A method of detecting routing hijacks on the Internet, the method comprising: collecting a plurality of Border Gateway Protocol, BGP, updates from a plurality of BGP routers among a plurality of Autonomous Systems, ASs, (230a-g) on the Internet, each BGP update in the plurality of BGP updates including at least one prefix; identifying a plurality of prefixes with at least one new origin from among the prefixes included in the plurality of BGP updates; removing at least one RFC1918 prefix from the plurality of prefixes; upon determination that a particular prefix of the plurality of prefixes fulfills at least one criterion of a set of criteria, removing the particular prefix from the plurality of prefixes; and reporting at least one prefix of the remaining prefixes in the plurality of prefixes as a potential routing hijack; wherein the set of criteria comprises at least one of the following criteria: (a) a string identifying an entity to which a particular AS number, ASN, has been registered is equivalent to a string identifying an entity to which the particular prefix or a covering prefix of the particular prefix has been registered, wherein the particular ASN is identified based on a BGP update including the particular prefix in the plurality of BGP updates, (b) the particular prefix is a Multi-Originated AS, MOAS, prefix, wherein the at least one new origin is seen by all peers of the at least one new origin, (c) the particular prefix is associated with the at least one new origin which has a BGP relationship with an origin older than the at least one new origin, (d) the particular prefix is associated with a covering prefix originated by the at least one new origin, or (e) the particular prefix is announced by the at least one new origin for an organization, wherein the at least one new origin previously announced at least one other prefix for the organization. collecting a plurality of Border Gateway Protocol, BGP, updates from a plurality of BGP routers among a plurality of Autonomous Systems, ASs, (230a-g) on the Internet, each BGP update in the plurality of BGP updates including at least one prefix; identifying a plurality of prefixes with at least one new origin from among the prefixes included in the plurality of BGP updates; removing at least one RFC1918 prefix from the plurality of prefixes; upon determination that a particular prefix of the plurality of prefixes fulfills at least one criterion of a set of criteria, removing the particular prefix from the plurality of prefixes; and reporting at least one prefix of the remaining prefixes in the plurality of prefixes as a potential routing hijack; wherein the set of criteria comprises at least one of the following criteria: (a) a string identifying an entity to which a particular AS number, ASN, has been registered is equivalent to a string identifying an entity to which the particular prefix or a covering prefix of the particular prefix has been registered, wherein the particular ASN is identified based on a BGP update including the particular prefix in the plurality of BGP updates, (b) the particular prefix is a Multi-Originated AS, MOAS, prefix, wherein the at least one new origin is seen by all peers of the at least one new origin, (c) the particular prefix is associated with the at least one new origin which has a BGP relationship with an origin older than the at least one new origin, (d) the particular prefix is associated with a covering prefix originated by the at least one new origin, or (e) the particular prefix is announced by the at least one new origin for an organization, wherein the at least one new origin previously announced at least one other prefix for the organization. (a) a string identifying an entity to which a particular AS number, ASN, has been registered is equivalent to a string identifying an entity to which the particular prefix or a covering prefix of the particular prefix has been registered, wherein the particular ASN is identified based on a BGP update including the particular prefix in the plurality of BGP updates, (b) the particular prefix is a Multi-Originated AS, MOAS, prefix, wherein the at least one new origin is seen by all peers of the at least one new origin, (c) the particular prefix is associated with the at least one new origin which has a BGP relationship with an origin older than the at least one new origin, (d) the particular prefix is associated with a covering prefix originated by the at least one new origin, or (e) the particular prefix is announced by the at least one new origin for an organization, wherein the at least one new origin previously announced at least one other prefix for the organization.