Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
11,054
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 11,054 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Aug 29, 21:38 UTC | 60 | 177.4.88.0/24 | AS137535 |
| Aug 29, 21:38 UTC | 60 | 197.93.149.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 89.130.128.0/22 | AS12479 |
| Aug 29, 21:38 UTC | 60 | 45.249.215.0/24 | AS134543 |
| Aug 29, 21:38 UTC | 60 | 147.28.186.0/23 | AS15830 |
| Aug 29, 21:38 UTC | 60 | 121.251.16.0/21 | AS24362 |
| Aug 29, 21:38 UTC | 60 | 43.247.88.0/22 | AS138950 |
| Aug 29, 21:38 UTC | 60 | 45.12.82.0/24 | AS152672 |
| Aug 29, 21:38 UTC | 60 | 192.30.38.0/23 | AS63081 |
| Aug 29, 21:38 UTC | 70 | 120.136.184.0/24 | AS4812 |
| Aug 29, 21:38 UTC | 60 | 91.199.242.0/24 | AS44788 |
| Aug 29, 21:38 UTC | 60 | 121.58.156.0/23 | AS4847 |
| Aug 29, 21:38 UTC | 60 | 34.3.20.0/22 | AS43515 |
| Aug 29, 21:38 UTC | 60 | 213.248.222.0/24 | AS43519 |
| Aug 29, 21:38 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 70 | 192.82.134.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 222.126.184.0/23 | AS7468 |
| Aug 29, 21:38 UTC | 60 | 80.84.158.0/23 | AS21057 |
| Aug 29, 21:38 UTC | 60 | 204.74.106.0/23 | AS399159 |
| Aug 29, 21:38 UTC | 60 | 152.65.226.0/24 | AS19527 |
| Aug 29, 21:38 UTC | 60 | 170.10.142.0/24 | AS42427 |
| Aug 29, 21:38 UTC | 70 | 123.103.13.0/24 | AS23724 |
| Aug 29, 21:38 UTC | 70 | 103.141.9.0/24 | AS139296 |
| Aug 29, 21:38 UTC | 60 | 34.2.92.0/23 | AS15169 |
| Aug 29, 21:38 UTC | 60 | 200.198.75.0/24 | AS10429 |
| Aug 29, 21:38 UTC | 60 | 146.127.224.0/20 | AS6303 |
| Aug 29, 21:38 UTC | 60 | 45.61.171.0/24 | AS213122 |
| Aug 29, 21:38 UTC | 60 | 14.103.208.0/21 | AS4811 |
| Aug 29, 21:38 UTC | 60 | 200.219.159.0/24 | AS14650 |
| Aug 29, 21:38 UTC | 60 | 185.238.0.0/24 | AS200313 |
| Aug 29, 21:38 UTC | 70 | 192.42.176.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 200.220.193.0/24 | AS262589 |
| Aug 29, 21:38 UTC | 60 | 35.213.192.0/18 | AS19527 |
| Aug 29, 21:38 UTC | 60 | 62.151.16.0/20 | AS12479 |
| Aug 29, 21:38 UTC | 60 | 223.196.28.0/24 | AS55410 |
| Aug 29, 21:38 UTC | 60 | 200.153.0.0/17 | AS10429 |
| Aug 29, 21:38 UTC | 60 | 202.112.42.0/24 | AS4538 |
| Aug 29, 21:38 UTC | 60 | 192.42.175.0/24 | AS19836 |
| Aug 29, 21:38 UTC | 60 | 103.201.200.0/24 | AS134773 |
| Aug 29, 21:38 UTC | 60 | 34.3.48.0/22 | AS43515 |
| Aug 29, 21:38 UTC | 60 | 192.42.173.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 177.3.94.0/24 | AS137535 |
| Aug 29, 21:38 UTC | 60 | 85.51.168.0/22 | AS12479 |
| Aug 29, 21:38 UTC | 60 | 192.12.94.0/24 | AS396549 |
| Aug 29, 21:38 UTC | 60 | 178.249.12.0/22 | AS21057 |
| Aug 29, 21:38 UTC | 60 | 45.249.212.0/22 | AS134772 |
| Aug 29, 21:38 UTC | 60 | 37.135.0.0/16 | AS12479 |
| Aug 29, 21:38 UTC | 60 | 211.99.188.0/23 | AS9308 |
| Aug 29, 21:38 UTC | 60 | 114.198.168.0/21 | AS24163 |
| Aug 29, 21:38 UTC | 60 | 57.140.209.0/24 | AS15169 |
| Aug 29, 21:38 UTC | 60 | 204.239.152.0/22 | AS393966 |
| Aug 29, 21:38 UTC | 60 | 80.66.121.0/24 | AS8903 |
| Aug 29, 21:38 UTC | 60 | 57.140.240.0/24 | AS19527 |
| Aug 29, 21:38 UTC | 60 | 120.133.128.0/20 | AS58466 |
| Aug 29, 21:38 UTC | 70 | 101.124.22.0/24 | AS23724 |
| Aug 29, 21:38 UTC | 60 | 141.193.37.0/24 | AS6169 |
| Aug 29, 21:38 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 29, 21:38 UTC | 60 | 139.9.144.0/20 | AS58519 |
| Aug 29, 21:38 UTC | 70 | 161.49.74.0/24 | AS65002 |
| Aug 29, 21:38 UTC | 60 | 103.85.87.0/24 | AS131483 |
| Aug 29, 21:38 UTC | 60 | 155.130.152.0/24 | AS23005 |
| Aug 29, 21:38 UTC | 60 | 161.129.47.0/24 | AS213122 |
| Aug 29, 21:38 UTC | 60 | 223.196.17.0/24 | AS55410 |
| Aug 29, 21:38 UTC | 60 | 120.92.16.0/21 | AS59019 |
| Aug 29, 21:38 UTC | 60 | 192.33.14.0/24 | AS396748 |
| Aug 29, 21:38 UTC | 60 | 181.41.222.0/23 | AS61317 |
| Aug 29, 21:38 UTC | 60 | 190.53.47.0/24 | AS263201 |
| Aug 29, 21:38 UTC | 70 | 192.54.112.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 35.216.0.0/17 | AS19527 |
| Aug 29, 21:38 UTC | 60 | 194.149.70.0/23 | AS12389 |
| Aug 29, 21:38 UTC | 60 | 199.7.71.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 70 | 117.122.241.0/24 | AS4847 |
| Aug 29, 21:38 UTC | 60 | 177.4.94.0/23 | AS137535 |
| Aug 29, 21:38 UTC | 60 | 213.9.190.0/23 | AS8903 |
| Aug 29, 21:38 UTC | 60 | 187.86.10.0/24 | AS28135 |
| Aug 29, 21:38 UTC | 60 | 217.19.32.0/20 | AS15702 |
| Aug 29, 21:38 UTC | 60 | 201.28.0.0/18 | AS10429 |
| Aug 29, 21:38 UTC | 60 | 192.34.234.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 189.39.185.0/24 | AS270792 |
| Aug 29, 21:38 UTC | 60 | 83.143.228.0/22 | AS5631 |
| Aug 29, 21:38 UTC | 60 | 212.163.235.0/24 | AS8903 |
| Aug 29, 21:38 UTC | 60 | 144.250.22.0/24 | AS7046 |
| Aug 29, 21:38 UTC | 60 | 202.90.108.0/22 | AS4811 |
| Aug 29, 21:38 UTC | 70 | 103.154.65.0/24 | AS139043 |
| Aug 29, 21:38 UTC | 70 | 41.60.150.0/23 | AS37006 |
| Aug 29, 21:38 UTC | 60 | 113.31.160.0/20 | AS4811 |
| Aug 29, 21:38 UTC | 60 | 107.6.119.0/24 | AS14636 |
| Aug 29, 21:38 UTC | 60 | 205.172.96.0/21 | AS10753 |
| Aug 29, 21:38 UTC | 60 | 110.43.152.0/21 | AS4811 |
| Aug 29, 21:38 UTC | 60 | 121.4.4.0/22 | AS45090 |
| Aug 29, 21:38 UTC | 60 | 197.89.130.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 81.19.195.0/24 | AS396555 |
| Aug 29, 21:38 UTC | 60 | 69.171.154.0/24 | AS11814 |
| Aug 29, 21:38 UTC | 60 | 34.1.81.0/24 | AS43515 |
| Aug 29, 21:38 UTC | 60 | 200.125.130.0/24 | AS27947 |
| Aug 29, 21:38 UTC | 60 | 190.90.24.0/24 | AS18678 |
| Aug 29, 21:38 UTC | 60 | 154.197.80.0/24 | AS17561 |
| Aug 29, 21:38 UTC | 60 | 200.220.202.0/24 | AS22381 |
| Aug 29, 21:38 UTC | 60 | 120.133.240.0/22 | AS17428 |
| Aug 29, 21:38 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 35.207.0.0/18 | AS43515 |
| Aug 29, 21:38 UTC | 60 | 197.93.134.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 202.57.201.0/24 | AS4812 |
| Aug 29, 21:38 UTC | 70 | 156.233.232.0/22 | AS401701 |
| Aug 29, 21:38 UTC | 60 | 192.184.68.0/24 | AS14618 |
| Aug 29, 21:38 UTC | 60 | 177.4.93.0/24 | AS137535 |
| Aug 29, 21:38 UTC | 60 | 170.10.142.0/24 | AS42427 |
| Aug 29, 21:38 UTC | 60 | 199.7.71.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 87.240.166.0/24 | AS47541 |
| Aug 29, 21:38 UTC | 60 | 43.227.140.0/22 | AS4847 |
| Aug 29, 21:38 UTC | 60 | 89.31.65.0/24 | AS198131 |
| Aug 29, 21:38 UTC | 60 | 121.190.174.0/24 | AS23591 |
| Aug 29, 21:38 UTC | 60 | 45.116.32.0/24 | AS58466 |
| Aug 29, 21:38 UTC | 60 | 90.162.48.0/20 | AS12479 |
| Aug 29, 21:38 UTC | 60 | 120.92.10.0/23 | AS59019 |
| Aug 29, 21:38 UTC | 60 | 45.248.202.0/23 | AS41095 |
| Aug 29, 21:38 UTC | 60 | 79.181.160.0/20 | AS8551 |
| Aug 29, 21:38 UTC | 60 | 212.163.227.0/24 | AS8903 |
| Aug 29, 21:38 UTC | 60 | 43.231.103.0/24 | AS4816 |
| Aug 29, 21:38 UTC | 60 | 202.168.160.0/19 | AS17816 |
| Aug 29, 21:38 UTC | 70 | 103.56.77.0/24 | AS58466 |
| Aug 29, 21:38 UTC | 60 | 34.1.192.0/20 | AS15169 |
| Aug 29, 21:38 UTC | 60 | 120.133.236.0/24 | AS4811 |
| Aug 29, 21:38 UTC | 60 | 121.251.88.0/21 | AS24362 |
| Aug 29, 21:38 UTC | 60 | 197.89.168.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 63.223.64.0/18 | AS31713 |
| Aug 29, 21:38 UTC | 60 | 103.103.247.0/24 | AS62610 |
| Aug 29, 21:38 UTC | 60 | 197.89.61.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 70 | 192.42.176.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 29, 21:38 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 29, 21:38 UTC | 60 | 71.18.162.0/24 | AS396986 |
| Aug 29, 21:38 UTC | 60 | 80.174.160.0/24 | AS197646 |
| Aug 29, 21:38 UTC | 60 | 216.168.228.0/24 | AS19836 |
| Aug 29, 21:38 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 147.28.188.0/24 | AS15830 |
| Aug 29, 21:38 UTC | 60 | 34.191.24.0/21 | AS43515 |
| Aug 29, 21:38 UTC | 60 | 204.225.223.0/24 | AS41625 |
| Aug 29, 21:38 UTC | 60 | 199.4.18.0/24 | AS17044 |
| Aug 29, 21:38 UTC | 60 | 192.42.178.0/24 | AS396566 |
| Aug 29, 21:38 UTC | 60 | 45.9.233.0/24 | AS5588 |
| Aug 29, 21:38 UTC | 60 | 197.89.255.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 70 | 106.3.136.0/21 | AS23724 |
| Aug 29, 21:38 UTC | 70 | 38.19.48.0/24 | AS274697 |
| Aug 29, 21:38 UTC | 80 | 38.102.235.0/24 | AS152672 |
| Aug 29, 21:38 UTC | 70 | 175.102.134.0/24 | AS4811 |
| Aug 29, 21:38 UTC | 60 | 63.217.87.0/24 | AS31713 |
| Aug 29, 21:38 UTC | 80 | 139.162.251.130/32 | AS63949 |
| Aug 29, 21:38 UTC | 60 | 213.9.224.0/20 | AS8903 |
| Aug 29, 21:38 UTC | 60 | 34.0.0.0/15 | AS15169 |
| Aug 29, 21:38 UTC | 60 | 38.211.254.0/24 | AS274248 |
| Aug 29, 21:38 UTC | 60 | 202.177.157.0/24 | AS132215 |
| Aug 29, 21:38 UTC | 60 | 63.219.0.0/20 | AS31713 |
| Aug 29, 21:38 UTC | 60 | 192.35.51.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 185.202.100.0/22 | AS205960 |
| Aug 29, 21:38 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 29, 21:38 UTC | 60 | 192.68.130.0/24 | AS396549 |
| Aug 29, 21:38 UTC | 60 | 121.78.141.0/24 | AS9957 |
| Aug 29, 21:38 UTC | 60 | 199.5.64.0/18 | AS10753 |
| Aug 29, 21:38 UTC | 60 | 194.156.162.0/23 | AS23961 |
| Aug 29, 21:38 UTC | 80 | 192.82.134.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 177.3.91.0/24 | AS137535 |
| Aug 29, 21:38 UTC | 60 | 211.148.22.0/24 | AS17428 |
| Aug 29, 21:38 UTC | 60 | 58.68.236.0/24 | AS4847 |
| Aug 29, 21:38 UTC | 60 | 45.172.126.0/24 | AS28598 |
| Aug 29, 21:38 UTC | 60 | 185.151.204.0/24 | AS205184 |
| Aug 29, 21:38 UTC | 60 | 192.55.83.0/24 | AS396566 |
| Aug 29, 21:38 UTC | 60 | 204.145.245.0/24 | AS33651 |
| Aug 29, 21:38 UTC | 70 | 198.41.0.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 202.112.49.0/24 | AS4538 |
| Aug 29, 21:38 UTC | 70 | 82.115.63.0/24 | AS205516 |
| Aug 29, 21:38 UTC | 60 | 185.245.200.0/24 | AS207316 |
| Aug 29, 21:38 UTC | 60 | 5.100.152.0/22 | AS31898 |
| Aug 29, 21:38 UTC | 60 | 156.243.148.0/23 | AS328608 |
| Aug 29, 21:38 UTC | 60 | 63.222.106.0/24 | AS31713 |
| Aug 29, 21:38 UTC | 60 | 197.89.56.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 197.93.133.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 70 | 154.50.121.0/24 | AS133255 |
| Aug 29, 21:38 UTC | 60 | 142.248.139.0/24 | AS137535 |
| Aug 29, 21:38 UTC | 70 | 103.150.60.0/24 | AS140389 |
| Aug 29, 21:38 UTC | 70 | 209.112.127.0/24 | AS397197 |
| Aug 29, 21:38 UTC | 60 | 193.138.220.0/24 | AS34343 |
| Aug 29, 21:38 UTC | 60 | 122.14.149.0/24 | AS56082 |
| Aug 29, 21:38 UTC | 60 | 93.186.68.0/24 | AS9125 |
| Aug 29, 21:38 UTC | 60 | 161.232.19.0/24 | AS207266 |
| Aug 29, 21:38 UTC | 70 | 193.200.96.0/23 | AS12741 |
| Aug 29, 21:38 UTC | 60 | 34.4.16.0/22 | AS43515 |
| Aug 29, 21:38 UTC | 60 | 213.9.128.0/24 | AS8903 |
| Aug 29, 21:38 UTC | 60 | 81.2.187.0/24 | AS209784 |
| Aug 29, 21:38 UTC | 60 | 197.93.188.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 197.89.218.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 2.27.196.0/22 | AS400402 |
| Aug 29, 21:38 UTC | 60 | 154.214.219.0/24 | AS328608 |
| Aug 29, 21:38 UTC | 70 | 62.217.23.0/24 | AS5065 |
| Aug 29, 21:38 UTC | 60 | 197.89.137.0/24 | AS20011 |
| Aug 29, 21:38 UTC | 60 | 192.82.133.0/24 | AS19836 |
| Aug 29, 21:38 UTC | 60 | 192.42.175.0/24 | AS19836 |
| Aug 29, 21:38 UTC | 60 | 211.152.96.0/23 | AS9308 |
| Aug 29, 21:38 UTC | 60 | 192.31.80.0/24 | AS396549 |
| Aug 29, 21:38 UTC | 60 | 192.42.173.0/24 | AS397197 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-29 21:45 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
