Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
10,404
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 10,404 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Aug 22, 06:12 UTC | 60 | 221.122.64.0/20 | AS23724 |
| Aug 22, 06:12 UTC | 60 | 38.225.218.0/24 | AS265705 |
| Aug 22, 06:12 UTC | 70 | 114.116.96.0/19 | AS23724 |
| Aug 22, 06:12 UTC | 60 | 105.234.148.0/24 | AS37440 |
| Aug 22, 06:12 UTC | 60 | 45.74.56.0/24 | AS140641 |
| Aug 22, 06:12 UTC | 60 | 140.141.0.0/17 | AS600 |
| Aug 22, 06:12 UTC | 60 | 223.203.100.0/24 | AS4847 |
| Aug 22, 06:12 UTC | 60 | 23.19.53.0/24 | AS205544 |
| Aug 22, 06:12 UTC | 60 | 102.220.88.0/22 | AS55933 |
| Aug 22, 06:12 UTC | 60 | 216.87.145.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 34.0.236.0/23 | AS19527 |
| Aug 22, 06:12 UTC | 60 | 27.123.2.0/24 | AS45706 |
| Aug 22, 06:12 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 70 | 103.3.213.0/24 | AS38149 |
| Aug 22, 06:12 UTC | 60 | 63.217.208.0/22 | AS31713 |
| Aug 22, 06:12 UTC | 60 | 63.216.152.0/22 | AS31713 |
| Aug 22, 06:12 UTC | 60 | 187.188.140.0/24 | AS17072 |
| Aug 22, 06:12 UTC | 60 | 118.201.228.0/24 | AS3758 |
| Aug 22, 06:12 UTC | 60 | 164.156.20.0/22 | AS10753 |
| Aug 22, 06:12 UTC | 70 | 101.124.22.0/24 | AS23724 |
| Aug 22, 06:12 UTC | 60 | 139.159.168.0/22 | AS58466 |
| Aug 22, 06:12 UTC | 60 | 190.90.218.0/24 | AS262589 |
| Aug 22, 06:12 UTC | 60 | 120.132.88.0/22 | AS23724 |
| Aug 22, 06:12 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 22, 06:12 UTC | 60 | 124.251.128.0/21 | AS9308 |
| Aug 22, 06:12 UTC | 70 | 85.51.74.0/23 | AS12479 |
| Aug 22, 06:12 UTC | 60 | 120.133.30.0/24 | AS4835 |
| Aug 22, 06:12 UTC | 70 | 167.244.247.0/24 | AS13536 |
| Aug 22, 06:12 UTC | 60 | 74.200.186.0/24 | AS22645 |
| Aug 22, 06:12 UTC | 60 | 118.197.56.0/21 | AS4811 |
| Aug 22, 06:12 UTC | 60 | 124.250.244.0/23 | AS9308 |
| Aug 22, 06:12 UTC | 60 | 192.12.94.0/24 | AS396549 |
| Aug 22, 06:12 UTC | 60 | 197.89.198.0/24 | AS20011 |
| Aug 22, 06:12 UTC | 60 | 35.206.32.0/19 | AS43515 |
| Aug 22, 06:12 UTC | 70 | 34.1.69.0/24 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 161.232.0.0/16 | AS12041 |
| Aug 22, 06:12 UTC | 60 | 197.89.141.0/24 | AS20011 |
| Aug 22, 06:12 UTC | 60 | 93.158.128.0/18 | AS208398 |
| Aug 22, 06:12 UTC | 60 | 216.87.145.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 150.129.82.0/23 | AS138968 |
| Aug 22, 06:12 UTC | 60 | 202.177.157.0/24 | AS132215 |
| Aug 22, 06:12 UTC | 60 | 185.162.75.0/24 | AS213122 |
| Aug 22, 06:12 UTC | 60 | 124.251.8.0/23 | AS9308 |
| Aug 22, 06:12 UTC | 60 | 192.82.133.0/24 | AS19836 |
| Aug 22, 06:12 UTC | 60 | 43.231.167.0/24 | AS23724 |
| Aug 22, 06:12 UTC | 60 | 194.121.203.0/24 | AS12480 |
| Aug 22, 06:12 UTC | 60 | 198.41.0.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 213.180.192.0/19 | AS208398 |
| Aug 22, 06:12 UTC | 60 | 63.218.146.0/23 | AS31713 |
| Aug 22, 06:12 UTC | 60 | 209.46.68.0/24 | AS36779 |
| Aug 22, 06:12 UTC | 80 | 193.183.47.0/24 | AS8473 |
| Aug 22, 06:12 UTC | 60 | 154.202.84.0/24 | AS328608 |
| Aug 22, 06:12 UTC | 60 | 35.207.0.0/18 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 200.7.212.0/24 | AS19114 |
| Aug 22, 06:12 UTC | 60 | 89.30.5.0/24 | AS4455 |
| Aug 22, 06:12 UTC | 70 | 192.42.93.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 45.183.32.0/22 | AS269310 |
| Aug 22, 06:12 UTC | 60 | 175.25.32.0/21 | AS23724 |
| Aug 22, 06:12 UTC | 60 | 199.4.190.0/24 | AS396879 |
| Aug 22, 06:12 UTC | 60 | 77.243.190.0/24 | AS16247 |
| Aug 22, 06:12 UTC | 60 | 1.12.14.0/23 | AS45090 |
| Aug 22, 06:12 UTC | 60 | 34.2.70.0/23 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 34.113.0.0/16 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 203.28.15.0/24 | AS207551 |
| Aug 22, 06:12 UTC | 60 | 37.19.219.0/24 | AS211612 |
| Aug 22, 06:12 UTC | 60 | 69.171.13.0/24 | AS13767 |
| Aug 22, 06:12 UTC | 60 | 197.89.185.0/24 | AS20011 |
| Aug 22, 06:12 UTC | 60 | 120.136.18.0/24 | AS4847 |
| Aug 22, 06:12 UTC | 60 | 192.173.112.0/24 | AS55095 |
| Aug 22, 06:12 UTC | 60 | 34.0.48.0/20 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 216.172.188.0/23 | AS31898 |
| Aug 22, 06:12 UTC | 80 | 192.42.93.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 22, 06:12 UTC | 60 | 67.221.16.0/20 | AS11584 |
| Aug 22, 06:12 UTC | 60 | 129.205.64.0/20 | AS37628 |
| Aug 22, 06:12 UTC | 60 | 63.216.150.0/24 | AS31713 |
| Aug 22, 06:12 UTC | 70 | 103.30.78.0/24 | AS932 |
| Aug 22, 06:12 UTC | 60 | 159.49.231.0/24 | AS29702 |
| Aug 22, 06:12 UTC | 80 | 192.30.45.0/24 | AS396549 |
| Aug 22, 06:12 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 43.229.51.0/24 | AS131274 |
| Aug 22, 06:12 UTC | 60 | 72.5.161.0/24 | AS14636 |
| Aug 22, 06:12 UTC | 60 | 192.52.178.0/24 | AS396566 |
| Aug 22, 06:12 UTC | 70 | 37.132.173.0/24 | AS12479 |
| Aug 22, 06:12 UTC | 60 | 117.48.156.0/22 | AS140292 |
| Aug 22, 06:12 UTC | 60 | 156.232.8.0/24 | AS17561 |
| Aug 22, 06:12 UTC | 60 | 185.26.155.0/24 | AS12684 |
| Aug 22, 06:12 UTC | 60 | 193.105.40.0/24 | AS196695 |
| Aug 22, 06:12 UTC | 70 | 192.42.176.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 118.145.36.0/22 | AS58466 |
| Aug 22, 06:12 UTC | 70 | 34.1.68.0/24 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 185.108.92.0/24 | AS205402 |
| Aug 22, 06:12 UTC | 60 | 57.140.209.0/24 | AS15169 |
| Aug 22, 06:12 UTC | 60 | 45.125.112.0/23 | AS58779 |
| Aug 22, 06:12 UTC | 60 | 102.220.88.0/22 | AS55933 |
| Aug 22, 06:12 UTC | 70 | 88.229.88.0/24 | AS47331 |
| Aug 22, 06:12 UTC | 60 | 63.222.65.0/24 | AS3491 |
| Aug 22, 06:12 UTC | 60 | 14.103.120.0/21 | AS4811 |
| Aug 22, 06:12 UTC | 70 | 171.22.80.0/22 | AS197790 |
| Aug 22, 06:12 UTC | 80 | 192.30.45.0/24 | AS396549 |
| Aug 22, 06:12 UTC | 60 | 64.38.253.0/24 | AS32164 |
| Aug 22, 06:12 UTC | 60 | 170.140.99.0/24 | AS3512 |
| Aug 22, 06:12 UTC | 70 | 192.34.234.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 70 | 89.30.26.0/24 | AS4455 |
| Aug 22, 06:12 UTC | 70 | 103.3.212.0/24 | AS38149 |
| Aug 22, 06:12 UTC | 60 | 170.46.155.0/24 | AS18697 |
| Aug 22, 06:12 UTC | 60 | 83.118.224.0/22 | AS209242 |
| Aug 22, 06:12 UTC | 60 | 128.65.136.0/21 | AS44266 |
| Aug 22, 06:12 UTC | 60 | 43.226.57.0/24 | AS151302 |
| Aug 22, 06:12 UTC | 70 | 78.169.38.0/23 | AS47331 |
| Aug 22, 06:12 UTC | 60 | 82.108.73.0/24 | AS151338 |
| Aug 22, 06:12 UTC | 60 | 113.21.236.0/24 | AS4812 |
| Aug 22, 06:12 UTC | 60 | 24.248.247.0/24 | AS19905 |
| Aug 22, 06:12 UTC | 60 | 42.240.160.0/20 | AS58466 |
| Aug 22, 06:12 UTC | 60 | 195.49.142.0/24 | AS31216 |
| Aug 22, 06:12 UTC | 60 | 170.168.20.0/24 | AS43278 |
| Aug 22, 06:12 UTC | 60 | 192.41.162.0/24 | AS396566 |
| Aug 22, 06:12 UTC | 70 | 192.43.172.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 70 | 91.199.154.190/32 | AS62212 |
| Aug 22, 06:12 UTC | 60 | 57.140.192.0/18 | AS19527 |
| Aug 22, 06:12 UTC | 60 | 62.76.74.0/24 | AS49199 |
| Aug 22, 06:12 UTC | 60 | 103.200.220.0/24 | AS4812 |
| Aug 22, 06:12 UTC | 60 | 212.163.8.0/24 | AS12541 |
| Aug 22, 06:12 UTC | 60 | 93.88.176.0/20 | AS44868 |
| Aug 22, 06:12 UTC | 60 | 121.250.56.0/21 | AS141005 |
| Aug 22, 06:12 UTC | 70 | 87.218.110.0/24 | AS12479 |
| Aug 22, 06:12 UTC | 60 | 181.119.118.0/24 | AS52468 |
| Aug 22, 06:12 UTC | 70 | 120.132.177.0/24 | AS58466 |
| Aug 22, 06:12 UTC | 70 | 192.26.92.0/24 | AS396549 |
| Aug 22, 06:12 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 22, 06:12 UTC | 60 | 201.50.114.0/24 | AS214833 |
| Aug 22, 06:12 UTC | 60 | 208.52.177.0/24 | AS400196 |
| Aug 22, 06:12 UTC | 60 | 38.76.222.0/23 | AS401701 |
| Aug 22, 06:12 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 22, 06:12 UTC | 60 | 141.11.237.0/24 | AS198831 |
| Aug 22, 06:12 UTC | 60 | 223.196.4.0/24 | AS55410 |
| Aug 22, 06:12 UTC | 60 | 121.251.208.0/21 | AS4538 |
| Aug 22, 06:12 UTC | 70 | 182.175.243.0/24 | AS4811 |
| Aug 22, 06:12 UTC | 60 | 120.132.124.0/22 | AS58466 |
| Aug 22, 06:12 UTC | 60 | 199.7.71.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 70 | 163.61.146.0/24 | AS153618 |
| Aug 22, 06:12 UTC | 60 | 117.48.148.0/22 | AS140292 |
| Aug 22, 06:12 UTC | 60 | 209.23.97.0/24 | AS15065 |
| Aug 22, 06:12 UTC | 60 | 118.197.0.0/21 | AS4811 |
| Aug 22, 06:12 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 38.89.68.0/24 | AS22369 |
| Aug 22, 06:12 UTC | 60 | 152.65.226.0/24 | AS19527 |
| Aug 22, 06:12 UTC | 60 | 34.191.88.0/21 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 211.151.84.0/23 | AS9308 |
| Aug 22, 06:12 UTC | 60 | 192.42.176.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 91.223.68.0/24 | AS2115 |
| Aug 22, 06:12 UTC | 60 | 43.226.59.0/24 | AS151302 |
| Aug 22, 06:12 UTC | 60 | 174.47.195.0/24 | AS15065 |
| Aug 22, 06:12 UTC | 60 | 192.26.92.0/24 | AS396549 |
| Aug 22, 06:12 UTC | 60 | 45.195.159.0/24 | AS135222 |
| Aug 22, 06:12 UTC | 60 | 121.250.88.0/23 | AS141005 |
| Aug 22, 06:12 UTC | 60 | 192.67.239.0/24 | AS23918 |
| Aug 22, 06:12 UTC | 60 | 197.89.142.0/24 | AS20011 |
| Aug 22, 06:12 UTC | 60 | 136.0.34.0/24 | AS213840 |
| Aug 22, 06:12 UTC | 60 | 192.23.185.0/24 | AS72 |
| Aug 22, 06:12 UTC | 60 | 205.209.193.0/24 | AS17025 |
| Aug 22, 06:12 UTC | 60 | 178.154.128.0/19 | AS208398 |
| Aug 22, 06:12 UTC | 60 | 204.157.74.0/24 | AS272930 |
| Aug 22, 06:12 UTC | 60 | 52.82.167.0/24 | AS135629 |
| Aug 22, 06:12 UTC | 60 | 195.5.79.0/24 | AS8903 |
| Aug 22, 06:12 UTC | 60 | 12.148.180.0/22 | AS19299 |
| Aug 22, 06:12 UTC | 60 | 154.58.196.0/24 | AS44431 |
| Aug 22, 06:12 UTC | 60 | 154.12.190.0/23 | AS32519 |
| Aug 22, 06:12 UTC | 60 | 23.129.76.0/24 | AS13378 |
| Aug 22, 06:12 UTC | 70 | 216.87.145.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 156.255.0.0/24 | AS54801 |
| Aug 22, 06:12 UTC | 60 | 120.136.19.0/24 | AS4847 |
| Aug 22, 06:12 UTC | 60 | 120.92.184.0/23 | AS4811 |
| Aug 22, 06:12 UTC | 60 | 170.33.93.0/24 | AS45102 |
| Aug 22, 06:12 UTC | 60 | 115.84.165.0/24 | AS17574 |
| Aug 22, 06:12 UTC | 70 | 185.179.52.0/23 | AS15397 |
| Aug 22, 06:12 UTC | 60 | 139.159.108.0/23 | AS4811 |
| Aug 22, 06:12 UTC | 60 | 207.189.143.0/24 | AS394347 |
| Aug 22, 06:12 UTC | 60 | 45.155.100.0/23 | AS42831 |
| Aug 22, 06:12 UTC | 60 | 62.8.74.0/24 | AS15399 |
| Aug 22, 06:12 UTC | 60 | 152.65.230.0/24 | AS19527 |
| Aug 22, 06:12 UTC | 60 | 147.78.60.0/24 | AS40513 |
| Aug 22, 06:12 UTC | 70 | 123.103.13.0/24 | AS23724 |
| Aug 22, 06:12 UTC | 60 | 118.196.112.0/21 | AS4811 |
| Aug 22, 06:12 UTC | 70 | 198.41.0.0/24 | AS397197 |
| Aug 22, 06:12 UTC | 60 | 185.133.64.0/24 | AS9050 |
| Aug 22, 06:12 UTC | 60 | 216.245.88.0/24 | AS28753 |
| Aug 22, 06:12 UTC | 60 | 57.140.209.0/24 | AS15169 |
| Aug 22, 06:12 UTC | 60 | 189.39.185.0/24 | AS270792 |
| Aug 22, 06:12 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 22, 06:12 UTC | 60 | 185.186.205.0/24 | AS206350 |
| Aug 22, 06:12 UTC | 60 | 35.219.128.0/18 | AS43515 |
| Aug 22, 06:12 UTC | 60 | 118.197.48.0/21 | AS4811 |
| Aug 22, 06:12 UTC | 60 | 107.6.119.0/24 | AS14636 |
| Aug 22, 06:12 UTC | 60 | 195.49.184.0/22 | AS44266 |
| Aug 22, 06:12 UTC | 60 | 63.222.45.0/24 | AS31713 |
| Aug 22, 06:12 UTC | 60 | 123.59.192.0/19 | AS23724 |
| Aug 22, 06:12 UTC | 60 | 201.159.131.0/24 | AS22908 |
| Aug 22, 06:12 UTC | 60 | 165.224.140.0/24 | AS3423 |
| Aug 22, 06:12 UTC | 70 | 185.113.232.0/22 | AS29644 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-22 06:15 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
