Your website’s uptime depends on a protocol you’ve probably never configured, run by networks you’ve never heard of, held together by rules that are — as Cloudflare just demonstrated — routinely ignored. On July 24, Cloudflare published a study of the BGP ORIGIN attribute with a startling headline number: roughly 70% of the routing paths it observed carried an ORIGIN value different from the one the originating network actually set, despite the protocol standard saying that value should never be touched in transit.
That finding is a useful entry point into a bigger question every site owner eventually runs into, usually during an outage postmortem: what actually decides how traffic reaches my server, and why do “route hijacks” and “route leaks” keep taking sites offline in 2026? This guide walks through how the Border Gateway Protocol works at the level you need, what Cloudflare’s new data says about how casually its rules get bent, and — the practical part — what you can and cannot do about it as someone who runs a website rather than a backbone network.
The internet is a negotiation, not a map
The internet is a mesh of roughly independent networks called Autonomous Systems (ASes) — your hosting provider is one, your CDN is one, the telco carrying traffic between continents is another. BGP is the protocol these networks use to tell each other which IP address blocks they can reach and by what path. When someone in Berlin loads your site hosted in Virginia, the route their packets take is stitched together from thousands of BGP announcements, each one essentially a network saying “send traffic for these addresses through me.”
Crucially, BGP largely runs on trust. A network announces routes; its neighbors believe it, apply their own commercial preferences, and pass the announcement along. There is no central authority checking whether an announcement is truthful, and the tiebreaking rules that pick between competing routes were designed for a cooperative internet that no longer quite exists.
That’s where hijacks come from. A route hijack is a network announcing address space it doesn’t own — whether by fat-fingered config or by malice — and the rest of the internet believing it. Traffic meant for your site flows to the wrong network, where it can be dropped (an outage), inspected, or answered by an impostor. Route leaks are the accidental cousin: legitimate routes propagated in ways that violate routing policy, sending traffic through paths never meant to carry it.
What Cloudflare found: rule-bending at internet scale
Cloudflare’s new study looks at a subtler layer of the same trust problem. Every BGP route announcement carries a mandatory attribute called ORIGIN, which records how the route entered BGP. It has three values — IGP, EGP, and INCOMPLETE — and RFC 4271, the BGP specification, is explicit that the attribute “SHOULD NOT be changed by any other speaker” after the originating router sets it.
It matters because ORIGIN is a tiebreaker in route selection: when two routes have equal local preference and equal path length, routers prefer the one with the lower ORIGIN value. Which means a transit provider that quietly rewrites ORIGIN on routes passing through it can make its own paths look more attractive, pulling traffic — and the revenue that comes with carrying it — toward its network.
To measure how widespread this is, Cloudflare announced three IPv4 and three IPv6 test prefixes, each with a different ORIGIN value, from its anycast network, then watched what came back through the public route collectors run by RIPE RIS and RouteViews. Among its direct peers — networks connected straight to Cloudflare, where any change is unambiguous — nearly 10% rewrote the ORIGIN to the most-preferred IGP value regardless of what was announced. Of the 16 Tier-1 networks that form the internet’s backbone, six manipulate the value. A handful of networks rewrote in the other direction, deliberately marking routes as less preferred; one network engineer confirmed to Cloudflare they do this to deprioritize routes from peers in favor of paying customers. Across all observed paths, about 70% arrived with an ORIGIN that didn’t match what was sent.
None of this is a hijack in itself — nobody is stealing address space by tweaking ORIGIN. But it’s a clean, measurable demonstration of the underlying condition that makes hijacks possible: BGP’s rules are advisory, compliance is optional, and networks bend the protocol when money is on the line. As the study notes, operators have described route selection as a revenue-driven arms race — once some networks rewrite attributes to attract traffic, competitors rewrite them just to level the field. An expired IETF draft even proposed deprecating the ORIGIN attribute entirely.
What this means when your site goes dark
For a site owner, the takeaway isn’t the ORIGIN attribute itself — it’s the mental model. When your monitoring shows the site unreachable from one country but fine everywhere else, or latency from a region suddenly triples with no deploy in sight, routing is a real suspect. The path between your users and your server is recomputed continuously by networks optimizing for their own costs, and it can change — or break — without anyone touching your infrastructure.
Three failure shapes are worth recognizing:
The misdirected route. Someone announces your provider’s address space, and part of the internet follows the false route. Users in affected regions get timeouts or, worse, someone else’s server. This is the classic hijack, and it tends to be regional rather than global, because the bogus announcement wins the tiebreakers only in parts of the topology.
The detour. Your traffic still arrives, but via a path it shouldn’t take — through an extra continent, or through a network positioned to observe it. Latency spikes are your only visible symptom. Attribute games like the ORIGIN rewriting in Cloudflare’s data steer traffic in exactly this quiet way.
The leak. A network accidentally re-advertises routes it learned, becoming an unintended transit path for traffic it can’t handle. The result is congestion and packet loss that looks, from your dashboard, like your host having a bad day.
What you can actually do about it
You don’t run BGP, but you make purchasing decisions that determine how exposed you are to it.
Choose providers that validate routes. The strongest deployed defense against hijacks is RPKI — a cryptographic system letting address holders publish which networks may originate their prefixes, so others can reject invalid announcements. Adoption varies widely between providers. Cloudflare maintains Is BGP Safe Yet, a public tracker that names which major ISPs and cloud networks enforce RPKI origin validation and lets you test your own ISP. When evaluating a host or CDN, whether they sign their routes and filter invalid ones is a fair — and answerable — question to ask.
Put an anycast network in front of the origin. Serving through a large CDN doesn’t make BGP problems disappear, but it changes the blast radius. Anycast announces the same addresses from many locations, so a bad route in one region tends to affect that region alone, and the provider’s network team — whose entire job is watching routing — handles detection and response instead of you.
Treat TLS as your integrity layer. Routing determines where packets go, not what attackers can read. If traffic is diverted through a hostile path, universally enforced HTTPS with HSTS means the diverter sees ciphertext and can’t impersonate your site without also defeating the certificate system. Several of the most damaging historical hijacks worked because interception was paired with weak or missing transport security on the target.
Know where to look when regions go dark. The same public data Cloudflare used is open to everyone. RIPEstat will show you, for any IP prefix, what routes the world currently sees and how they’ve changed — enough to distinguish “our host is down” from “our host’s routes just vanished from half the internet.” Bookmark it before the incident, not during.
The uncomfortable equilibrium
The honest summary of Cloudflare’s data is that the internet’s routing layer works not because its rules are enforced but because breaking them catastrophically is bad for everyone’s business — while breaking them profitably, in small attribute-sized ways, is apparently routine. Seventy percent of paths carrying a rewritten ORIGIN is not a crisis; your site loads anyway. But it is a reminder that reachability sits on a foundation of commercial self-interest and voluntary compliance.
For site owners, the practical posture hasn’t changed, only sharpened: buy from providers that treat routing security as a feature, front your origin with networks big enough to absorb regional weirdness, encrypt everything so misdirection can’t become impersonation, and keep one tab ready to check what the routing table actually says. You can’t fix BGP. You can make sure that when it misbehaves, your site is the one that shrugs it off.
