[fiber]

I doubt that this is a genuine hijacking attempt. All it takes is a Cisco router and some IT admin making up an address.

[bodyfour]

Agreed. As many pointed out when the 1.1.1.1 DNS service was introduced, it's an address that is often used (incorrectly) as an internal or temporary IP. Then all it takes is a slight mistake in your route redistribution and suddenly you can find yourself accidentally announcing the prefix to eBGP.

I wouldn't be surprised if this becomes a semi-regular occurrence.

[walrus01]

Hanlon's razor applies to a great degree. I have no doubt that there are a great many enterprise-type organizations that have been using 1.0.0.0/8 internally and cluelessly for a very long time.

[floatingatoll]

Has the hijacker previously hijacked other prefixes in the past, or is this a one-time event for them?