Pulse — Sudden withdrawal event
ASNs whose active prefix count dropped by ≥50% in the last hour vs. the 1–7h baseline — outages, DDoS-blackhole, route leak fallout.
What is Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Geographic distribution
Flagged events
Showing 200 most recent of 3,167 · last 24h| When | Severity | Prefix | AS |
|---|---|---|---|
| Aug 30, 10:54 UTC | 70 | * | AS4818 |
| Aug 30, 10:54 UTC | 70 | * | AS262428 |
| Aug 30, 10:54 UTC | 70 | * | AS61828 |
| Aug 30, 10:54 UTC | 80 | * | AS265142 |
| Aug 30, 10:54 UTC | 70 | * | AS399646 |
| Aug 30, 10:54 UTC | 80 | * | AS268280 |
| Aug 30, 10:54 UTC | 80 | * | AS265267 |
| Aug 30, 10:54 UTC | 70 | * | AS28577 |
| Aug 30, 10:54 UTC | 80 | * | AS394284 |
| Aug 30, 10:54 UTC | 70 | * | AS53132 |
| Aug 30, 10:54 UTC | 70 | * | AS268829 |
| Aug 30, 10:54 UTC | 70 | * | AS28634 |
| Aug 30, 10:54 UTC | 80 | * | AS267717 |
| Aug 30, 10:54 UTC | 70 | * | AS266081 |
| Aug 30, 10:54 UTC | 80 | * | AS266133 |
| Aug 30, 10:54 UTC | 70 | * | AS263888 |
| Aug 30, 10:54 UTC | 80 | * | AS52962 |
| Aug 30, 10:54 UTC | 80 | * | AS7821 |
| Aug 30, 10:54 UTC | 70 | * | AS327926 |
| Aug 30, 10:54 UTC | 80 | * | AS265394 |
| Aug 30, 10:54 UTC | 80 | * | AS267117 |
| Aug 30, 10:54 UTC | 70 | * | AS262412 |
| Aug 30, 10:54 UTC | 80 | * | AS264332 |
| Aug 30, 10:54 UTC | 80 | * | AS269329 |
| Aug 30, 10:54 UTC | 80 | * | AS61684 |
| Aug 30, 10:54 UTC | 70 | * | AS395479 |
| Aug 30, 10:54 UTC | 70 | * | AS40861 |
| Aug 30, 10:54 UTC | 80 | * | AS271538 |
| Aug 30, 10:54 UTC | 70 | * | AS28668 |
| Aug 30, 10:54 UTC | 70 | * | AS265937 |
| Aug 30, 10:54 UTC | 70 | * | AS265279 |
| Aug 30, 10:54 UTC | 80 | * | AS264921 |
| Aug 30, 10:54 UTC | 80 | * | AS264867 |
| Aug 30, 10:54 UTC | 80 | * | AS262669 |
| Aug 30, 10:54 UTC | 80 | * | AS137951 |
| Aug 30, 10:54 UTC | 80 | * | AS268397 |
| Aug 30, 10:54 UTC | 80 | * | AS263781 |
| Aug 30, 10:54 UTC | 80 | * | AS264342 |
| Aug 30, 10:54 UTC | 80 | * | AS262349 |
| Aug 30, 10:54 UTC | 80 | * | AS61704 |
| Aug 30, 10:54 UTC | 70 | * | AS266427 |
| Aug 30, 10:54 UTC | 80 | * | AS32524 |
| Aug 30, 10:54 UTC | 70 | * | AS263035 |
| Aug 30, 10:54 UTC | 70 | * | AS264344 |
| Aug 30, 10:54 UTC | 80 | * | AS267348 |
| Aug 30, 10:54 UTC | 70 | * | AS263574 |
| Aug 30, 10:54 UTC | 70 | * | AS48326 |
| Aug 30, 10:54 UTC | 70 | * | AS9751 |
| Aug 30, 10:54 UTC | 70 | * | AS46378 |
| Aug 30, 10:54 UTC | 70 | * | AS34999 |
| Aug 30, 10:54 UTC | 70 | * | AS26881 |
| Aug 30, 10:54 UTC | 70 | * | AS262463 |
| Aug 30, 10:54 UTC | 90 | * | AS28201 |
| Aug 30, 10:54 UTC | 80 | * | AS36504 |
| Aug 30, 10:54 UTC | 70 | * | AS44284 |
| Aug 30, 10:54 UTC | 80 | * | AS265027 |
| Aug 30, 10:54 UTC | 70 | * | AS28178 |
| Aug 30, 10:54 UTC | 70 | * | AS52947 |
| Aug 30, 10:54 UTC | 70 | * | AS28327 |
| Aug 30, 10:54 UTC | 70 | * | AS268323 |
| Aug 30, 10:54 UTC | 80 | * | AS264235 |
| Aug 30, 10:54 UTC | 80 | * | AS138462 |
| Aug 30, 10:54 UTC | 80 | * | AS12041 |
| Aug 30, 10:54 UTC | 80 | * | AS266591 |
| Aug 30, 10:54 UTC | 70 | * | AS265303 |
| Aug 30, 10:54 UTC | 70 | * | AS53175 |
| Aug 30, 10:54 UTC | 80 | * | AS52861 |
| Aug 30, 10:54 UTC | 70 | * | AS53094 |
| Aug 30, 10:54 UTC | 80 | * | AS263918 |
| Aug 30, 10:54 UTC | 70 | * | AS60503 |
| Aug 30, 10:54 UTC | 70 | * | AS267174 |
| Aug 30, 10:54 UTC | 80 | * | AS269018 |
| Aug 30, 10:54 UTC | 80 | * | AS52977 |
| Aug 30, 10:54 UTC | 80 | * | AS269705 |
| Aug 30, 10:54 UTC | 80 | * | AS264592 |
| Aug 30, 10:54 UTC | 80 | * | AS266831 |
| Aug 30, 10:54 UTC | 70 | * | AS269167 |
| Aug 30, 10:54 UTC | 70 | * | AS264524 |
| Aug 30, 10:54 UTC | 70 | * | AS33236 |
| Aug 30, 10:54 UTC | 80 | * | AS268818 |
| Aug 30, 10:54 UTC | 80 | * | AS55045 |
| Aug 30, 10:54 UTC | 70 | * | AS263608 |
| Aug 30, 10:54 UTC | 70 | * | AS262290 |
| Aug 30, 10:54 UTC | 70 | * | AS12654 |
| Aug 30, 10:54 UTC | 70 | * | AS31490 |
| Aug 30, 10:54 UTC | 80 | * | AS52528 |
| Aug 30, 10:54 UTC | 70 | * | AS262973 |
| Aug 30, 10:54 UTC | 80 | * | AS24492 |
| Aug 30, 10:54 UTC | 70 | * | AS8257 |
| Aug 30, 10:54 UTC | 70 | * | AS327700 |
| Aug 30, 10:54 UTC | 70 | * | AS263263 |
| Aug 30, 10:54 UTC | 70 | * | AS201603 |
| Aug 30, 10:54 UTC | 80 | * | AS269114 |
| Aug 30, 10:54 UTC | 70 | * | AS268311 |
| Aug 30, 10:54 UTC | 80 | * | AS270884 |
| Aug 30, 10:54 UTC | 80 | * | AS28202 |
| Aug 30, 10:39 UTC | 70 | * | AS8518 |
| Aug 30, 10:39 UTC | 80 | * | AS4249 |
| Aug 30, 10:39 UTC | 70 | * | AS147019 |
| Aug 30, 10:39 UTC | 70 | * | AS44521 |
| Aug 30, 10:39 UTC | 80 | * | AS267656 |
| Aug 30, 10:39 UTC | 80 | * | AS39370 |
| Aug 30, 10:39 UTC | 80 | * | AS134729 |
| Aug 30, 10:39 UTC | 80 | * | AS18801 |
| Aug 30, 10:39 UTC | 70 | * | AS27482 |
| Aug 30, 10:39 UTC | 80 | * | AS41741 |
| Aug 30, 10:39 UTC | 70 | * | AS45644 |
| Aug 30, 10:39 UTC | 70 | * | AS133772 |
| Aug 30, 10:39 UTC | 70 | * | AS262565 |
| Aug 30, 10:39 UTC | 70 | * | AS28227 |
| Aug 30, 10:39 UTC | 80 | * | AS202161 |
| Aug 30, 10:39 UTC | 70 | * | AS25273 |
| Aug 30, 10:39 UTC | 70 | * | AS41362 |
| Aug 30, 10:39 UTC | 80 | * | AS16378 |
| Aug 30, 10:39 UTC | 80 | * | AS24570 |
| Aug 30, 10:39 UTC | 80 | * | AS269229 |
| Aug 30, 10:39 UTC | 70 | * | AS40026 |
| Aug 30, 10:39 UTC | 80 | * | AS26610 |
| Aug 30, 10:39 UTC | 70 | * | AS43338 |
| Aug 30, 10:39 UTC | 70 | * | AS36905 |
| Aug 30, 10:39 UTC | 80 | * | AS43145 |
| Aug 30, 10:39 UTC | 70 | * | AS31747 |
| Aug 30, 10:39 UTC | 80 | * | AS269655 |
| Aug 30, 10:39 UTC | 80 | * | AS14920 |
| Aug 30, 10:39 UTC | 70 | * | AS267575 |
| Aug 30, 10:24 UTC | 70 | * | AS30016 |
| Aug 30, 10:24 UTC | 70 | * | AS32829 |
| Aug 30, 10:24 UTC | 80 | * | AS213382 |
| Aug 30, 10:24 UTC | 70 | * | AS54623 |
| Aug 30, 10:24 UTC | 80 | * | AS13053 |
| Aug 30, 10:24 UTC | 70 | * | AS11676 |
| Aug 30, 10:24 UTC | 70 | * | AS32528 |
| Aug 30, 10:24 UTC | 80 | * | AS25892 |
| Aug 30, 10:24 UTC | 70 | * | AS138152 |
| Aug 30, 10:24 UTC | 70 | * | AS202105 |
| Aug 30, 10:09 UTC | 80 | * | AS45007 |
| Aug 30, 10:09 UTC | 80 | * | AS202024 |
| Aug 30, 10:09 UTC | 70 | * | AS56246 |
| Aug 30, 10:09 UTC | 70 | * | AS401307 |
| Aug 30, 10:09 UTC | 80 | * | AS43885 |
| Aug 30, 10:09 UTC | 80 | * | AS262437 |
| Aug 30, 10:09 UTC | 80 | * | AS206991 |
| Aug 30, 10:09 UTC | 80 | * | AS146834 |
| Aug 30, 10:09 UTC | 70 | * | AS52129 |
| Aug 30, 10:09 UTC | 70 | * | AS58821 |
| Aug 30, 10:09 UTC | 70 | * | AS201814 |
| Aug 30, 10:09 UTC | 70 | * | AS139820 |
| Aug 30, 10:09 UTC | 90 | * | AS135478 |
| Aug 30, 10:09 UTC | 80 | * | AS23465 |
| Aug 30, 10:09 UTC | 70 | * | AS4314 |
| Aug 30, 10:09 UTC | 70 | * | AS393950 |
| Aug 30, 10:09 UTC | 70 | * | AS49770 |
| Aug 30, 10:09 UTC | 80 | * | AS51918 |
| Aug 30, 10:09 UTC | 80 | * | AS18001 |
| Aug 30, 10:09 UTC | 80 | * | AS24532 |
| Aug 30, 10:09 UTC | 80 | * | AS38325 |
| Aug 30, 10:09 UTC | 80 | * | AS43372 |
| Aug 30, 10:09 UTC | 70 | * | AS24432 |
| Aug 30, 10:09 UTC | 80 | * | AS197897 |
| Aug 30, 10:09 UTC | 70 | * | AS37410 |
| Aug 30, 10:09 UTC | 70 | * | AS36295 |
| Aug 30, 10:09 UTC | 70 | * | AS17210 |
| Aug 30, 10:09 UTC | 70 | * | AS53340 |
| Aug 30, 10:09 UTC | 80 | * | AS328442 |
| Aug 30, 10:09 UTC | 80 | * | AS63859 |
| Aug 30, 10:09 UTC | 80 | * | AS198798 |
| Aug 30, 10:09 UTC | 70 | * | AS152698 |
| Aug 30, 10:09 UTC | 80 | * | AS44851 |
| Aug 30, 10:09 UTC | 80 | * | AS12990 |
| Aug 30, 10:09 UTC | 80 | * | AS56030 |
| Aug 30, 10:09 UTC | 80 | * | AS48956 |
| Aug 30, 10:09 UTC | 80 | * | AS200239 |
| Aug 30, 10:09 UTC | 80 | * | AS197033 |
| Aug 30, 10:09 UTC | 80 | * | AS23678 |
| Aug 30, 10:09 UTC | 80 | * | AS28885 |
| Aug 30, 10:09 UTC | 80 | * | AS9335 |
| Aug 30, 10:09 UTC | 70 | * | AS24323 |
| Aug 30, 10:09 UTC | 70 | * | AS33635 |
| Aug 30, 10:09 UTC | 70 | * | AS131464 |
| Aug 30, 10:09 UTC | 90 | * | AS9943 |
| Aug 30, 10:09 UTC | 70 | * | AS40511 |
| Aug 30, 10:09 UTC | 80 | * | AS27501 |
| Aug 30, 10:09 UTC | 70 | * | AS208909 |
| Aug 30, 10:09 UTC | 80 | * | AS35530 |
| Aug 30, 10:09 UTC | 70 | * | AS6653 |
| Aug 30, 10:09 UTC | 80 | * | AS396420 |
| Aug 30, 10:09 UTC | 70 | * | AS56167 |
| Aug 30, 10:09 UTC | 70 | * | AS41079 |
| Aug 30, 10:09 UTC | 70 | * | AS14010 |
| Aug 30, 10:09 UTC | 80 | * | AS134146 |
| Aug 30, 10:09 UTC | 80 | * | AS200000 |
| Aug 30, 10:09 UTC | 70 | * | AS37088 |
| Aug 30, 10:09 UTC | 80 | * | AS26253 |
| Aug 30, 10:09 UTC | 70 | * | AS138640 |
| Aug 30, 10:09 UTC | 80 | * | AS132165 |
| Aug 30, 10:09 UTC | 80 | * | AS134806 |
| Aug 30, 10:09 UTC | 70 | * | AS40948 |
| Aug 30, 10:09 UTC | 80 | * | AS29667 |
| Aug 30, 10:09 UTC | 80 | * | AS132298 |
| Aug 30, 10:09 UTC | 80 | * | AS23422 |
Frequently Asked Questions
What is a BGP Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the Sudden withdrawal event feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-30 11:05 UTC.
How do I subscribe to Sudden withdrawal event events?
Subscribe to the Atom feed at /pulse/bgp/withdrawal.atom or poll the JSON endpoint at /api/pulse/bgp/withdrawal.