Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
9,135
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 9,135 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Oct 14, 01:43 UTC | 60 | 119.29.29.0/24 | AS132203 |
| Oct 14, 01:43 UTC | 60 | 81.8.22.0/24 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 110.43.248.0/21 | AS58466 |
| Oct 14, 01:43 UTC | 60 | 14.103.128.0/21 | AS4811 |
| Oct 14, 01:43 UTC | 60 | 197.89.142.0/24 | AS20011 |
| Oct 14, 01:43 UTC | 60 | 156.247.36.0/24 | AS138415 |
| Oct 14, 01:43 UTC | 60 | 139.220.193.0/24 | AS17638 |
| Oct 14, 01:43 UTC | 60 | 188.248.72.0/24 | AS48695 |
| Oct 14, 01:43 UTC | 60 | 196.28.44.0/24 | AS5713 |
| Oct 14, 01:43 UTC | 60 | 90.165.220.0/22 | AS12479 |
| Oct 14, 01:43 UTC | 60 | 151.245.239.0/24 | AS212238 |
| Oct 14, 01:43 UTC | 60 | 38.188.88.0/24 | AS138754 |
| Oct 14, 01:43 UTC | 60 | 176.97.159.0/24 | AS198949 |
| Oct 14, 01:43 UTC | 60 | 63.222.187.0/24 | AS3491 |
| Oct 14, 01:43 UTC | 60 | 213.194.120.0/24 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 197.89.41.0/24 | AS5713 |
| Oct 14, 01:43 UTC | 70 | 197.88.200.0/21 | AS5713 |
| Oct 14, 01:43 UTC | 70 | 94.184.128.0/17 | AS6736 |
| Oct 14, 01:43 UTC | 70 | 131.100.40.0/24 | AS61754 |
| Oct 14, 01:43 UTC | 60 | 35.212.0.0/14 | AS15169 |
| Oct 14, 01:43 UTC | 80 | 161.248.108.0/23 | AS55933 |
| Oct 14, 01:43 UTC | 60 | 113.31.112.0/20 | AS4811 |
| Oct 14, 01:43 UTC | 60 | 122.200.120.0/22 | AS4847 |
| Oct 14, 01:43 UTC | 70 | 46.221.47.0/24 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 38.46.14.0/24 | AS22427 |
| Oct 14, 01:43 UTC | 70 | 209.166.46.0/24 | AS39600 |
| Oct 14, 01:43 UTC | 60 | 64.41.117.0/24 | AS3064 |
| Oct 14, 01:43 UTC | 70 | 201.34.176.0/20 | AS8167 |
| Oct 14, 01:43 UTC | 60 | 54.222.115.0/24 | AS23724 |
| Oct 14, 01:43 UTC | 60 | 38.126.229.0/24 | AS36336 |
| Oct 14, 01:43 UTC | 60 | 69.171.13.0/24 | AS13767 |
| Oct 14, 01:43 UTC | 60 | 206.43.35.0/24 | AS267587 |
| Oct 14, 01:43 UTC | 60 | 103.131.100.0/24 | AS151080 |
| Oct 14, 01:43 UTC | 60 | 65.170.218.0/24 | AS396411 |
| Oct 14, 01:43 UTC | 60 | 115.69.237.0/24 | AS7521 |
| Oct 14, 01:43 UTC | 60 | 120.131.8.0/23 | AS59019 |
| Oct 14, 01:43 UTC | 60 | 195.42.248.0/24 | AS200313 |
| Oct 14, 01:43 UTC | 60 | 52.82.166.0/24 | AS9808 |
| Oct 14, 01:43 UTC | 60 | 152.175.144.0/24 | AS202069 |
| Oct 14, 01:43 UTC | 60 | 206.107.70.0/24 | AS174 |
| Oct 14, 01:43 UTC | 60 | 212.12.157.0/24 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 197.89.100.0/24 | AS20011 |
| Oct 14, 01:43 UTC | 60 | 200.53.187.0/24 | AS22011 |
| Oct 14, 01:43 UTC | 60 | 23.185.104.0/24 | AS401776 |
| Oct 14, 01:43 UTC | 60 | 197.89.98.0/24 | AS20011 |
| Oct 14, 01:43 UTC | 70 | 213.247.48.0/23 | AS8315 |
| Oct 14, 01:43 UTC | 60 | 114.79.51.0/24 | AS18004 |
| Oct 14, 01:43 UTC | 70 | 179.42.46.0/24 | AS273309 |
| Oct 14, 01:43 UTC | 60 | 43.254.46.0/23 | AS4811 |
| Oct 14, 01:43 UTC | 60 | 118.26.168.0/21 | AS4847 |
| Oct 14, 01:43 UTC | 60 | 34.1.83.0/24 | AS19527 |
| Oct 14, 01:43 UTC | 60 | 103.79.2.0/24 | AS133296 |
| Oct 14, 01:43 UTC | 70 | 23.226.50.0/24 | AS138415 |
| Oct 14, 01:43 UTC | 60 | 210.48.146.0/24 | AS18206 |
| Oct 14, 01:43 UTC | 60 | 117.121.230.0/24 | AS136908 |
| Oct 14, 01:43 UTC | 60 | 63.223.20.0/24 | AS31713 |
| Oct 14, 01:43 UTC | 60 | 143.199.140.0/23 | AS203 |
| Oct 14, 01:43 UTC | 60 | 63.221.155.0/24 | AS31713 |
| Oct 14, 01:43 UTC | 60 | 45.253.26.0/24 | AS138421 |
| Oct 14, 01:43 UTC | 60 | 89.46.26.0/24 | AS44947 |
| Oct 14, 01:43 UTC | 60 | 200.53.169.0/24 | AS22908 |
| Oct 14, 01:43 UTC | 60 | 63.222.158.0/24 | AS31713 |
| Oct 14, 01:43 UTC | 60 | 34.1.70.0/24 | AS43515 |
| Oct 14, 01:43 UTC | 60 | 199.88.114.0/23 | AS10309 |
| Oct 14, 01:43 UTC | 60 | 195.87.31.0/24 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 66.113.135.0/24 | AS3064 |
| Oct 14, 01:43 UTC | 60 | 57.140.227.0/24 | AS19527 |
| Oct 14, 01:43 UTC | 60 | 34.0.233.0/24 | AS43515 |
| Oct 14, 01:43 UTC | 60 | 121.46.28.0/22 | AS135391 |
| Oct 14, 01:43 UTC | 60 | 118.197.24.0/21 | AS4811 |
| Oct 14, 01:43 UTC | 60 | 38.100.105.0/24 | AS400810 |
| Oct 14, 01:43 UTC | 60 | 144.208.80.0/22 | AS396341 |
| Oct 14, 01:43 UTC | 60 | 166.86.194.0/24 | AS213735 |
| Oct 14, 01:43 UTC | 60 | 200.219.148.0/24 | AS53035 |
| Oct 14, 01:43 UTC | 60 | 128.26.97.0/24 | AS27137 |
| Oct 14, 01:43 UTC | 60 | 91.209.198.0/24 | AS50369 |
| Oct 14, 01:43 UTC | 60 | 195.209.218.160/32 | AS62255 |
| Oct 14, 01:43 UTC | 60 | 192.42.178.0/24 | AS396566 |
| Oct 14, 01:43 UTC | 60 | 203.4.136.0/24 | AS18390 |
| Oct 14, 01:43 UTC | 60 | 223.202.67.0/24 | AS4847 |
| Oct 14, 01:43 UTC | 60 | 214.25.177.0/24 | AS27137 |
| Oct 14, 01:43 UTC | 60 | 212.163.18.0/24 | AS8903 |
| Oct 14, 01:43 UTC | 60 | 210.87.197.0/24 | AS135120 |
| Oct 14, 01:43 UTC | 60 | 34.0.234.0/24 | AS19527 |
| Oct 14, 01:43 UTC | 60 | 84.45.50.0/24 | AS40513 |
| Oct 14, 01:43 UTC | 60 | 103.169.159.0/24 | AS140228 |
| Oct 14, 01:43 UTC | 60 | 150.137.0.0/16 | AS1600 |
| Oct 14, 01:43 UTC | 60 | 34.2.124.0/22 | AS43515 |
| Oct 14, 01:43 UTC | 60 | 192.12.94.0/24 | AS396549 |
| Oct 14, 01:43 UTC | 80 | 187.49.41.0/24 | AS28140 |
| Oct 14, 01:43 UTC | 60 | 95.27.212.0/23 | AS34038 |
| Oct 14, 01:43 UTC | 60 | 145.40.101.0/24 | AS15830 |
| Oct 14, 01:43 UTC | 60 | 38.188.94.0/24 | AS138754 |
| Oct 14, 01:43 UTC | 60 | 91.123.181.0/24 | AS51648 |
| Oct 14, 01:43 UTC | 60 | 117.48.234.0/24 | AS58466 |
| Oct 14, 01:43 UTC | 60 | 82.139.242.0/24 | AS151338 |
| Oct 14, 01:43 UTC | 60 | 143.255.183.0/24 | AS266335 |
| Oct 14, 01:43 UTC | 60 | 180.184.176.0/21 | AS4811 |
| Oct 14, 01:43 UTC | 70 | 168.210.128.0/18 | AS20011 |
| Oct 14, 01:43 UTC | 60 | 87.222.209.0/24 | AS12479 |
| Oct 14, 01:43 UTC | 80 | 94.142.187.0/24 | AS48463 |
| Oct 14, 01:43 UTC | 60 | 191.243.243.0/24 | AS263519 |
| Oct 14, 01:43 UTC | 60 | 38.225.110.0/24 | AS174 |
| Oct 14, 01:43 UTC | 60 | 103.221.49.0/24 | AS139259 |
| Oct 14, 01:43 UTC | 60 | 45.62.133.0/24 | AS15265 |
| Oct 14, 01:43 UTC | 60 | 27.124.8.0/24 | AS64050 |
| Oct 14, 01:43 UTC | 60 | 45.43.16.0/24 | AS398465 |
| Oct 14, 01:43 UTC | 60 | 45.215.225.0/24 | AS327708 |
| Oct 14, 01:43 UTC | 60 | 90.74.68.0/22 | AS12479 |
| Oct 14, 01:43 UTC | 80 | 90.168.30.0/23 | AS12479 |
| Oct 14, 01:43 UTC | 60 | 194.164.87.0/24 | AS207551 |
| Oct 14, 01:43 UTC | 60 | 192.81.185.0/24 | AS36631 |
| Oct 14, 01:43 UTC | 70 | 31.145.26.0/24 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 38.87.169.0/24 | AS400302 |
| Oct 14, 01:43 UTC | 60 | 156.154.100.0/24 | AS12008 |
| Oct 14, 01:43 UTC | 60 | 193.232.39.0/24 | AS48009 |
| Oct 14, 01:43 UTC | 60 | 34.190.88.0/21 | AS15169 |
| Oct 14, 01:43 UTC | 60 | 72.249.112.0/24 | AS7181 |
| Oct 14, 01:43 UTC | 60 | 112.196.220.0/24 | AS38705 |
| Oct 14, 01:43 UTC | 60 | 204.145.64.0/19 | AS29838 |
| Oct 14, 01:43 UTC | 60 | 190.90.58.0/24 | AS18678 |
| Oct 14, 01:43 UTC | 60 | 66.22.101.0/24 | AS25773 |
| Oct 14, 01:43 UTC | 60 | 54.222.109.0/24 | AS23724 |
| Oct 14, 01:43 UTC | 60 | 206.11.94.0/24 | AS35985 |
| Oct 14, 01:43 UTC | 60 | 116.89.241.0/24 | AS150706 |
| Oct 14, 01:43 UTC | 60 | 91.123.178.0/24 | AS51648 |
| Oct 14, 01:43 UTC | 60 | 156.154.128.0/24 | AS12008 |
| Oct 14, 01:43 UTC | 80 | 103.243.24.0/22 | AS55933 |
| Oct 14, 01:43 UTC | 60 | 208.0.80.0/20 | AS174 |
| Oct 14, 01:43 UTC | 60 | 134.132.52.0/22 | AS22717 |
| Oct 14, 01:43 UTC | 60 | 208.93.96.0/23 | AS19709 |
| Oct 14, 01:43 UTC | 60 | 23.19.52.0/24 | AS205544 |
| Oct 14, 01:43 UTC | 60 | 95.27.208.0/23 | AS34038 |
| Oct 14, 01:43 UTC | 60 | 192.82.134.0/24 | AS396549 |
| Oct 14, 01:43 UTC | 60 | 95.30.7.0/24 | AS34038 |
| Oct 14, 01:43 UTC | 60 | 195.200.84.0/24 | AS34343 |
| Oct 14, 01:43 UTC | 60 | 103.217.163.0/24 | AS41095 |
| Oct 14, 01:43 UTC | 70 | 196.28.42.0/24 | AS5713 |
| Oct 14, 01:43 UTC | 70 | 212.115.162.0/24 | AS3257 |
| Oct 14, 01:43 UTC | 60 | 52.82.166.0/24 | AS9808 |
| Oct 14, 01:43 UTC | 60 | 43.240.192.0/22 | AS4812 |
| Oct 14, 01:43 UTC | 60 | 147.242.100.0/22 | AS5277 |
| Oct 14, 01:43 UTC | 70 | 90.168.252.0/24 | AS12479 |
| Oct 14, 01:43 UTC | 60 | 120.136.16.0/24 | AS4847 |
| Oct 14, 01:43 UTC | 60 | 185.242.175.0/24 | AS8903 |
| Oct 14, 01:43 UTC | 60 | 110.43.64.0/20 | AS23724 |
| Oct 14, 01:43 UTC | 60 | 216.145.222.0/24 | AS30031 |
| Oct 14, 01:43 UTC | 70 | 87.81.251.0/24 | AS54113 |
| Oct 14, 01:43 UTC | 60 | 106.75.176.0/20 | AS58466 |
| Oct 14, 01:43 UTC | 60 | 89.40.238.0/24 | AS200845 |
| Oct 14, 01:43 UTC | 60 | 192.68.126.0/24 | AS19836 |
| Oct 14, 01:43 UTC | 60 | 102.164.80.0/20 | AS328315 |
| Oct 14, 01:43 UTC | 60 | 208.22.128.0/18 | AS11404 |
| Oct 14, 01:43 UTC | 60 | 156.225.24.0/21 | AS401701 |
| Oct 14, 01:43 UTC | 70 | 154.64.59.0/24 | AS271493 |
| Oct 14, 01:43 UTC | 60 | 103.222.41.0/24 | AS138421 |
| Oct 14, 01:43 UTC | 60 | 34.190.248.0/21 | AS43515 |
| Oct 14, 01:43 UTC | 60 | 69.5.248.0/24 | AS47030 |
| Oct 14, 01:43 UTC | 60 | 168.92.0.0/19 | AS16399 |
| Oct 14, 01:43 UTC | 60 | 83.243.16.0/21 | AS31216 |
| Oct 14, 01:43 UTC | 60 | 117.50.160.0/19 | AS23724 |
| Oct 14, 01:43 UTC | 60 | 185.114.236.0/24 | AS57866 |
| Oct 14, 01:43 UTC | 60 | 38.100.44.0/22 | AS6405 |
| Oct 14, 01:43 UTC | 60 | 50.118.226.0/24 | AS5511 |
| Oct 14, 01:43 UTC | 60 | 122.11.40.0/21 | AS23724 |
| Oct 14, 01:43 UTC | 60 | 192.42.93.0/24 | AS36631 |
| Oct 14, 01:43 UTC | 60 | 38.203.0.0/22 | AS9009 |
| Oct 14, 01:43 UTC | 60 | 38.95.160.0/24 | AS174 |
| Oct 14, 01:43 UTC | 60 | 192.100.224.0/23 | AS12008 |
| Oct 14, 01:43 UTC | 60 | 84.44.64.0/19 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 23.19.197.0/24 | AS28753 |
| Oct 14, 01:43 UTC | 60 | 122.200.92.0/24 | AS4847 |
| Oct 14, 01:43 UTC | 60 | 45.88.1.0/24 | AS200313 |
| Oct 14, 01:43 UTC | 60 | 34.0.236.0/23 | AS19527 |
| Oct 14, 01:43 UTC | 60 | 43.254.64.0/24 | AS4515 |
| Oct 14, 01:43 UTC | 60 | 195.170.185.0/24 | AS41699 |
| Oct 14, 01:43 UTC | 60 | 119.16.72.0/21 | AS137718 |
| Oct 14, 01:43 UTC | 60 | 138.226.192.0/21 | AS33651 |
| Oct 14, 01:43 UTC | 70 | 103.165.252.0/24 | AS151521 |
| Oct 14, 01:43 UTC | 60 | 177.74.156.0/24 | AS263650 |
| Oct 14, 01:43 UTC | 60 | 103.102.132.0/24 | AS9009 |
| Oct 14, 01:43 UTC | 70 | 95.16.172.0/22 | AS12479 |
| Oct 14, 01:43 UTC | 60 | 154.223.134.0/23 | AS13335 |
| Oct 14, 01:43 UTC | 60 | 185.165.123.0/24 | AS60922 |
| Oct 14, 01:43 UTC | 60 | 54.222.53.0/24 | AS23724 |
| Oct 14, 01:43 UTC | 60 | 149.100.8.0/24 | AS174 |
| Oct 14, 01:43 UTC | 60 | 101.33.188.0/22 | AS132203 |
| Oct 14, 01:43 UTC | 70 | 192.58.128.0/24 | AS396748 |
| Oct 14, 01:43 UTC | 60 | 201.50.114.0/24 | AS214833 |
| Oct 14, 01:43 UTC | 60 | 145.40.78.0/24 | AS15830 |
| Oct 14, 01:43 UTC | 60 | 81.180.71.0/24 | AS9199 |
| Oct 14, 01:43 UTC | 60 | 63.223.17.0/24 | AS31713 |
| Oct 14, 01:43 UTC | 60 | 35.206.10.0/23 | AS43515 |
| Oct 14, 01:43 UTC | 60 | 185.135.19.0/24 | AS28889 |
| Oct 14, 01:43 UTC | 60 | 212.154.128.0/19 | AS50482 |
| Oct 14, 01:43 UTC | 60 | 62.244.225.0/24 | AS15924 |
| Oct 14, 01:43 UTC | 60 | 120.92.232.0/23 | AS4811 |
| Oct 14, 01:43 UTC | 60 | 124.251.228.0/22 | AS9308 |
| Oct 14, 01:43 UTC | 60 | 107.158.7.0/24 | AS33651 |
| Oct 14, 01:43 UTC | 60 | 104.153.111.0/24 | AS401263 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-10-14 01:55 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
