_request_cnt":0,"tr_request_failure_cnt":0,"tr_skip_reason":"","tr_skipped":false,"tr_worthy":false,"tr_worthy_pfx_event_cnt":0,"tr_worthy_tags":[]},"view_ts":1776589200}],"draw":null,"recordsFiltered":0,"recordsTotal":10000}