Pulse — Sudden withdrawal event
ASNs whose active prefix count dropped by ≥50% in the last hour vs. the 1–7h baseline — outages, DDoS-blackhole, route leak fallout.
What is Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Geographic distribution
Flagged events
Showing 200 most recent of 3,127 · last 24h| When | Severity | Prefix | AS |
|---|---|---|---|
| Aug 31, 13:39 UTC | 80 | * | AS269018 |
| Aug 31, 13:39 UTC | 80 | * | AS202161 |
| Aug 31, 13:39 UTC | 80 | * | AS52977 |
| Aug 31, 13:39 UTC | 80 | * | AS265142 |
| Aug 31, 13:39 UTC | 80 | * | AS32524 |
| Aug 31, 13:39 UTC | 80 | * | AS268280 |
| Aug 31, 13:39 UTC | 70 | * | AS43338 |
| Aug 31, 13:39 UTC | 70 | * | AS9751 |
| Aug 31, 13:39 UTC | 70 | * | AS263853 |
| Aug 31, 13:39 UTC | 70 | * | AS54201 |
| Aug 31, 13:39 UTC | 70 | * | AS399646 |
| Aug 31, 13:39 UTC | 80 | * | AS25892 |
| Aug 31, 13:39 UTC | 70 | * | AS30021 |
| Aug 31, 13:39 UTC | 70 | * | AS262565 |
| Aug 31, 13:39 UTC | 80 | * | AS23471 |
| Aug 31, 13:39 UTC | 80 | * | AS264235 |
| Aug 31, 13:39 UTC | 70 | * | AS54623 |
| Aug 31, 13:39 UTC | 80 | * | AS269329 |
| Aug 31, 13:39 UTC | 80 | * | AS137951 |
| Aug 31, 13:39 UTC | 70 | * | AS23002 |
| Aug 31, 13:39 UTC | 80 | * | AS268397 |
| Aug 31, 13:39 UTC | 70 | * | AS11676 |
| Aug 31, 13:39 UTC | 80 | * | AS22088 |
| Aug 31, 13:39 UTC | 70 | * | AS36874 |
| Aug 31, 13:39 UTC | 80 | * | AS55045 |
| Aug 31, 13:39 UTC | 70 | * | AS210258 |
| Aug 31, 13:39 UTC | 70 | * | AS48326 |
| Aug 31, 13:39 UTC | 80 | * | AS267717 |
| Aug 31, 13:39 UTC | 70 | * | AS46378 |
| Aug 31, 13:39 UTC | 70 | * | AS52860 |
| Aug 31, 13:39 UTC | 80 | * | AS40727 |
| Aug 31, 13:39 UTC | 70 | * | AS262428 |
| Aug 31, 13:39 UTC | 70 | * | AS40861 |
| Aug 31, 13:39 UTC | 80 | * | AS16378 |
| Aug 31, 13:39 UTC | 70 | * | AS269167 |
| Aug 31, 13:39 UTC | 70 | * | AS55189 |
| Aug 31, 13:39 UTC | 70 | * | AS268188 |
| Aug 31, 13:39 UTC | 70 | * | AS18018 |
| Aug 31, 13:39 UTC | 80 | * | AS46414 |
| Aug 31, 13:39 UTC | 90 | * | AS28201 |
| Aug 31, 13:39 UTC | 80 | * | AS327926 |
| Aug 31, 13:39 UTC | 80 | * | AS53139 |
| Aug 31, 13:39 UTC | 80 | * | AS134729 |
| Aug 31, 13:39 UTC | 70 | * | AS395479 |
| Aug 31, 13:39 UTC | 70 | * | AS26118 |
| Aug 31, 13:39 UTC | 70 | * | AS328638 |
| Aug 31, 13:39 UTC | 70 | * | AS265279 |
| Aug 31, 13:39 UTC | 70 | * | AS11700 |
| Aug 31, 13:39 UTC | 80 | * | AS268818 |
| Aug 31, 13:39 UTC | 80 | * | AS54706 |
| Aug 31, 13:39 UTC | 80 | * | AS24492 |
| Aug 31, 13:39 UTC | 70 | * | AS28261 |
| Aug 31, 13:39 UTC | 80 | * | AS266591 |
| Aug 31, 13:39 UTC | 80 | * | AS17040 |
| Aug 31, 13:39 UTC | 80 | * | AS271508 |
| Aug 31, 13:39 UTC | 70 | * | AS11228 |
| Aug 31, 13:39 UTC | 70 | * | AS44521 |
| Aug 31, 13:39 UTC | 70 | * | AS265937 |
| Aug 31, 13:39 UTC | 70 | * | AS11183 |
| Aug 31, 13:39 UTC | 70 | * | AS58826 |
| Aug 31, 13:39 UTC | 70 | * | AS133772 |
| Aug 31, 13:39 UTC | 80 | * | AS39370 |
| Aug 31, 13:39 UTC | 90 | * | AS12252 |
| Aug 31, 13:39 UTC | 70 | * | AS263263 |
| Aug 31, 13:39 UTC | 70 | * | AS4818 |
| Aug 31, 13:39 UTC | 70 | * | AS262689 |
| Aug 31, 13:39 UTC | 80 | * | AS14920 |
| Aug 31, 13:39 UTC | 70 | * | AS41362 |
| Aug 31, 13:39 UTC | 80 | * | AS63168 |
| Aug 31, 13:39 UTC | 70 | * | AS49823 |
| Aug 31, 13:39 UTC | 70 | * | AS26881 |
| Aug 31, 13:39 UTC | 70 | * | AS8257 |
| Aug 31, 13:39 UTC | 70 | * | AS201603 |
| Aug 31, 13:39 UTC | 80 | * | AS262283 |
| Aug 31, 13:39 UTC | 80 | * | AS264592 |
| Aug 31, 13:39 UTC | 80 | * | AS393526 |
| Aug 31, 13:39 UTC | 80 | * | AS267348 |
| Aug 31, 13:39 UTC | 80 | * | AS266831 |
| Aug 31, 13:39 UTC | 70 | * | AS138152 |
| Aug 31, 13:39 UTC | 70 | * | AS40564 |
| Aug 31, 13:39 UTC | 80 | * | AS264332 |
| Aug 31, 13:39 UTC | 70 | * | AS40026 |
| Aug 31, 13:39 UTC | 80 | * | AS36504 |
| Aug 31, 13:39 UTC | 70 | * | AS37199 |
| Aug 31, 13:39 UTC | 80 | * | AS4249 |
| Aug 31, 13:39 UTC | 70 | * | AS267174 |
| Aug 31, 13:39 UTC | 80 | * | AS147019 |
| Aug 31, 13:39 UTC | 80 | * | AS26615 |
| Aug 31, 13:39 UTC | 80 | * | AS41741 |
| Aug 31, 13:39 UTC | 80 | * | AS138559 |
| Aug 31, 13:39 UTC | 80 | * | AS267117 |
| Aug 31, 13:39 UTC | 70 | * | AS53236 |
| Aug 31, 13:39 UTC | 70 | * | AS58789 |
| Aug 31, 13:39 UTC | 70 | * | AS30016 |
| Aug 31, 13:39 UTC | 70 | * | AS53094 |
| Aug 31, 13:39 UTC | 70 | * | AS31747 |
| Aug 31, 13:39 UTC | 80 | * | AS18801 |
| Aug 31, 13:39 UTC | 80 | * | AS215721 |
| Aug 31, 13:39 UTC | 80 | * | AS262669 |
| Aug 31, 13:39 UTC | 70 | * | AS45644 |
| Aug 31, 13:39 UTC | 70 | * | AS8518 |
| Aug 31, 13:39 UTC | 80 | * | AS52777 |
| Aug 31, 13:39 UTC | 80 | * | AS131232 |
| Aug 31, 13:39 UTC | 70 | * | AS28227 |
| Aug 31, 13:39 UTC | 80 | * | AS202763 |
| Aug 31, 13:39 UTC | 70 | * | AS25273 |
| Aug 31, 13:39 UTC | 80 | * | AS3356 |
| Aug 31, 13:39 UTC | 70 | * | AS27482 |
| Aug 31, 13:24 UTC | 70 | * | AS52533 |
| Aug 31, 13:24 UTC | 70 | * | AS202660 |
| Aug 31, 13:24 UTC | 70 | * | AS202024 |
| Aug 31, 13:24 UTC | 80 | * | AS268421 |
| Aug 31, 13:24 UTC | 70 | * | AS139820 |
| Aug 31, 13:24 UTC | 80 | * | AS29385 |
| Aug 31, 13:24 UTC | 80 | * | AS39032 |
| Aug 31, 13:24 UTC | 70 | * | AS21887 |
| Aug 31, 13:24 UTC | 80 | * | AS201678 |
| Aug 31, 13:24 UTC | 80 | * | AS264495 |
| Aug 31, 13:24 UTC | 80 | * | AS263501 |
| Aug 31, 13:24 UTC | 80 | * | AS271657 |
| Aug 31, 13:24 UTC | 70 | * | AS213029 |
| Aug 31, 13:24 UTC | 70 | * | AS141031 |
| Aug 31, 13:24 UTC | 80 | * | AS264045 |
| Aug 31, 13:24 UTC | 80 | * | AS268707 |
| Aug 31, 13:24 UTC | 80 | * | AS267242 |
| Aug 31, 13:24 UTC | 70 | * | AS49273 |
| Aug 31, 13:24 UTC | 70 | * | AS41202 |
| Aug 31, 13:24 UTC | 80 | * | AS17557 |
| Aug 31, 13:24 UTC | 70 | * | AS38742 |
| Aug 31, 13:24 UTC | 70 | * | AS263934 |
| Aug 31, 13:24 UTC | 80 | * | AS265034 |
| Aug 31, 13:24 UTC | 70 | * | AS264915 |
| Aug 31, 13:24 UTC | 70 | * | AS22128 |
| Aug 31, 13:24 UTC | 80 | * | AS7821 |
| Aug 31, 13:24 UTC | 70 | * | AS43647 |
| Aug 31, 13:24 UTC | 70 | * | AS266208 |
| Aug 31, 13:24 UTC | 70 | * | AS26616 |
| Aug 31, 13:24 UTC | 70 | * | AS137910 |
| Aug 31, 13:24 UTC | 70 | * | AS17071 |
| Aug 31, 13:24 UTC | 70 | * | AS265435 |
| Aug 31, 13:24 UTC | 80 | * | AS265981 |
| Aug 31, 13:24 UTC | 70 | * | AS264297 |
| Aug 31, 13:24 UTC | 80 | * | AS61870 |
| Aug 31, 13:24 UTC | 70 | * | AS24499 |
| Aug 31, 13:24 UTC | 80 | * | AS269409 |
| Aug 31, 13:24 UTC | 80 | * | AS270548 |
| Aug 31, 13:24 UTC | 70 | * | AS270836 |
| Aug 31, 13:24 UTC | 70 | * | AS263888 |
| Aug 31, 13:24 UTC | 80 | * | AS262945 |
| Aug 31, 13:24 UTC | 80 | * | AS267451 |
| Aug 31, 13:24 UTC | 70 | * | AS133066 |
| Aug 31, 13:24 UTC | 80 | * | AS49472 |
| Aug 31, 13:24 UTC | 80 | * | AS34718 |
| Aug 31, 13:24 UTC | 80 | * | AS207266 |
| Aug 31, 13:24 UTC | 70 | * | AS28605 |
| Aug 31, 13:24 UTC | 80 | * | AS59257 |
| Aug 31, 13:24 UTC | 80 | * | AS28584 |
| Aug 31, 13:24 UTC | 80 | * | AS269234 |
| Aug 31, 13:24 UTC | 70 | * | AS32829 |
| Aug 31, 13:09 UTC | 70 | * | AS16019 |
| Aug 31, 13:09 UTC | 70 | * | AS28327 |
| Aug 31, 13:09 UTC | 80 | * | AS28627 |
| Aug 31, 13:09 UTC | 80 | * | AS263041 |
| Aug 31, 13:09 UTC | 80 | * | AS268836 |
| Aug 31, 13:09 UTC | 70 | * | AS263549 |
| Aug 31, 13:09 UTC | 70 | * | AS8193 |
| Aug 31, 13:09 UTC | 70 | * | AS59668 |
| Aug 31, 13:09 UTC | 70 | * | AS140952 |
| Aug 31, 13:09 UTC | 80 | * | AS264411 |
| Aug 31, 13:09 UTC | 70 | * | AS52971 |
| Aug 31, 13:09 UTC | 80 | * | AS28233 |
| Aug 31, 13:09 UTC | 70 | * | AS197350 |
| Aug 31, 13:09 UTC | 80 | * | AS58254 |
| Aug 31, 13:09 UTC | 70 | * | AS138322 |
| Aug 31, 13:09 UTC | 80 | * | AS28358 |
| Aug 31, 13:09 UTC | 70 | * | AS265432 |
| Aug 31, 13:09 UTC | 70 | * | AS262493 |
| Aug 31, 13:09 UTC | 70 | * | AS48431 |
| Aug 31, 13:09 UTC | 70 | * | AS268257 |
| Aug 31, 13:09 UTC | 70 | * | AS28366 |
| Aug 31, 13:09 UTC | 70 | * | AS3480 |
| Aug 31, 13:09 UTC | 80 | * | AS44027 |
| Aug 31, 13:09 UTC | 80 | * | AS28910 |
| Aug 31, 13:09 UTC | 80 | * | AS264221 |
| Aug 31, 13:09 UTC | 80 | * | AS50025 |
| Aug 31, 13:09 UTC | 80 | * | AS205640 |
| Aug 31, 13:09 UTC | 80 | * | AS31203 |
| Aug 31, 13:09 UTC | 70 | * | AS12365 |
| Aug 31, 13:09 UTC | 80 | * | AS52851 |
| Aug 31, 13:09 UTC | 70 | * | AS262822 |
| Aug 31, 13:09 UTC | 80 | * | AS43533 |
| Aug 31, 13:09 UTC | 80 | * | AS21928 |
| Aug 31, 13:09 UTC | 80 | * | AS264063 |
| Aug 31, 13:09 UTC | 80 | * | AS263585 |
| Aug 31, 13:09 UTC | 70 | * | AS263382 |
| Aug 31, 13:09 UTC | 80 | * | AS265127 |
| Aug 31, 13:09 UTC | 80 | * | AS268264 |
| Aug 31, 13:09 UTC | 70 | * | AS270353 |
| Aug 31, 13:09 UTC | 70 | * | AS43060 |
| Aug 31, 13:09 UTC | 70 | * | AS265369 |
Frequently Asked Questions
What is a BGP Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the Sudden withdrawal event feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-31 13:45 UTC.
How do I subscribe to Sudden withdrawal event events?
Subscribe to the Atom feed at /pulse/bgp/withdrawal.atom or poll the JSON endpoint at /api/pulse/bgp/withdrawal.