Who Is Announcing RPKI Invalids?

While going through my router’s logs, I noticed that I was filtering way more RPKI invalids than I had expected. I decided to look into who is actually originating them, how they got to my router and why they were invalid in the first place.

What even is RPKI?

To understand RPKI, you first need to understand how traffic is routed on the internet.

The internet consist of thousands of independant networks called Autonomous Systems (or ASNs). To talk to each other, they use the Border Gateway Protocol (BGP). They send each other routes to know where to route the internet traffic to.

Before RPKI was implemented, BGP relied on trust. If a rogue network claimed to own a set of IP-Adresses, other networks would blindly believe it. This is known as a BGP hijack. A BGP hijack isn’t always malicious, in fact the most common cause is a typo.

With RPKI (Resource Public Key Infrastructure) resource owners can publish a signed certificate called a ROA to specify two things:

• Who is allowed to originate this resource? (e.g. AS213768)
• How specific can the announcement be? (maximum prefix length)

When my router receives a route, it checks it against the public RPKI ROA. If the announcement breaks the rules, my router simply drops it.

However the RPKI rollout is sluggish, even though it has existed for many years by now. Furthermore, according to bgp.tools, only 1279 out of ~88,000 ASNs are validating RPKI ROAs. Luckily most major ISPs have implemented RPKI by now, but there are many unprotected networks left.

Cloudflare’s website, isbgpsafeyet.com, tracks which ISPs are signing and validating ROAs and which are not.

Additionally, around 73.59% of IPv6 Prefixes (and 67.23% of IPv4 Prefixes) are covered by at least one ROA.

_{^{Source: bgp.he.net}}

Who is sending me invalid prefixes?

My ASN’s (AS213768) upstreams are iFog (AS34927) and ParadoxNetworks (AS52025) which are naturally sending me the most routes. iFog is not filtering RPKI Invalids themselves while ParadoxNetworks say that they do not accept routes with invalid ROAs. To my surprise ParadoxNetworks was sending me the most invalid routes.

I expected Cloudflare to show up because they intentionally announce 103.21.244.0/24, which has a ROA set to AS0 for their RPKI check. But I actually received 5 additional invalid routes originated by Cloudflare BYOIP & IP-Transit Customers.

Who is originating the invalid prefixes?

I looked up who is originating the most RPKI Invalid prefixes from my router’s point of view.

The AS originating the most RPKI invalid IPv6 Prefixes is AS23956 (AmberIT Limited) with a total of 175 invalid prefixes. However looking at their invalid prefixes it is clear that they have either misconfigured their RPKI or they are accidentally announcing prefixes they didn’t mean to announce in the first place.

For example I picked 2405:7600:1024::/48. The matching ROA is:
2405:7600::/32-36 AS23956 [rpki1 2026-08-12] * (100).

The problem is that they have set the max prefix length to a /36, but they are announcing a more specific /48. For networks that drop RPKI invalids, traffic to this subnet will simply be routed to their less specific route covered by the ROA (2405:7600:1000::/36), which is why their operations remain unaffected.

And the same thing appears to be happening with AS4787.
I chose 202.158.84.0/23 as an example:
202.158.0.0/17-17 AS4787 [rpki1 2026-08-12] * (100)

Again the ROA only allows a maximum prefix length of /17 while they are announcing a /23.

Interestingly, Cogent (AS174), a self-proclaimed “Tier 1 Provider” is also originating some invalid routes. For example prefixes 87.254.25.0/24 and 69.33.90.0/23 are being originated by Cogent. The ROAs are:

87.254.24.0/22-24 AS834  [rpki1 2026-08-20] * (100)
69.33.90.0/23-24 AS834  [rpki1 2026-08-12] * (100)

These IP addresses belong to AS834 (IPXO) and I have no clue why Cogent is originating them.

For fun I also created a chart showing the top countries originating the most IPv6 and IPv4 RPKI invalids.

How did these prefixes get to me?

The AS Path for 2405:7600:1024::/48 is 34927 34549 6461 9498 58717 23956 and
52025 6939 6461 9498 58717 23956.

AS23956 is originating the Prefix and is being upstreamed by AS58717 which is then upstreamed by AS9498 in both paths. None of them are filtering RPKI Invalids which is why it got this far. Then it goes to the first Tier 1 Provider, AS6461 (Zayo Bandwidth). This is weird because they are supposed to filter RPKI invalids and are listed on isbgpsafeyet.com. The same is happening with AS6939 (Hurricane Electric) even though they claim to drop RPKI invalids. Then it ends up at ParadoxNetworks (AS52025) and iFog(AS34927) via Meerfarbig/AS34549 after which it finally gets filtered by my router.

The path also aligns with the path seen by bgp.tools

Going trough these logs and checking why exactly I was receiving this route was suprisingly revealing. I expected smaller networks to mess up their RPKI configurations or straight up not implement it at all, but seeing multiple Tier 1 transit providers and major upstream providers pass invalid routes to each other was a bit suprising.

My biggest takeaway from this experiment is to not rely on your upstream providers to clean your routes for you. If you are operating an Autonomous System I heavily recommend enabling or implementing RPKI to stop BGP hijacking.