Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
8,335
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 8,335 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Oct 13, 18:58 UTC | 60 | 147.28.186.0/23 | AS15830 |
| Oct 13, 18:58 UTC | 60 | 103.204.13.0/24 | AS13335 |
| Oct 13, 18:58 UTC | 60 | 45.12.82.0/24 | AS152672 |
| Oct 13, 18:58 UTC | 60 | 192.30.38.0/23 | AS63081 |
| Oct 13, 18:58 UTC | 60 | 185.238.0.0/24 | AS200313 |
| Oct 13, 18:58 UTC | 60 | 91.199.242.0/24 | AS44788 |
| Oct 13, 18:58 UTC | 60 | 195.46.128.0/20 | AS15924 |
| Oct 13, 18:58 UTC | 60 | 38.47.129.0/24 | AS147019 |
| Oct 13, 18:58 UTC | 60 | 202.57.205.0/24 | AS131314 |
| Oct 13, 18:58 UTC | 60 | 72.4.154.0/23 | AS3064 |
| Oct 13, 18:58 UTC | 60 | 213.248.222.0/24 | AS43519 |
| Oct 13, 18:58 UTC | 60 | 14.103.208.0/21 | AS4811 |
| Oct 13, 18:58 UTC | 60 | 222.126.184.0/23 | AS7468 |
| Oct 13, 18:58 UTC | 60 | 80.84.158.0/23 | AS21057 |
| Oct 13, 18:58 UTC | 60 | 152.65.226.0/24 | AS19527 |
| Oct 13, 18:58 UTC | 60 | 82.39.162.0/24 | AS205247 |
| Oct 13, 18:58 UTC | 60 | 43.247.88.0/22 | AS138950 |
| Oct 13, 18:58 UTC | 70 | 66.80.0.0/24 | AS39600 |
| Oct 13, 18:58 UTC | 60 | 34.2.92.0/23 | AS15169 |
| Oct 13, 18:58 UTC | 70 | 216.133.145.0/24 | AS39600 |
| Oct 13, 18:58 UTC | 60 | 45.61.171.0/24 | AS213122 |
| Oct 13, 18:58 UTC | 60 | 177.2.188.0/23 | AS137535 |
| Oct 13, 18:58 UTC | 60 | 121.58.156.0/23 | AS4847 |
| Oct 13, 18:58 UTC | 60 | 170.10.142.0/24 | AS42427 |
| Oct 13, 18:58 UTC | 60 | 146.127.224.0/20 | AS6303 |
| Oct 13, 18:58 UTC | 60 | 198.41.0.0/24 | AS396566 |
| Oct 13, 18:58 UTC | 60 | 45.249.215.0/24 | AS134543 |
| Oct 13, 18:58 UTC | 60 | 43.251.18.0/23 | AS141201 |
| Oct 13, 18:58 UTC | 60 | 115.69.237.0/24 | AS7521 |
| Oct 13, 18:58 UTC | 60 | 200.53.169.0/24 | AS22908 |
| Oct 13, 18:58 UTC | 60 | 195.42.248.0/24 | AS200313 |
| Oct 13, 18:58 UTC | 60 | 52.82.166.0/24 | AS9808 |
| Oct 13, 18:58 UTC | 60 | 152.175.144.0/24 | AS202069 |
| Oct 13, 18:58 UTC | 60 | 206.107.70.0/24 | AS174 |
| Oct 13, 18:58 UTC | 60 | 212.12.157.0/24 | AS15924 |
| Oct 13, 18:58 UTC | 60 | 199.7.71.0/24 | AS396549 |
| Oct 13, 18:58 UTC | 60 | 200.53.187.0/24 | AS22011 |
| Oct 13, 18:58 UTC | 60 | 197.89.98.0/24 | AS20011 |
| Oct 13, 18:58 UTC | 70 | 213.247.48.0/23 | AS8315 |
| Oct 13, 18:58 UTC | 60 | 114.79.51.0/24 | AS18004 |
| Oct 13, 18:58 UTC | 70 | 179.42.46.0/24 | AS273309 |
| Oct 13, 18:58 UTC | 60 | 43.254.46.0/23 | AS4811 |
| Oct 13, 18:58 UTC | 60 | 118.26.168.0/21 | AS4847 |
| Oct 13, 18:58 UTC | 60 | 34.1.83.0/24 | AS19527 |
| Oct 13, 18:58 UTC | 60 | 103.79.2.0/24 | AS133296 |
| Oct 13, 18:58 UTC | 70 | 23.226.50.0/24 | AS138415 |
| Oct 13, 18:58 UTC | 60 | 210.48.146.0/24 | AS18206 |
| Oct 13, 18:58 UTC | 60 | 117.121.230.0/24 | AS136908 |
| Oct 13, 18:58 UTC | 60 | 197.89.100.0/24 | AS20011 |
| Oct 13, 18:58 UTC | 60 | 63.223.20.0/24 | AS31713 |
| Oct 13, 18:58 UTC | 60 | 143.199.140.0/23 | AS203 |
| Oct 13, 18:58 UTC | 60 | 63.221.155.0/24 | AS31713 |
| Oct 13, 18:58 UTC | 60 | 45.253.26.0/24 | AS138421 |
| Oct 13, 18:58 UTC | 60 | 34.1.70.0/24 | AS43515 |
| Oct 13, 18:58 UTC | 60 | 63.222.158.0/24 | AS31713 |
| Oct 13, 18:58 UTC | 60 | 199.88.114.0/23 | AS10309 |
| Oct 13, 18:58 UTC | 60 | 195.87.31.0/24 | AS15924 |
| Oct 13, 18:58 UTC | 60 | 145.40.101.0/24 | AS15830 |
| Oct 13, 18:58 UTC | 60 | 57.140.227.0/24 | AS19527 |
| Oct 13, 18:58 UTC | 60 | 34.0.233.0/24 | AS43515 |
| Oct 13, 18:58 UTC | 60 | 121.46.28.0/22 | AS135391 |
| Oct 13, 18:58 UTC | 60 | 118.197.24.0/21 | AS4811 |
| Oct 13, 18:58 UTC | 60 | 38.100.105.0/24 | AS400810 |
| Oct 13, 18:58 UTC | 60 | 144.208.80.0/22 | AS396341 |
| Oct 13, 18:58 UTC | 60 | 166.86.194.0/24 | AS213735 |
| Oct 13, 18:58 UTC | 60 | 192.42.178.0/24 | AS396566 |
| Oct 13, 18:58 UTC | 60 | 180.184.176.0/21 | AS4811 |
| Oct 13, 18:58 UTC | 60 | 91.209.198.0/24 | AS50369 |
| Oct 13, 18:58 UTC | 60 | 195.209.218.160/32 | AS62255 |
| Oct 13, 18:58 UTC | 60 | 143.255.183.0/24 | AS266335 |
| Oct 13, 18:58 UTC | 60 | 66.113.135.0/24 | AS3064 |
| Oct 13, 18:58 UTC | 60 | 223.202.67.0/24 | AS4847 |
| Oct 13, 18:58 UTC | 60 | 212.163.18.0/24 | AS8903 |
| Oct 13, 18:58 UTC | 60 | 210.87.197.0/24 | AS135120 |
| Oct 13, 18:58 UTC | 60 | 34.0.234.0/24 | AS19527 |
| Oct 13, 18:58 UTC | 60 | 84.45.50.0/24 | AS40513 |
| Oct 13, 18:58 UTC | 60 | 82.139.242.0/24 | AS151338 |
| Oct 13, 18:58 UTC | 60 | 91.123.181.0/24 | AS51648 |
| Oct 13, 18:58 UTC | 60 | 150.137.0.0/16 | AS1600 |
| Oct 13, 18:58 UTC | 60 | 38.188.94.0/24 | AS138754 |
| Oct 13, 18:58 UTC | 60 | 192.12.94.0/24 | AS396549 |
| Oct 13, 18:58 UTC | 60 | 95.27.212.0/23 | AS34038 |
| Oct 13, 18:58 UTC | 60 | 117.48.234.0/24 | AS58466 |
| Oct 13, 18:58 UTC | 60 | 168.187.243.0/24 | AS6412 |
| Oct 13, 18:58 UTC | 70 | 46.184.25.0/24 | AS47794 |
| Oct 13, 18:58 UTC | 60 | 8.148.37.0/24 | AS24429 |
| Oct 13, 18:58 UTC | 60 | 216.168.228.0/24 | AS19836 |
| Oct 13, 18:58 UTC | 70 | 195.87.112.0/24 | AS15924 |
| Oct 13, 18:58 UTC | 60 | 23.19.53.0/24 | AS205544 |
| Oct 13, 18:58 UTC | 70 | 95.19.103.0/24 | AS12479 |
| Oct 13, 18:58 UTC | 60 | 68.68.98.0/24 | AS10753 |
| Oct 13, 18:58 UTC | 60 | 80.66.122.0/24 | AS8903 |
| Oct 13, 18:58 UTC | 60 | 38.253.95.0/24 | AS272027 |
| Oct 13, 18:58 UTC | 70 | 83.98.144.0/22 | AS8315 |
| Oct 13, 18:58 UTC | 60 | 34.1.72.0/24 | AS43515 |
| Oct 13, 18:58 UTC | 60 | 102.68.130.0/24 | AS21003 |
| Oct 13, 18:58 UTC | 60 | 43.240.126.0/23 | AS4811 |
| Oct 13, 18:58 UTC | 60 | 34.0.160.0/19 | AS15169 |
| Oct 13, 18:58 UTC | 60 | 124.251.128.0/21 | AS9308 |
| Oct 13, 18:58 UTC | 60 | 223.196.18.0/24 | AS55410 |
| Oct 13, 18:58 UTC | 60 | 123.103.15.0/24 | AS23724 |
| Oct 13, 18:58 UTC | 60 | 159.242.9.0/24 | AS205019 |
| Oct 13, 18:58 UTC | 70 | 168.210.128.0/18 | AS20011 |
| Oct 13, 18:58 UTC | 60 | 103.221.49.0/24 | AS139259 |
| Oct 13, 18:58 UTC | 80 | 94.142.187.0/24 | AS48463 |
| Oct 13, 18:58 UTC | 60 | 191.243.243.0/24 | AS263519 |
| Oct 13, 18:58 UTC | 60 | 38.225.110.0/24 | AS174 |
| Oct 13, 18:58 UTC | 70 | 188.208.2.0/24 | AS12479 |
| Oct 13, 18:58 UTC | 60 | 45.62.133.0/24 | AS15265 |
| Oct 13, 18:58 UTC | 60 | 91.123.178.0/24 | AS51648 |
| Oct 13, 18:58 UTC | 60 | 45.215.225.0/24 | AS327708 |
| Oct 13, 18:58 UTC | 60 | 194.164.87.0/24 | AS207551 |
| Oct 13, 18:58 UTC | 60 | 27.124.8.0/24 | AS64050 |
| Oct 13, 18:58 UTC | 60 | 38.87.169.0/24 | AS400302 |
| Oct 13, 18:58 UTC | 60 | 156.154.100.0/24 | AS12008 |
| Oct 13, 18:58 UTC | 60 | 193.232.39.0/24 | AS48009 |
| Oct 13, 18:58 UTC | 60 | 34.190.88.0/21 | AS15169 |
| Oct 13, 18:58 UTC | 60 | 190.90.58.0/24 | AS18678 |
| Oct 13, 18:58 UTC | 60 | 72.249.112.0/24 | AS7181 |
| Oct 13, 18:58 UTC | 60 | 112.196.220.0/24 | AS38705 |
| Oct 13, 18:58 UTC | 60 | 87.222.209.0/24 | AS12479 |
| Oct 13, 18:58 UTC | 60 | 156.154.128.0/24 | AS12008 |
| Oct 13, 18:58 UTC | 60 | 116.89.241.0/24 | AS150706 |
| Oct 13, 18:58 UTC | 60 | 66.22.101.0/24 | AS25773 |
| Oct 13, 18:58 UTC | 60 | 54.222.109.0/24 | AS23724 |
| Oct 13, 18:58 UTC | 60 | 45.43.16.0/24 | AS398465 |
| Oct 13, 18:58 UTC | 60 | 87.221.219.0/24 | AS12479 |
| Oct 13, 18:58 UTC | 60 | 195.209.208.0/20 | AS35598 |
| Oct 13, 18:58 UTC | 60 | 64.40.126.0/24 | AS3064 |
| Oct 13, 18:58 UTC | 60 | 103.181.209.0/24 | AS138296 |
| Oct 13, 18:58 UTC | 70 | 141.11.161.0/24 | AS29802 |
| Oct 13, 18:58 UTC | 60 | 192.42.176.0/24 | AS396549 |
| Oct 13, 18:58 UTC | 60 | 35.219.194.0/24 | AS19527 |
| Oct 13, 18:58 UTC | 60 | 38.54.115.0/24 | AS138915 |
| Oct 13, 18:58 UTC | 60 | 41.173.224.0/22 | AS37332 |
| Oct 13, 18:58 UTC | 60 | 138.97.188.0/23 | AS26491 |
| Oct 13, 18:58 UTC | 60 | 170.33.31.0/24 | AS45102 |
| Oct 13, 18:58 UTC | 60 | 31.57.142.0/24 | AS202051 |
| Oct 13, 18:58 UTC | 60 | 38.156.71.0/24 | AS272964 |
| Oct 13, 18:58 UTC | 60 | 54.222.114.0/24 | AS23724 |
| Oct 13, 18:58 UTC | 60 | 192.68.126.0/24 | AS19836 |
| Oct 13, 18:58 UTC | 60 | 54.222.50.0/24 | AS9808 |
| Oct 13, 18:58 UTC | 60 | 188.191.52.0/24 | AS50246 |
| Oct 13, 18:58 UTC | 70 | 197.158.254.0/23 | AS37343 |
| Oct 13, 18:58 UTC | 60 | 149.12.70.0/24 | AS174 |
| Oct 13, 18:58 UTC | 60 | 14.1.112.0/22 | AS45102 |
| Oct 13, 18:58 UTC | 60 | 197.89.231.0/24 | AS5713 |
| Oct 13, 18:58 UTC | 60 | 107.163.67.0/24 | AS395776 |
| Oct 13, 18:58 UTC | 60 | 37.9.64.0/24 | AS208398 |
| Oct 13, 18:58 UTC | 60 | 152.65.241.0/24 | AS43515 |
| Oct 13, 18:58 UTC | 60 | 66.9.98.0/24 | AS7029 |
| Oct 13, 18:58 UTC | 60 | 118.196.8.0/21 | AS4811 |
| Oct 13, 18:58 UTC | 60 | 161.129.40.0/24 | AS213122 |
| Oct 13, 18:58 UTC | 60 | 161.36.119.0/24 | AS394135 |
| Oct 13, 18:58 UTC | 60 | 69.53.247.0/24 | AS2906 |
| Oct 13, 18:58 UTC | 70 | 37.132.128.0/23 | AS12479 |
| Oct 13, 18:58 UTC | 60 | 118.247.0.0/16 | AS4847 |
| Oct 13, 18:58 UTC | 60 | 77.85.171.0/24 | AS207371 |
| Oct 13, 18:58 UTC | 80 | 186.177.119.0/24 | AS262197 |
| Oct 13, 18:58 UTC | 60 | 63.221.181.0/24 | AS31713 |
| Oct 13, 18:58 UTC | 60 | 202.57.198.0/24 | AS131314 |
| Oct 13, 18:58 UTC | 60 | 159.49.251.0/24 | AS29750 |
| Oct 13, 18:58 UTC | 60 | 63.223.14.0/24 | AS31713 |
| Oct 13, 18:58 UTC | 60 | 38.105.3.0/24 | AS174 |
| Oct 13, 18:58 UTC | 60 | 192.42.177.0/24 | AS396549 |
| Oct 13, 18:58 UTC | 60 | 121.139.137.0/24 | AS23591 |
| Oct 13, 18:58 UTC | 60 | 115.84.161.0/24 | AS17574 |
| Oct 13, 18:58 UTC | 60 | 177.3.93.0/24 | AS137535 |
| Oct 13, 18:58 UTC | 60 | 207.190.143.0/24 | AS6461 |
| Oct 13, 18:58 UTC | 60 | 195.253.65.0/24 | AS50611 |
| Oct 13, 18:58 UTC | 60 | 84.44.24.0/24 | AS15924 |
| Oct 13, 18:58 UTC | 70 | 66.93.82.0/24 | AS39600 |
| Oct 13, 18:58 UTC | 60 | 205.172.72.0/21 | AS10753 |
| Oct 13, 18:58 UTC | 60 | 134.42.227.0/24 | AS53712 |
| Oct 13, 18:58 UTC | 60 | 197.89.240.0/24 | AS20011 |
| Oct 13, 18:58 UTC | 60 | 38.147.195.0/24 | AS13536 |
| Oct 13, 18:58 UTC | 60 | 89.30.58.0/24 | AS4455 |
| Oct 13, 18:58 UTC | 60 | 118.145.44.0/22 | AS58466 |
| Oct 13, 18:58 UTC | 60 | 151.244.186.0/24 | AS20473 |
| Oct 13, 18:58 UTC | 60 | 103.16.210.0/23 | AS132611 |
| Oct 13, 18:58 UTC | 60 | 154.58.231.0/24 | AS149672 |
| Oct 13, 18:58 UTC | 60 | 193.138.149.0/24 | AS13116 |
| Oct 13, 18:58 UTC | 60 | 156.59.146.0/24 | AS62610 |
| Oct 13, 18:58 UTC | 60 | 120.132.64.0/22 | AS23724 |
| Oct 13, 18:58 UTC | 60 | 62.244.208.0/20 | AS15924 |
| Oct 13, 18:58 UTC | 60 | 66.113.160.0/21 | AS3064 |
| Oct 13, 18:58 UTC | 60 | 195.46.128.0/19 | AS15924 |
| Oct 13, 18:58 UTC | 60 | 81.8.51.0/24 | AS15924 |
| Oct 13, 18:58 UTC | 60 | 38.253.93.0/24 | AS272027 |
| Oct 13, 18:58 UTC | 60 | 45.215.250.0/24 | AS327708 |
| Oct 13, 18:58 UTC | 60 | 34.112.0.0/16 | AS43515 |
| Oct 13, 18:58 UTC | 60 | 63.174.218.0/24 | AS19409 |
| Oct 13, 18:58 UTC | 60 | 148.224.24.0/22 | AS64160 |
| Oct 13, 18:58 UTC | 60 | 156.154.105.0/24 | AS12008 |
| Oct 13, 18:58 UTC | 60 | 80.66.124.0/24 | AS8903 |
| Oct 13, 18:58 UTC | 60 | 87.218.58.0/23 | AS12479 |
| Oct 13, 18:58 UTC | 60 | 57.140.210.0/24 | AS19527 |
| Oct 13, 18:58 UTC | 60 | 212.163.94.0/24 | AS8903 |
| Oct 13, 18:58 UTC | 60 | 195.5.80.0/22 | AS8903 |
| Oct 13, 18:58 UTC | 60 | 38.147.220.0/24 | AS46887 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-10-13 19:00 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
