Address space historically originated by AS202412 (Omegatech LTD) is now originated by AS6461. Nineteen of the affected /24s validate as RPKI Invalid because AS0 ROAs cover them. Those routes reach about 3% of RIPE RIS peers, while the same origin's uncovered prefixes reach about 80%.
Independent public reporting has associated parts of the historical AS202412 estate with malware staging and delivery, command-and-control, botnet, malspam and phishing activity. Sources include Breakglass Intelligence, Nokia Deepfield ERT, ThreatFox (abuse.ch), Intrinsec and Netcraft. SecureLeaf tracks this cluster under advisory SL-ADV-2026-WP-001.
That history concerns past activity in this address space. It does not implicate the networks or organizations that originate, hold or route the space today.
On attribution. A BGP origin ASN identifies the network announcing reachability for a prefix. It does not identify who operates the servers behind it. Carriers routinely originate space for customers, resellers, VPN and mitigation services. Nothing in this note suggests AS6461 or any resource holder named here knowingly took part in malicious activity.
All 24 announced prefixes in the watch list now have a new origin. Grouped by RPKI state, AS6461's routes split cleanly. Prefixes with no covering ROA propagate widely. Prefixes covered by AS0 ROAs barely propagate. Because the origin is the same in both groups, poor propagation by AS6461 does not explain the gap.
of RIS peers see the route · 82–89% median
of RIS peers see the route · 0% median
The visibility collapse is strongly associated with the AS0-covered invalid routes. RIS visibility alone cannot show why each missing path is missing, so we do not claim that every absent peer dropped the route because of route origin validation.
An AS0 ROA is a signed RPKI statement that no origin AS is authorized to announce the covered space. Networks that perform route origin validation treat any announcement of that space as Invalid. We retrieved and validated two such objects from the RIPE NCC repository. Each carries nine AS0 entries and expires on 2027-07-01. They chain to different issuing certificates, which in RIPE's hosted RPKI usually means different resource holders.
Qgs4lcmCzDX-kdy4tyN672rVdfk.roa| Prefix | maxLength | In this study |
|---|---|---|
| 91.92.240.0/22 | /24 | 4 invalid /24s |
| 91.206.71.0/24 | /24 | not monitored |
| 158.94.208.0/22 | /24 | 4 invalid /24s |
| 178.16.52.0/22 | /24 | 4 invalid /24s |
| 185.7.240.0/22 | /22 | not monitored |
| 185.7.240.0/24 | /24 | not monitored |
| 185.7.243.0/24 | /24 | not monitored |
| 185.81.153.0/24 | /24 | not monitored |
| 185.81.154.0/24 | /24 | not monitored |
yZMbrPnYL62wFsLCuxQ4aaHq_IE.roa| Prefix | maxLength | In this study |
|---|---|---|
| 5.181.85.0/24 | /24 | not monitored |
| 5.181.87.0/24 | /24 | not monitored |
| 45.94.170.0/24 | /24 | not monitored |
| 45.132.180.0/24 | /24 | invalid /24 |
| 45.144.213.0/24 | /24 | not monitored |
| 77.83.39.0/24 | /24 | not monitored |
| 146.19.125.0/24 | /24 | invalid /24 |
| 193.30.241.0/24 | /24 | invalid /24 |
| 195.211.190.0/24 | /24 | not monitored |
Entries marked “not monitored” are other resources carried by the same signed objects. We list them because they are public RPKI data. We make no claim that they are connected to AS202412 or to any malicious activity.
The signing time is the timestamp of the current object. A ROA can be reissued with the same content, so it does not tell us when the AS0 policy first appeared. This matters most for ROA B, which was signed about 15 hours after the withdrawals.
RIPE RDAP lists 158.94.208.0/22 as an active ALLOCATED PA block registered to MGN TEKNOLOJI ANONIM SIRKETI (Istanbul, TR), with a registration date of 2025-09-10. The record shows a database change at 13:49:36 UTC on 28 October 2026. RDAP does not say which attribute changed.
Because the block is an active allocation and not returned free-pool space, the AS0 ROA appears to have been issued within an allocated resource holder's RPKI. We have not established who requested it or why.
Issuing certificate 1B12120C… becomes valid.
Its resources include 91.92.240.0/22 and 158.94.208.0/22.
Four /24s first observed originated by AS219199, with AS202412 upstream.
ROA A signed: nine AS0 authorizations.
Synchronized withdrawals across the AS202412 estate.
RIPE database change on 158.94.208.0/22.
ROA B signed under a different issuing CA: nine AS0 authorizations.
SecureLeaf baselines the 29-prefix watch.
AS202412 at zero prefixes; 23 /24s from AS6461, one from AS51130, five unannounced.
Snapshot used for the figures in this note.
State as of 2026-10-29 01:39 UTC. Origins in leased space change often, so verify current routing before acting on this list.
| Prefix | Origin now | Previous origin | RPKI | Visibility / median |
|---|
Routing data comes from RIPEstat (RIPE NCC RIS): prefix overview, routing status, visibility, routing history and announced prefixes, polled every 15 minutes. Visibility is the share of full-table RIS peers that see the exact prefix; the median is taken across route collectors. RPKI validity was decided locally per RFC 6811 against RIPEstat VRP data. ROA objects were retrieved from the RIPE NCC repository and validated independently. Registration data comes from RIPE RDAP.