BGP Hijack & Routing-Hygiene Audit

How it uses the graph

Traverses the BGP, RPKI, DNS layers of the graph, in 9 steps:

Why each step runs

1. 01Announced prefixes & conflicts. A CONFLICTS_WITH origin is a MOAS conflict — the hijack signal.
2. 02RPKI coverage. An uncovered prefix can be hijacked without RPKI-invalid rejection.
3. 03Exposed hostnames. The blast radius — which domains are exposed if a prefix is hijacked.
4. 04Routing-hygiene scorecard. One headline row grading the ASN: how many announced prefixes it has, how many are in MOAS conflict, and how many carry an ROA.
5. 05ROA inventory (expiry & looseness). The ground-truth ROA set authorizing this ASN, each with days until it expires and how loose its maxLength is — the authoritative RPKI picture the anchor's name-match coverage check misses.
6. 06Imminently expiring ROAs (90 days). ROAs lapsing within 90 days — when they expire, RPKI-valid routes silently become RPKI-unknown, so these are the top remediation priority.
7. 07Over-permissive maxLength ROAs. ROAs whose maxLength sits far above the prefix length leave room for forged more-specific sub-prefix hijacks while still reading as valid — a gap coverage checks never catch.
8. 08ROAs by RIR trust anchor. Buckets the ASN's ROAs by issuing RIR with the soonest expiry in each, so remediation can be routed to the right registry portal.
9. 09MOAS conflicts for a prefix input. When the indicator is a prefix rather than an ASN, this lists the competing origin ASNs announcing it — a direct hijack signal.