method , system and computer - readable device to locate a prefix hijacker of a destination prefix within a one - hop neighborhood . the method includes generating one - hop neighborhoods from autonomous system - level paths associated with a plurality of monitors to a destination prefix . the method also includes determining a suspect set of autonomous system identifiers resulting from a union of the one - hop neighborhoods . the method further includes calculating a count and a distance associated with each autonomous system identifier in the suspect set of autonomous system identifiers . the count represents how often an autonomous system identifier appears in the one - hop neighborhoods . the distance represents a total number of autonomous system identifiers from the autonomous system identifier to autonomous system identifiers associated with the plurality of monitors . yet further , the method includes generating a one - hop suspect set including autonomous system identifiers in the suspect set that have a greatest sum of the count and the distance .