How is hijacking done?
In most cases hijacking involves not only announcing IP address space but also changing WHOIS information in the regional Internet registry to show the hijacker’s nameservers and email address. This is necessary because upstream ISPs would usually not announce IP address space unless they see that the address block has some relation to their client and this is checked through WHOIS records. In order to change WHOIS records at the regional Internet registry and to have administrative control over the IP address space, several methods have been used, but basically all of them involve somebody pretending to represent the organization that originally owned the address space. Since it currently is the case that most RIRs do not have any security beyond email confirmation (especially for old records), hijacking is usually done by those who have in some way gained control over the old domain (and as such the email address) listed as contact for that particular IP address block. Gaining contro
