Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
12,229
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 12,229 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Aug 29, 14:38 UTC | 60 | 170.33.20.0/24 | AS45102 |
| Aug 29, 14:38 UTC | 60 | 5.180.140.0/22 | AS50319 |
| Aug 29, 14:38 UTC | 70 | 195.86.32.0/24 | AS3257 |
| Aug 29, 14:38 UTC | 60 | 156.112.142.0/24 | AS27065 |
| Aug 29, 14:38 UTC | 60 | 155.28.10.0/24 | AS1516 |
| Aug 29, 14:38 UTC | 80 | 193.221.192.216/32 | AS56630 |
| Aug 29, 14:38 UTC | 60 | 125.208.49.0/24 | AS24406 |
| Aug 29, 14:38 UTC | 60 | 66.113.160.0/21 | AS3064 |
| Aug 29, 14:38 UTC | 60 | 117.50.224.0/19 | AS23724 |
| Aug 29, 14:38 UTC | 60 | 34.2.118.0/23 | AS43515 |
| Aug 29, 14:38 UTC | 70 | 94.77.16.0/20 | AS39374 |
| Aug 29, 14:38 UTC | 60 | 192.185.16.0/21 | AS31898 |
| Aug 29, 14:38 UTC | 60 | 209.23.96.0/24 | AS15065 |
| Aug 29, 14:38 UTC | 60 | 82.109.69.0/24 | AS198475 |
| Aug 29, 14:38 UTC | 60 | 202.57.199.0/24 | AS4812 |
| Aug 29, 14:38 UTC | 60 | 85.49.128.0/19 | AS12479 |
| Aug 29, 14:38 UTC | 70 | 110.43.32.0/21 | AS58466 |
| Aug 29, 14:38 UTC | 60 | 206.108.232.0/22 | AS399938 |
| Aug 29, 14:38 UTC | 60 | 192.41.162.0/24 | AS396566 |
| Aug 29, 14:38 UTC | 60 | 34.1.93.0/24 | AS15169 |
| Aug 29, 14:38 UTC | 60 | 34.4.128.0/18 | AS19527 |
| Aug 29, 14:38 UTC | 60 | 185.5.16.0/22 | AS44266 |
| Aug 29, 14:38 UTC | 60 | 197.89.152.0/24 | AS20011 |
| Aug 29, 14:38 UTC | 70 | 102.218.32.0/22 | AS328944 |
| Aug 29, 14:38 UTC | 60 | 23.145.136.0/24 | AS209242 |
| Aug 29, 14:38 UTC | 60 | 58.68.247.0/24 | AS4847 |
| Aug 29, 14:38 UTC | 60 | 216.145.218.0/24 | AS30031 |
| Aug 29, 14:38 UTC | 60 | 103.142.148.0/24 | AS64073 |
| Aug 29, 14:38 UTC | 70 | 85.60.160.0/20 | AS12479 |
| Aug 29, 14:38 UTC | 60 | 209.87.172.0/24 | AS142240 |
| Aug 29, 14:38 UTC | 60 | 89.130.128.0/22 | AS12479 |
| Aug 29, 14:38 UTC | 60 | 102.208.230.0/24 | AS328882 |
| Aug 29, 14:38 UTC | 60 | 110.43.48.0/21 | AS58466 |
| Aug 29, 14:38 UTC | 60 | 147.28.174.0/23 | AS15830 |
| Aug 29, 14:38 UTC | 60 | 192.82.134.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 103.118.52.0/22 | AS4847 |
| Aug 29, 14:38 UTC | 70 | 192.31.80.0/24 | AS396549 |
| Aug 29, 14:38 UTC | 60 | 45.12.35.0/24 | AS200313 |
| Aug 29, 14:38 UTC | 60 | 103.12.55.0/24 | AS40605 |
| Aug 29, 14:38 UTC | 60 | 63.218.148.0/23 | AS31713 |
| Aug 29, 14:38 UTC | 60 | 192.34.234.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 70 | 192.54.112.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 34.190.88.0/21 | AS15169 |
| Aug 29, 14:38 UTC | 60 | 170.61.128.0/18 | AS11911 |
| Aug 29, 14:38 UTC | 70 | 163.5.53.0/24 | AS215898 |
| Aug 29, 14:38 UTC | 60 | 154.86.0.0/24 | AS54801 |
| Aug 29, 14:38 UTC | 60 | 103.36.168.0/24 | AS4811 |
| Aug 29, 14:38 UTC | 60 | 201.91.0.0/17 | AS10429 |
| Aug 29, 14:38 UTC | 60 | 43.231.169.0/24 | AS23724 |
| Aug 29, 14:38 UTC | 60 | 192.33.14.0/24 | AS396748 |
| Aug 29, 14:38 UTC | 60 | 177.2.185.0/24 | AS137535 |
| Aug 29, 14:38 UTC | 60 | 154.223.134.0/23 | AS13335 |
| Aug 29, 14:38 UTC | 60 | 192.82.133.0/24 | AS19836 |
| Aug 29, 14:38 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 29, 14:38 UTC | 60 | 173.245.150.0/24 | AS15065 |
| Aug 29, 14:38 UTC | 60 | 38.95.121.0/24 | AS152672 |
| Aug 29, 14:38 UTC | 60 | 66.148.24.0/24 | AS395177 |
| Aug 29, 14:38 UTC | 60 | 197.89.196.0/24 | AS20011 |
| Aug 29, 14:38 UTC | 60 | 163.253.23.0/24 | AS396955 |
| Aug 29, 14:38 UTC | 60 | 120.131.12.0/23 | AS59019 |
| Aug 29, 14:38 UTC | 60 | 34.2.76.0/23 | AS43515 |
| Aug 29, 14:38 UTC | 60 | 38.19.214.0/24 | AS53107 |
| Aug 29, 14:38 UTC | 60 | 103.56.78.0/24 | AS58466 |
| Aug 29, 14:38 UTC | 70 | 69.25.152.0/24 | AS21734 |
| Aug 29, 14:38 UTC | 60 | 216.133.108.0/22 | AS2914 |
| Aug 29, 14:38 UTC | 60 | 103.61.60.0/24 | AS138457 |
| Aug 29, 14:38 UTC | 60 | 117.51.172.0/22 | AS58466 |
| Aug 29, 14:38 UTC | 60 | 194.67.75.0/24 | AS197695 |
| Aug 29, 14:38 UTC | 60 | 88.254.140.0/24 | AS47331 |
| Aug 29, 14:38 UTC | 80 | 31.217.225.0/24 | AS198392 |
| Aug 29, 14:38 UTC | 60 | 63.218.192.0/23 | AS31713 |
| Aug 29, 14:38 UTC | 60 | 34.112.0.0/14 | AS15169 |
| Aug 29, 14:38 UTC | 60 | 91.240.219.0/24 | AS206850 |
| Aug 29, 14:38 UTC | 70 | 197.89.7.0/24 | AS20011 |
| Aug 29, 14:38 UTC | 60 | 180.184.148.0/22 | AS4811 |
| Aug 29, 14:38 UTC | 60 | 210.77.144.0/21 | AS9308 |
| Aug 29, 14:38 UTC | 60 | 27.125.206.0/24 | AS55383 |
| Aug 29, 14:38 UTC | 60 | 209.40.88.0/24 | AS397765 |
| Aug 29, 14:38 UTC | 60 | 63.216.140.0/24 | AS31713 |
| Aug 29, 14:38 UTC | 60 | 34.1.90.0/24 | AS15169 |
| Aug 29, 14:38 UTC | 60 | 192.52.178.0/24 | AS396566 |
| Aug 29, 14:38 UTC | 70 | 123.108.88.0/24 | AS55996 |
| Aug 29, 14:38 UTC | 60 | 156.154.101.0/24 | AS12008 |
| Aug 29, 14:38 UTC | 60 | 189.56.0.0/16 | AS10429 |
| Aug 29, 14:38 UTC | 60 | 192.54.112.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 88.237.252.0/24 | AS47331 |
| Aug 29, 14:38 UTC | 60 | 192.35.51.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 213.9.128.0/24 | AS8903 |
| Aug 29, 14:38 UTC | 70 | 154.194.200.0/22 | AS19318 |
| Aug 29, 14:38 UTC | 60 | 63.221.240.0/24 | AS31713 |
| Aug 29, 14:38 UTC | 70 | 45.204.192.0/19 | AS62468 |
| Aug 29, 14:38 UTC | 70 | 152.175.214.0/24 | AS8143 |
| Aug 29, 14:38 UTC | 60 | 120.136.17.0/24 | AS4847 |
| Aug 29, 14:38 UTC | 60 | 63.218.156.0/23 | AS31713 |
| Aug 29, 14:38 UTC | 70 | 132.7.106.0/24 | AS56 |
| Aug 29, 14:38 UTC | 60 | 89.30.121.0/24 | AS4455 |
| Aug 29, 14:38 UTC | 60 | 139.159.110.0/24 | AS4811 |
| Aug 29, 14:38 UTC | 60 | 195.39.194.0/23 | AS60798 |
| Aug 29, 14:38 UTC | 60 | 34.0.16.0/20 | AS19527 |
| Aug 29, 14:38 UTC | 70 | 23.180.136.0/24 | AS209242 |
| Aug 29, 14:38 UTC | 60 | 38.19.39.0/24 | AS28458 |
| Aug 29, 14:38 UTC | 60 | 195.5.78.0/24 | AS8903 |
| Aug 29, 14:38 UTC | 60 | 123.103.72.0/21 | AS23724 |
| Aug 29, 14:38 UTC | 60 | 38.247.27.0/24 | AS152672 |
| Aug 29, 14:38 UTC | 60 | 38.127.93.0/24 | AS174 |
| Aug 29, 14:38 UTC | 60 | 156.154.150.0/23 | AS399169 |
| Aug 29, 14:38 UTC | 60 | 192.42.177.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 192.16.136.0/24 | AS25181 |
| Aug 29, 14:38 UTC | 60 | 110.43.144.0/21 | AS4811 |
| Aug 29, 14:38 UTC | 80 | 185.25.95.0/24 | AS207231 |
| Aug 29, 14:38 UTC | 60 | 23.27.114.0/24 | AS199550 |
| Aug 29, 14:38 UTC | 60 | 102.129.92.0/24 | AS37451 |
| Aug 29, 14:38 UTC | 70 | 80.174.162.0/24 | AS197646 |
| Aug 29, 14:38 UTC | 60 | 203.19.219.0/24 | AS7575 |
| Aug 29, 14:38 UTC | 60 | 37.135.0.0/16 | AS12479 |
| Aug 29, 14:38 UTC | 70 | 41.173.24.0/21 | AS30844 |
| Aug 29, 14:38 UTC | 60 | 59.79.0.0/16 | AS4538 |
| Aug 29, 14:38 UTC | 70 | 101.52.216.0/22 | AS4811 |
| Aug 29, 14:38 UTC | 70 | 154.53.208.0/24 | AS328500 |
| Aug 29, 14:38 UTC | 60 | 192.42.176.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 71.18.162.0/24 | AS396986 |
| Aug 29, 14:38 UTC | 60 | 118.145.44.0/22 | AS58466 |
| Aug 29, 14:38 UTC | 60 | 222.204.0.0/16 | AS4538 |
| Aug 29, 14:38 UTC | 60 | 35.206.3.0/24 | AS19527 |
| Aug 29, 14:38 UTC | 60 | 34.1.93.0/24 | AS15169 |
| Aug 29, 14:38 UTC | 60 | 38.188.165.0/24 | AS273113 |
| Aug 29, 14:38 UTC | 60 | 34.1.91.0/24 | AS15169 |
| Aug 29, 14:38 UTC | 60 | 154.43.165.0/24 | AS211691 |
| Aug 29, 14:38 UTC | 70 | 192.35.51.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 64.38.253.0/24 | AS32164 |
| Aug 29, 14:38 UTC | 70 | 114.116.96.0/19 | AS23724 |
| Aug 29, 14:38 UTC | 60 | 45.74.56.0/24 | AS140641 |
| Aug 29, 14:38 UTC | 60 | 223.203.100.0/24 | AS4847 |
| Aug 29, 14:38 UTC | 60 | 23.19.53.0/24 | AS205544 |
| Aug 29, 14:38 UTC | 60 | 102.220.88.0/22 | AS55933 |
| Aug 29, 14:38 UTC | 60 | 216.87.145.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 70 | 206.147.186.0/24 | AS5715 |
| Aug 29, 14:38 UTC | 60 | 34.0.236.0/23 | AS19527 |
| Aug 29, 14:38 UTC | 60 | 27.123.2.0/24 | AS45706 |
| Aug 29, 14:38 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 63.217.208.0/22 | AS31713 |
| Aug 29, 14:38 UTC | 60 | 63.216.152.0/22 | AS31713 |
| Aug 29, 14:38 UTC | 60 | 197.89.195.0/24 | AS20011 |
| Aug 29, 14:38 UTC | 60 | 193.105.40.0/24 | AS196695 |
| Aug 29, 14:38 UTC | 70 | 192.42.176.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 107.163.0.0/24 | AS395776 |
| Aug 29, 14:38 UTC | 60 | 118.145.36.0/22 | AS58466 |
| Aug 29, 14:38 UTC | 70 | 2.27.92.0/24 | AS25198 |
| Aug 29, 14:38 UTC | 60 | 173.45.40.0/21 | AS29838 |
| Aug 29, 14:38 UTC | 70 | 34.1.68.0/24 | AS43515 |
| Aug 29, 14:38 UTC | 80 | 38.95.113.0/24 | AS152672 |
| Aug 29, 14:38 UTC | 60 | 185.108.92.0/24 | AS205402 |
| Aug 29, 14:38 UTC | 60 | 57.140.209.0/24 | AS15169 |
| Aug 29, 14:38 UTC | 60 | 45.125.112.0/23 | AS58779 |
| Aug 29, 14:38 UTC | 60 | 102.220.88.0/22 | AS55933 |
| Aug 29, 14:38 UTC | 60 | 88.229.88.0/24 | AS47331 |
| Aug 29, 14:38 UTC | 60 | 187.188.140.0/24 | AS17072 |
| Aug 29, 14:38 UTC | 70 | 192.30.45.0/24 | AS396549 |
| Aug 29, 14:38 UTC | 60 | 188.208.40.0/21 | AS12479 |
| Aug 29, 14:38 UTC | 60 | 221.122.64.0/20 | AS23724 |
| Aug 29, 14:38 UTC | 70 | 64.93.29.0/24 | AS40605 |
| Aug 29, 14:38 UTC | 80 | 192.55.83.0/24 | AS396566 |
| Aug 29, 14:38 UTC | 60 | 170.140.99.0/24 | AS3512 |
| Aug 29, 14:38 UTC | 70 | 192.34.234.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 80 | 185.194.173.0/24 | AS203543 |
| Aug 29, 14:38 UTC | 70 | 89.30.26.0/24 | AS4455 |
| Aug 29, 14:38 UTC | 60 | 83.118.224.0/22 | AS209242 |
| Aug 29, 14:38 UTC | 60 | 170.46.155.0/24 | AS18697 |
| Aug 29, 14:38 UTC | 60 | 128.65.136.0/21 | AS44266 |
| Aug 29, 14:38 UTC | 60 | 78.169.38.0/23 | AS47331 |
| Aug 29, 14:38 UTC | 60 | 82.108.73.0/24 | AS151338 |
| Aug 29, 14:38 UTC | 80 | 192.82.134.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 113.21.236.0/24 | AS4812 |
| Aug 29, 14:38 UTC | 60 | 24.248.247.0/24 | AS19905 |
| Aug 29, 14:38 UTC | 60 | 42.240.160.0/20 | AS58466 |
| Aug 29, 14:38 UTC | 60 | 167.219.58.0/24 | AS132384 |
| Aug 29, 14:38 UTC | 60 | 195.49.142.0/24 | AS31216 |
| Aug 29, 14:38 UTC | 60 | 170.168.20.0/24 | AS43278 |
| Aug 29, 14:38 UTC | 60 | 14.103.120.0/21 | AS4811 |
| Aug 29, 14:38 UTC | 60 | 192.41.162.0/24 | AS396566 |
| Aug 29, 14:38 UTC | 80 | 216.93.66.0/24 | AS7321 |
| Aug 29, 14:38 UTC | 70 | 103.127.242.0/23 | AS137535 |
| Aug 29, 14:38 UTC | 60 | 192.34.234.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 60 | 145.40.80.0/23 | AS15830 |
| Aug 29, 14:38 UTC | 70 | 45.192.133.0/24 | AS263242 |
| Aug 29, 14:38 UTC | 70 | 109.176.255.0/24 | AS399989 |
| Aug 29, 14:38 UTC | 60 | 203.196.0.0/23 | AS9308 |
| Aug 29, 14:38 UTC | 60 | 34.190.160.0/21 | AS19527 |
| Aug 29, 14:38 UTC | 70 | 143.208.7.0/24 | AS264088 |
| Aug 29, 14:38 UTC | 60 | 194.33.68.0/24 | AS43766 |
| Aug 29, 14:38 UTC | 60 | 202.90.96.0/22 | AS4811 |
| Aug 29, 14:38 UTC | 60 | 154.196.252.0/24 | AS41095 |
| Aug 29, 14:38 UTC | 70 | 192.43.172.0/24 | AS397197 |
| Aug 29, 14:38 UTC | 70 | 185.100.0.0/24 | AS396566 |
| Aug 29, 14:38 UTC | 60 | 154.62.234.0/23 | AS8903 |
| Aug 29, 14:38 UTC | 60 | 88.227.240.0/21 | AS47331 |
| Aug 29, 14:38 UTC | 60 | 207.135.220.0/23 | AS397782 |
| Aug 29, 14:38 UTC | 60 | 212.163.8.0/24 | AS12541 |
| Aug 29, 14:38 UTC | 60 | 87.76.157.0/24 | AS209658 |
| Aug 29, 14:38 UTC | 60 | 163.171.65.0/24 | AS4775 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-29 14:45 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
