Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
11,027
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 11,027 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Aug 29, 22:53 UTC | 60 | 128.65.136.0/21 | AS44266 |
| Aug 29, 22:53 UTC | 60 | 63.216.152.0/22 | AS31713 |
| Aug 29, 22:53 UTC | 60 | 187.188.140.0/24 | AS17072 |
| Aug 29, 22:53 UTC | 60 | 107.163.56.0/24 | AS395776 |
| Aug 29, 22:53 UTC | 60 | 5.182.34.0/24 | AS201030 |
| Aug 29, 22:53 UTC | 60 | 164.156.20.0/22 | AS10753 |
| Aug 29, 22:53 UTC | 80 | 23.26.16.0/22 | AS401152 |
| Aug 29, 22:53 UTC | 70 | 101.124.22.0/24 | AS23724 |
| Aug 29, 22:53 UTC | 60 | 139.159.168.0/22 | AS58466 |
| Aug 29, 22:53 UTC | 60 | 190.90.218.0/24 | AS262589 |
| Aug 29, 22:53 UTC | 60 | 192.42.173.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 120.132.88.0/22 | AS23724 |
| Aug 29, 22:53 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 29, 22:53 UTC | 80 | 192.42.178.0/24 | AS396566 |
| Aug 29, 22:53 UTC | 60 | 124.251.128.0/21 | AS9308 |
| Aug 29, 22:53 UTC | 60 | 120.133.30.0/24 | AS4835 |
| Aug 29, 22:53 UTC | 80 | 38.95.112.0/24 | AS152672 |
| Aug 29, 22:53 UTC | 60 | 74.200.186.0/24 | AS22645 |
| Aug 29, 22:53 UTC | 60 | 41.79.248.0/24 | AS31713 |
| Aug 29, 22:53 UTC | 60 | 118.197.56.0/21 | AS4811 |
| Aug 29, 22:53 UTC | 60 | 124.250.244.0/23 | AS9308 |
| Aug 29, 22:53 UTC | 60 | 192.12.94.0/24 | AS396549 |
| Aug 29, 22:53 UTC | 60 | 90.77.224.0/22 | AS12479 |
| Aug 29, 22:53 UTC | 60 | 197.89.198.0/24 | AS20011 |
| Aug 29, 22:53 UTC | 60 | 35.206.32.0/19 | AS43515 |
| Aug 29, 22:53 UTC | 70 | 34.1.69.0/24 | AS43515 |
| Aug 29, 22:53 UTC | 60 | 197.89.141.0/24 | AS20011 |
| Aug 29, 22:53 UTC | 60 | 93.158.128.0/18 | AS208398 |
| Aug 29, 22:53 UTC | 60 | 216.87.145.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 150.129.82.0/23 | AS138968 |
| Aug 29, 22:53 UTC | 60 | 202.177.157.0/24 | AS132215 |
| Aug 29, 22:53 UTC | 60 | 185.162.75.0/24 | AS213122 |
| Aug 29, 22:53 UTC | 60 | 124.251.8.0/23 | AS9308 |
| Aug 29, 22:53 UTC | 60 | 192.82.133.0/24 | AS19836 |
| Aug 29, 22:53 UTC | 60 | 43.231.167.0/24 | AS23724 |
| Aug 29, 22:53 UTC | 60 | 194.121.203.0/24 | AS12480 |
| Aug 29, 22:53 UTC | 60 | 198.41.0.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 70 | 192.68.130.0/24 | AS396549 |
| Aug 29, 22:53 UTC | 60 | 213.180.192.0/19 | AS208398 |
| Aug 29, 22:53 UTC | 60 | 63.218.146.0/23 | AS31713 |
| Aug 29, 22:53 UTC | 60 | 154.202.84.0/24 | AS328608 |
| Aug 29, 22:53 UTC | 60 | 35.207.0.0/18 | AS43515 |
| Aug 29, 22:53 UTC | 60 | 200.7.212.0/24 | AS19114 |
| Aug 29, 22:53 UTC | 60 | 89.30.5.0/24 | AS4455 |
| Aug 29, 22:53 UTC | 70 | 192.42.93.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 45.183.32.0/22 | AS269310 |
| Aug 29, 22:53 UTC | 60 | 175.25.32.0/21 | AS23724 |
| Aug 29, 22:53 UTC | 60 | 199.4.190.0/24 | AS396879 |
| Aug 29, 22:53 UTC | 60 | 77.243.190.0/24 | AS16247 |
| Aug 29, 22:53 UTC | 60 | 1.12.14.0/23 | AS45090 |
| Aug 29, 22:53 UTC | 60 | 34.2.70.0/23 | AS43515 |
| Aug 29, 22:53 UTC | 60 | 34.113.0.0/16 | AS43515 |
| Aug 29, 22:53 UTC | 60 | 38.76.222.0/23 | AS401701 |
| Aug 29, 22:53 UTC | 60 | 166.0.100.0/24 | AS8796 |
| Aug 29, 22:53 UTC | 60 | 69.171.13.0/24 | AS13767 |
| Aug 29, 22:53 UTC | 60 | 197.89.185.0/24 | AS20011 |
| Aug 29, 22:53 UTC | 60 | 120.136.18.0/24 | AS4847 |
| Aug 29, 22:53 UTC | 60 | 192.173.112.0/24 | AS55095 |
| Aug 29, 22:53 UTC | 60 | 34.0.48.0/20 | AS43515 |
| Aug 29, 22:53 UTC | 60 | 216.172.188.0/23 | AS31898 |
| Aug 29, 22:53 UTC | 60 | 192.42.93.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 29, 22:53 UTC | 60 | 63.216.150.0/24 | AS31713 |
| Aug 29, 22:53 UTC | 70 | 192.68.130.0/24 | AS396549 |
| Aug 29, 22:53 UTC | 80 | 199.7.71.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 159.49.231.0/24 | AS29702 |
| Aug 29, 22:53 UTC | 70 | 192.30.45.0/24 | AS396549 |
| Aug 29, 22:53 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 43.229.51.0/24 | AS131274 |
| Aug 29, 22:53 UTC | 70 | 79.173.104.0/21 | AS41058 |
| Aug 29, 22:53 UTC | 60 | 72.5.161.0/24 | AS14636 |
| Aug 29, 22:53 UTC | 60 | 192.52.178.0/24 | AS396566 |
| Aug 29, 22:53 UTC | 60 | 154.94.42.0/24 | AS62240 |
| Aug 29, 22:53 UTC | 60 | 117.48.156.0/22 | AS140292 |
| Aug 29, 22:53 UTC | 60 | 185.26.155.0/24 | AS12684 |
| Aug 29, 22:53 UTC | 60 | 193.200.214.0/24 | AS43054 |
| Aug 29, 22:53 UTC | 70 | 192.42.176.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 107.163.0.0/24 | AS395776 |
| Aug 29, 22:53 UTC | 60 | 118.145.36.0/22 | AS58466 |
| Aug 29, 22:53 UTC | 70 | 2.27.92.0/24 | AS25198 |
| Aug 29, 22:53 UTC | 60 | 173.45.40.0/21 | AS29838 |
| Aug 29, 22:53 UTC | 60 | 41.79.249.0/24 | AS31713 |
| Aug 29, 22:53 UTC | 70 | 34.1.68.0/24 | AS43515 |
| Aug 29, 22:53 UTC | 80 | 38.95.113.0/24 | AS152672 |
| Aug 29, 22:53 UTC | 60 | 57.140.209.0/24 | AS15169 |
| Aug 29, 22:53 UTC | 60 | 45.125.112.0/23 | AS58779 |
| Aug 29, 22:53 UTC | 60 | 102.220.88.0/22 | AS55933 |
| Aug 29, 22:53 UTC | 60 | 14.103.120.0/21 | AS4811 |
| Aug 29, 22:53 UTC | 70 | 192.30.45.0/24 | AS396549 |
| Aug 29, 22:53 UTC | 70 | 147.28.240.0/24 | AS15830 |
| Aug 29, 22:53 UTC | 60 | 188.208.40.0/21 | AS12479 |
| Aug 29, 22:53 UTC | 60 | 221.122.64.0/20 | AS23724 |
| Aug 29, 22:53 UTC | 70 | 64.93.29.0/24 | AS40605 |
| Aug 29, 22:53 UTC | 80 | 192.55.83.0/24 | AS396566 |
| Aug 29, 22:53 UTC | 60 | 170.140.99.0/24 | AS3512 |
| Aug 29, 22:53 UTC | 70 | 192.34.234.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 80 | 185.194.173.0/24 | AS203543 |
| Aug 29, 22:53 UTC | 70 | 89.30.26.0/24 | AS4455 |
| Aug 29, 22:53 UTC | 60 | 170.46.155.0/24 | AS18697 |
| Aug 29, 22:53 UTC | 80 | 192.238.236.90/32 | AS138995 |
| Aug 29, 22:53 UTC | 60 | 63.217.208.0/22 | AS31713 |
| Aug 29, 22:53 UTC | 60 | 82.108.73.0/24 | AS151338 |
| Aug 29, 22:53 UTC | 80 | 192.82.134.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 113.21.236.0/24 | AS4812 |
| Aug 29, 22:53 UTC | 60 | 24.248.247.0/24 | AS19905 |
| Aug 29, 22:53 UTC | 60 | 42.240.160.0/20 | AS58466 |
| Aug 29, 22:53 UTC | 60 | 167.219.58.0/24 | AS132384 |
| Aug 29, 22:53 UTC | 60 | 195.49.142.0/24 | AS31216 |
| Aug 29, 22:53 UTC | 60 | 170.168.20.0/24 | AS43278 |
| Aug 29, 22:53 UTC | 60 | 192.41.162.0/24 | AS396566 |
| Aug 29, 22:53 UTC | 70 | 192.43.172.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 57.140.192.0/18 | AS19527 |
| Aug 29, 22:53 UTC | 60 | 103.200.220.0/24 | AS4812 |
| Aug 29, 22:53 UTC | 60 | 212.163.8.0/24 | AS12541 |
| Aug 29, 22:53 UTC | 60 | 163.171.65.0/24 | AS4775 |
| Aug 29, 22:53 UTC | 60 | 93.88.176.0/20 | AS44868 |
| Aug 29, 22:53 UTC | 60 | 181.119.118.0/24 | AS52468 |
| Aug 29, 22:53 UTC | 70 | 120.132.177.0/24 | AS58466 |
| Aug 29, 22:53 UTC | 70 | 192.26.92.0/24 | AS396549 |
| Aug 29, 22:53 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 29, 22:53 UTC | 60 | 201.50.114.0/24 | AS214833 |
| Aug 29, 22:53 UTC | 60 | 208.52.177.0/24 | AS400196 |
| Aug 29, 22:53 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 29, 22:53 UTC | 60 | 123.59.192.0/19 | AS23724 |
| Aug 29, 22:53 UTC | 60 | 45.202.120.0/22 | AS11427 |
| Aug 29, 22:53 UTC | 60 | 154.62.234.0/23 | AS8903 |
| Aug 29, 22:53 UTC | 70 | 185.100.0.0/24 | AS396566 |
| Aug 29, 22:53 UTC | 70 | 43.248.118.0/24 | AS151300 |
| Aug 29, 22:53 UTC | 60 | 207.135.220.0/23 | AS397782 |
| Aug 29, 22:53 UTC | 60 | 154.196.252.0/24 | AS41095 |
| Aug 29, 22:53 UTC | 60 | 202.90.96.0/22 | AS4811 |
| Aug 29, 22:53 UTC | 60 | 194.33.68.0/24 | AS43766 |
| Aug 29, 22:53 UTC | 60 | 34.190.160.0/21 | AS19527 |
| Aug 29, 22:53 UTC | 70 | 206.227.196.0/24 | AS6109 |
| Aug 29, 22:53 UTC | 60 | 203.196.0.0/23 | AS9308 |
| Aug 29, 22:53 UTC | 70 | 109.176.255.0/24 | AS399989 |
| Aug 29, 22:53 UTC | 70 | 45.192.133.0/24 | AS263242 |
| Aug 29, 22:53 UTC | 60 | 145.40.80.0/23 | AS15830 |
| Aug 29, 22:53 UTC | 60 | 193.105.40.0/24 | AS196695 |
| Aug 29, 22:53 UTC | 60 | 115.84.165.0/24 | AS17574 |
| Aug 29, 22:53 UTC | 60 | 120.92.184.0/23 | AS4811 |
| Aug 29, 22:53 UTC | 60 | 120.136.19.0/24 | AS4847 |
| Aug 29, 22:53 UTC | 60 | 156.255.0.0/24 | AS54801 |
| Aug 29, 22:53 UTC | 60 | 95.19.0.0/16 | AS12479 |
| Aug 29, 22:53 UTC | 70 | 216.87.145.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 70 | 38.57.116.0/24 | AS999 |
| Aug 29, 22:53 UTC | 60 | 192.34.234.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 103.26.64.0/22 | AS23724 |
| Aug 29, 22:53 UTC | 60 | 154.58.196.0/24 | AS44431 |
| Aug 29, 22:53 UTC | 60 | 12.148.180.0/22 | AS19299 |
| Aug 29, 22:53 UTC | 60 | 195.5.79.0/24 | AS8903 |
| Aug 29, 22:53 UTC | 60 | 52.82.167.0/24 | AS135629 |
| Aug 29, 22:53 UTC | 60 | 178.154.128.0/19 | AS208398 |
| Aug 29, 22:53 UTC | 60 | 103.163.174.0/24 | AS141891 |
| Aug 29, 22:53 UTC | 60 | 205.209.193.0/24 | AS17025 |
| Aug 29, 22:53 UTC | 70 | 87.107.86.0/24 | AS42337 |
| Aug 29, 22:53 UTC | 60 | 192.23.185.0/24 | AS72 |
| Aug 29, 22:53 UTC | 60 | 136.0.34.0/24 | AS213840 |
| Aug 29, 22:53 UTC | 60 | 197.89.142.0/24 | AS20011 |
| Aug 29, 22:53 UTC | 60 | 192.67.239.0/24 | AS23918 |
| Aug 29, 22:53 UTC | 60 | 45.195.159.0/24 | AS135222 |
| Aug 29, 22:53 UTC | 60 | 192.26.92.0/24 | AS396549 |
| Aug 29, 22:53 UTC | 60 | 174.47.195.0/24 | AS15065 |
| Aug 29, 22:53 UTC | 60 | 91.223.68.0/24 | AS2115 |
| Aug 29, 22:53 UTC | 60 | 192.42.176.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 211.151.84.0/23 | AS9308 |
| Aug 29, 22:53 UTC | 60 | 34.191.88.0/21 | AS43515 |
| Aug 29, 22:53 UTC | 60 | 152.65.226.0/24 | AS19527 |
| Aug 29, 22:53 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 170.238.239.0/24 | AS18678 |
| Aug 29, 22:53 UTC | 60 | 118.197.0.0/21 | AS4811 |
| Aug 29, 22:53 UTC | 60 | 209.23.97.0/24 | AS15065 |
| Aug 29, 22:53 UTC | 60 | 117.48.148.0/22 | AS140292 |
| Aug 29, 22:53 UTC | 60 | 154.12.190.0/23 | AS32519 |
| Aug 29, 22:53 UTC | 60 | 62.217.7.0/24 | AS5065 |
| Aug 29, 22:53 UTC | 60 | 34.0.229.0/24 | AS15169 |
| Aug 29, 22:53 UTC | 70 | 122.200.104.0/22 | AS4847 |
| Aug 29, 22:53 UTC | 60 | 118.145.36.0/22 | AS58466 |
| Aug 29, 22:53 UTC | 60 | 205.164.240.0/24 | AS273238 |
| Aug 29, 22:53 UTC | 60 | 185.100.0.0/24 | AS396566 |
| Aug 29, 22:53 UTC | 60 | 198.41.0.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 199.7.71.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 154.61.132.0/24 | AS43054 |
| Aug 29, 22:53 UTC | 60 | 92.240.228.0/24 | AS29405 |
| Aug 29, 22:53 UTC | 70 | 23.26.8.0/23 | AS219429 |
| Aug 29, 22:53 UTC | 60 | 192.34.234.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 80.66.123.0/24 | AS8903 |
| Aug 29, 22:53 UTC | 60 | 176.59.122.0/23 | AS39374 |
| Aug 29, 22:53 UTC | 70 | 175.102.18.0/24 | AS4811 |
| Aug 29, 22:53 UTC | 70 | 216.87.145.0/24 | AS397197 |
| Aug 29, 22:53 UTC | 60 | 173.245.153.0/24 | AS15065 |
| Aug 29, 22:53 UTC | 60 | 107.163.39.0/24 | AS395776 |
| Aug 29, 22:53 UTC | 60 | 167.86.47.0/24 | AS48851 |
| Aug 29, 22:53 UTC | 60 | 154.58.219.0/24 | AS8903 |
| Aug 29, 22:53 UTC | 60 | 203.28.15.0/24 | AS207551 |
| Aug 29, 22:53 UTC | 60 | 156.112.139.0/24 | AS27065 |
| Aug 29, 22:53 UTC | 60 | 187.62.192.0/24 | AS262617 |
| Aug 29, 22:53 UTC | 70 | 182.175.243.0/24 | AS4811 |
| Aug 29, 22:53 UTC | 60 | 120.132.124.0/22 | AS58466 |
| Aug 29, 22:53 UTC | 60 | 121.251.208.0/21 | AS4538 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-29 23:05 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
