RPKI

RPKI (Resource Public Key Infrastructure) lets the holder of an address block cryptographically authorise which AS may originate its prefixes. Routers can then mark announcements as valid, invalid or not found.

An “invalid” route often indicates a hijack or a misconfiguration, and some networks drop invalid routes entirely.

For IP inspection, RPKI status is a secondary signal: a valid route is normal, an invalid one is worth a second look. Most consumer tooling ignores it.