# Halowerk Netz BGP Route Hijack Suspicion Detector

> Halowerk Netz BGP Route Hijack Suspicion Detector is a paid API for AI agents from netz.halowerk.com, paid per call via x402, $0.006/call, status unknown (last checked 2026-09-15).

Analyzes a BGP prefix announcement for observable signs of a route hijack, scoring four weighted indicators including RPKI invalidity, unexpected origin AS, and historical origin changes.

## Facts

- Endpoint: POST https://netz.halowerk.com/v1/hijack-suspicion
- Price: $0.006/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-netz-bgp-route-hijack-suspicion-detector-48373e8a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_shs3TR6UmHcilxO7d2jTB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-netz-bgp-route-hijack-suspicion-detector-48373e8a -d '<json body>'
```

Example prompt: Check prefix 192.0.2.0/24 announced by AS64496 for all signs of a BGP route hijack — I want to know if RPKI marks it invalid, whether that origin AS has ever been seen for this prefix before, and the full evidence behind each indicator.

## When to prefer this

Use this endpoint when you need a consolidated, multi-signal hijack suspicion verdict for a single prefix in one call, rather than querying RPKI validity, AS path anomalies, and origin history separately. It is ideal for security monitoring pipelines, incident triage, and alerting workflows where you want weighted evidence rather than a single binary check. Prefer this over the standalone RPKI validation endpoint when historical origin AS context and composite scoring matter.

## Known failure modes

- Prefix not found in BGP routing tables — no data returned
- RPKI repository unavailable — RPKI indicator may be absent or stale
- Origin AS with very short history window may produce false positives for new legitimate announcements
- Malformed prefix CIDR input returns validation error
- Rate limiting or payment failure returns 402 or 429 error

## How this service works

Collects the observable signs of a route hijack for one prefix and reports which of them are present, with the measurement behind each. Four signs carry different weight. RPKI invalidity is the only hard one: a ROA exists and does not authorise this announcement. An origin AS that appears in the current state but nowhere in the history window is the classic sign, and the response gives the historical origins so the change can be dated.

## Output

A structured report listing up to four weighted hijack suspicion indicators: RPKI invalidity (hard indicator — ROA exists but does not authorize the announcement), unexpected origin AS not seen in historical records, and other observable signs. Each indicator states whether it is present and includes the underlying measurement or evidence, such as the list of historical origin ASes with approximate dates of change.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "prefix": {
   "type": "string",
   "maxLength": 60,
   "minLength": 4
  },
  "expected_asn": {
   "type": "string",
   "maxLength": 15,
   "description": "The AS you expect to announce this prefix. Supplying it turns a general check into a targeted one."
  },
  "history_days": {
   "type": "integer",
   "default": 30,
   "maximum": 180,
   "minimum": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-netz-bgp-route-hijack-suspicion-detector-48373e8a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netz.halowerk.com](https://www.zero.xyz/host/netz.halowerk.com/llms.txt)