Pulse — Sudden withdrawal event
ASNs whose active prefix count dropped by ≥50% in the last hour vs. the 1–7h baseline — outages, DDoS-blackhole, route leak fallout.
What is Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Geographic distribution
Flagged events
Showing 200 most recent of 3,176 · last 24h| When | Severity | Prefix | AS |
|---|---|---|---|
| Aug 30, 10:09 UTC | 80 | * | AS45459 |
| Aug 30, 10:09 UTC | 70 | * | AS264617 |
| Aug 30, 10:09 UTC | 80 | * | AS136255 |
| Aug 30, 10:09 UTC | 80 | * | AS16637 |
| Aug 30, 10:09 UTC | 70 | * | AS17539 |
| Aug 30, 10:09 UTC | 70 | * | AS26311 |
| Aug 30, 10:09 UTC | 80 | * | AS59362 |
| Aug 30, 10:09 UTC | 80 | * | AS17119 |
| Aug 30, 10:09 UTC | 80 | * | AS205025 |
| Aug 30, 10:09 UTC | 70 | * | AS153038 |
| Aug 30, 10:09 UTC | 80 | * | AS328191 |
| Aug 30, 10:09 UTC | 70 | * | AS19740 |
| Aug 30, 10:09 UTC | 80 | * | AS207459 |
| Aug 30, 10:09 UTC | 70 | * | AS48737 |
| Aug 30, 10:09 UTC | 70 | * | AS21527 |
| Aug 30, 10:09 UTC | 80 | * | AS53813 |
| Aug 30, 10:09 UTC | 80 | * | AS201678 |
| Aug 30, 10:09 UTC | 80 | * | AS28909 |
| Aug 30, 10:09 UTC | 80 | * | AS262256 |
| Aug 30, 10:09 UTC | 80 | * | AS20649 |
| Aug 30, 10:09 UTC | 80 | * | AS196954 |
| Aug 30, 10:09 UTC | 80 | * | AS9541 |
| Aug 30, 10:09 UTC | 70 | * | AS24556 |
| Aug 30, 10:09 UTC | 70 | * | AS42428 |
| Aug 30, 10:09 UTC | 70 | * | AS5087 |
| Aug 30, 10:09 UTC | 80 | * | AS2734 |
| Aug 30, 10:09 UTC | 80 | * | AS44947 |
| Aug 30, 10:09 UTC | 90 | * | AS18059 |
| Aug 30, 10:09 UTC | 80 | * | AS38513 |
| Aug 30, 10:09 UTC | 70 | * | AS45960 |
| Aug 30, 10:09 UTC | 70 | * | AS36958 |
| Aug 30, 10:09 UTC | 80 | * | AS132347 |
| Aug 30, 10:09 UTC | 80 | * | AS6939 |
| Aug 30, 10:09 UTC | 80 | * | AS7821 |
| Aug 30, 10:09 UTC | 70 | * | AS22006 |
| Aug 30, 10:09 UTC | 80 | * | AS22168 |
| Aug 30, 10:09 UTC | 70 | * | AS43289 |
| Aug 30, 10:09 UTC | 80 | * | AS32694 |
| Aug 30, 10:09 UTC | 70 | * | AS61468 |
| Aug 30, 10:09 UTC | 80 | * | AS18450 |
| Aug 30, 10:09 UTC | 70 | * | AS216300 |
| Aug 30, 10:09 UTC | 70 | * | AS32329 |
| Aug 30, 10:09 UTC | 80 | * | AS38932 |
| Aug 30, 10:09 UTC | 70 | * | AS42868 |
| Aug 30, 10:09 UTC | 70 | * | AS133606 |
| Aug 30, 10:09 UTC | 70 | * | AS209847 |
| Aug 30, 10:09 UTC | 80 | * | AS131293 |
| Aug 30, 10:09 UTC | 80 | * | AS15267 |
| Aug 30, 10:09 UTC | 80 | * | AS20141 |
| Aug 30, 10:09 UTC | 80 | * | AS29787 |
| Aug 30, 10:09 UTC | 80 | * | AS45634 |
| Aug 30, 10:09 UTC | 80 | * | AS141031 |
| Aug 30, 10:09 UTC | 70 | * | AS20598 |
| Aug 30, 10:09 UTC | 80 | * | AS72 |
| Aug 30, 10:09 UTC | 80 | * | AS134146 |
| Aug 30, 10:09 UTC | 80 | * | AS5384 |
| Aug 30, 10:09 UTC | 80 | * | AS202024 |
| Aug 30, 10:09 UTC | 70 | * | AS55699 |
| Aug 30, 10:09 UTC | 70 | * | AS557 |
| Aug 30, 10:09 UTC | 70 | * | AS48728 |
| Aug 30, 10:09 UTC | 70 | * | AS22423 |
| Aug 30, 10:09 UTC | 70 | * | AS57844 |
| Aug 30, 10:09 UTC | 70 | * | AS18422 |
| Aug 30, 10:09 UTC | 70 | * | AS24187 |
| Aug 30, 10:09 UTC | 80 | * | AS29802 |
| Aug 30, 10:09 UTC | 80 | * | AS396338 |
| Aug 30, 10:09 UTC | 80 | * | AS30549 |
| Aug 30, 10:09 UTC | 70 | * | AS133524 |
| Aug 30, 10:09 UTC | 90 | * | AS54483 |
| Aug 30, 10:09 UTC | 80 | * | AS61996 |
| Aug 30, 10:09 UTC | 90 | * | AS7642 |
| Aug 30, 10:09 UTC | 70 | * | AS41275 |
| Aug 30, 10:09 UTC | 70 | * | AS24389 |
| Aug 30, 10:09 UTC | 70 | * | AS152698 |
| Aug 30, 10:09 UTC | 80 | * | AS55685 |
| Aug 30, 10:09 UTC | 70 | * | AS63888 |
| Aug 30, 10:09 UTC | 70 | * | AS45754 |
| Aug 30, 10:09 UTC | 70 | * | AS36963 |
| Aug 30, 10:09 UTC | 70 | * | AS1241 |
| Aug 30, 10:09 UTC | 80 | * | AS48424 |
| Aug 30, 10:09 UTC | 70 | * | AS139009 |
| Aug 30, 10:09 UTC | 70 | * | AS41484 |
| Aug 30, 10:09 UTC | 70 | * | AS23949 |
| Aug 30, 10:09 UTC | 70 | * | AS14010 |
| Aug 30, 10:09 UTC | 70 | * | AS138640 |
| Aug 30, 10:09 UTC | 80 | * | AS132298 |
| Aug 30, 10:09 UTC | 80 | * | AS19605 |
| Aug 30, 10:09 UTC | 70 | * | AS24523 |
| Aug 30, 10:09 UTC | 90 | * | AS9943 |
| Aug 30, 10:09 UTC | 80 | * | AS29667 |
| Aug 30, 10:09 UTC | 80 | * | AS200000 |
| Aug 30, 10:09 UTC | 80 | * | AS23678 |
| Aug 30, 10:09 UTC | 80 | * | AS56030 |
| Aug 30, 10:09 UTC | 70 | * | AS30325 |
| Aug 30, 10:09 UTC | 80 | * | AS58404 |
| Aug 30, 10:09 UTC | 70 | * | AS41079 |
| Aug 30, 10:09 UTC | 80 | * | AS38200 |
| Aug 30, 10:09 UTC | 70 | * | AS53340 |
| Aug 30, 10:09 UTC | 70 | * | AS26554 |
| Aug 30, 10:09 UTC | 70 | * | AS17210 |
| Aug 30, 10:09 UTC | 80 | * | AS43533 |
| Aug 30, 10:09 UTC | 80 | * | AS23884 |
| Aug 30, 10:09 UTC | 70 | * | AS24432 |
| Aug 30, 10:09 UTC | 70 | * | AS22667 |
| Aug 30, 10:09 UTC | 80 | * | AS11666 |
| Aug 30, 10:09 UTC | 70 | * | AS37154 |
| Aug 30, 10:09 UTC | 70 | * | AS49699 |
| Aug 30, 10:09 UTC | 80 | * | AS53755 |
| Aug 30, 10:09 UTC | 90 | * | AS269782 |
| Aug 30, 10:09 UTC | 70 | * | AS8262 |
| Aug 30, 10:09 UTC | 80 | * | AS30569 |
| Aug 30, 10:09 UTC | 70 | * | AS141968 |
| Aug 30, 10:09 UTC | 80 | * | AS9335 |
| Aug 30, 10:09 UTC | 70 | * | AS40511 |
| Aug 30, 10:09 UTC | 80 | * | AS27501 |
| Aug 30, 10:09 UTC | 70 | * | AS48917 |
| Aug 30, 10:09 UTC | 70 | * | AS48452 |
| Aug 30, 10:09 UTC | 90 | * | AS29582 |
| Aug 30, 10:09 UTC | 80 | * | AS39120 |
| Aug 30, 10:09 UTC | 70 | * | AS16698 |
| Aug 30, 10:09 UTC | 70 | * | AS56167 |
| Aug 30, 10:09 UTC | 80 | * | AS396420 |
| Aug 30, 10:09 UTC | 70 | * | AS393278 |
| Aug 30, 10:09 UTC | 80 | * | AS12990 |
| Aug 30, 10:09 UTC | 80 | * | AS44851 |
| Aug 30, 10:09 UTC | 80 | * | AS63859 |
| Aug 30, 10:09 UTC | 80 | * | AS328442 |
| Aug 30, 10:09 UTC | 70 | * | AS36295 |
| Aug 30, 10:09 UTC | 80 | * | AS197897 |
| Aug 30, 10:09 UTC | 80 | * | AS43372 |
| Aug 30, 10:09 UTC | 80 | * | AS38325 |
| Aug 30, 10:09 UTC | 80 | * | AS51918 |
| Aug 30, 10:09 UTC | 70 | * | AS393950 |
| Aug 30, 10:09 UTC | 70 | * | AS4314 |
| Aug 30, 10:09 UTC | 90 | * | AS135478 |
| Aug 30, 10:09 UTC | 80 | * | AS40918 |
| Aug 30, 10:09 UTC | 70 | * | AS139820 |
| Aug 30, 10:09 UTC | 70 | * | AS201814 |
| Aug 30, 10:09 UTC | 80 | * | AS206991 |
| Aug 30, 10:09 UTC | 80 | * | AS262437 |
| Aug 30, 10:09 UTC | 80 | * | AS23422 |
| Aug 30, 10:09 UTC | 80 | * | AS43885 |
| Aug 30, 10:09 UTC | 70 | * | AS52129 |
| Aug 30, 10:09 UTC | 80 | * | AS23465 |
| Aug 30, 10:09 UTC | 70 | * | AS37410 |
| Aug 30, 10:09 UTC | 80 | * | AS48956 |
| Aug 30, 10:09 UTC | 80 | * | AS197033 |
| Aug 30, 10:09 UTC | 80 | * | AS45117 |
| Aug 30, 10:09 UTC | 70 | * | AS18988 |
| Aug 30, 10:09 UTC | 70 | * | AS31863 |
| Aug 30, 10:09 UTC | 70 | * | AS40020 |
| Aug 30, 10:09 UTC | 70 | * | AS22898 |
| Aug 30, 10:09 UTC | 70 | * | AS45245 |
| Aug 30, 10:09 UTC | 80 | * | AS25211 |
| Aug 30, 10:09 UTC | 80 | * | AS56690 |
| Aug 30, 10:09 UTC | 80 | * | AS55201 |
| Aug 30, 10:09 UTC | 80 | * | AS200239 |
| Aug 30, 10:09 UTC | 80 | * | AS146834 |
| Aug 30, 10:09 UTC | 70 | * | AS58821 |
| Aug 30, 10:09 UTC | 80 | * | AS45007 |
| Aug 30, 10:09 UTC | 80 | * | AS18001 |
| Aug 30, 10:09 UTC | 80 | * | AS397477 |
| Aug 30, 10:09 UTC | 80 | * | AS35530 |
| Aug 30, 10:09 UTC | 70 | * | AS6653 |
| Aug 30, 10:09 UTC | 70 | * | AS11096 |
| Aug 30, 10:09 UTC | 80 | * | AS132300 |
| Aug 30, 10:09 UTC | 70 | * | AS5758 |
| Aug 30, 10:09 UTC | 70 | * | AS134809 |
| Aug 30, 10:09 UTC | 70 | * | AS4049 |
| Aug 30, 10:09 UTC | 70 | * | AS33635 |
| Aug 30, 10:09 UTC | 70 | * | AS395111 |
| Aug 30, 10:09 UTC | 80 | * | AS137331 |
| Aug 30, 10:09 UTC | 80 | * | AS36374 |
| Aug 30, 10:09 UTC | 80 | * | AS12208 |
| Aug 30, 10:09 UTC | 70 | * | AS18526 |
| Aug 30, 10:09 UTC | 70 | * | AS29831 |
| Aug 30, 10:09 UTC | 80 | * | AS133613 |
| Aug 30, 10:09 UTC | 70 | * | AS9326 |
| Aug 30, 10:09 UTC | 80 | * | AS34605 |
| Aug 30, 10:09 UTC | 80 | * | AS395567 |
| Aug 30, 10:09 UTC | 70 | * | AS131207 |
| Aug 30, 10:09 UTC | 80 | * | AS394720 |
| Aug 30, 10:09 UTC | 80 | * | AS10242 |
| Aug 30, 10:09 UTC | 80 | * | AS134204 |
| Aug 30, 10:09 UTC | 80 | * | AS25147 |
| Aug 30, 10:09 UTC | 80 | * | AS38235 |
| Aug 30, 10:09 UTC | 80 | * | AS61942 |
| Aug 30, 10:09 UTC | 70 | * | AS40948 |
| Aug 30, 10:09 UTC | 80 | * | AS58717 |
| Aug 30, 10:09 UTC | 80 | * | AS24088 |
| Aug 30, 10:09 UTC | 90 | * | AS34619 |
| Aug 30, 10:09 UTC | 80 | * | AS16700 |
| Aug 30, 10:09 UTC | 70 | * | AS36100 |
| Aug 30, 10:09 UTC | 70 | * | AS208909 |
| Aug 30, 10:09 UTC | 70 | * | AS56246 |
| Aug 30, 10:09 UTC | 90 | * | AS58369 |
| Aug 30, 10:09 UTC | 70 | * | AS401307 |
| Aug 30, 10:09 UTC | 70 | * | AS24323 |
| Aug 30, 10:09 UTC | 80 | * | AS28885 |
| Aug 30, 10:09 UTC | 80 | * | AS8517 |
Frequently Asked Questions
What is a BGP Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the Sudden withdrawal event feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-30 10:20 UTC.
How do I subscribe to Sudden withdrawal event events?
Subscribe to the Atom feed at /pulse/bgp/withdrawal.atom or poll the JSON endpoint at /api/pulse/bgp/withdrawal.