Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
10,805
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 10,805 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Aug 15, 03:12 UTC | 60 | 69.171.13.0/24 | AS13767 |
| Aug 15, 03:12 UTC | 60 | 192.82.133.0/24 | AS19836 |
| Aug 15, 03:12 UTC | 60 | 63.218.14.0/23 | AS3491 |
| Aug 15, 03:12 UTC | 60 | 84.22.151.0/24 | AS210644 |
| Aug 15, 03:12 UTC | 60 | 151.245.239.0/24 | AS212238 |
| Aug 15, 03:12 UTC | 60 | 63.218.150.0/23 | AS3491 |
| Aug 15, 03:12 UTC | 60 | 198.91.73.0/24 | AS37 |
| Aug 15, 03:12 UTC | 70 | 103.143.84.0/24 | AS139488 |
| Aug 15, 03:12 UTC | 70 | 45.9.8.0/24 | AS41378 |
| Aug 15, 03:12 UTC | 70 | 192.42.173.0/24 | AS397197 |
| Aug 15, 03:12 UTC | 60 | 110.43.248.0/21 | AS58466 |
| Aug 15, 03:12 UTC | 60 | 14.103.128.0/21 | AS4811 |
| Aug 15, 03:12 UTC | 60 | 155.28.140.0/24 | AS1516 |
| Aug 15, 03:12 UTC | 60 | 204.74.104.0/23 | AS399169 |
| Aug 15, 03:12 UTC | 60 | 149.88.160.0/24 | AS9304 |
| Aug 15, 03:12 UTC | 60 | 65.170.218.0/24 | AS396411 |
| Aug 15, 03:12 UTC | 60 | 38.210.13.0/24 | AS28458 |
| Aug 15, 03:12 UTC | 60 | 176.97.159.0/24 | AS198949 |
| Aug 15, 03:12 UTC | 60 | 154.201.90.0/23 | AS8796 |
| Aug 15, 03:12 UTC | 70 | 113.209.197.0/24 | AS4847 |
| Aug 15, 03:12 UTC | 60 | 63.222.187.0/24 | AS3491 |
| Aug 15, 03:12 UTC | 60 | 206.43.35.0/24 | AS267587 |
| Aug 15, 03:12 UTC | 60 | 35.212.0.0/14 | AS15169 |
| Aug 15, 03:12 UTC | 60 | 119.29.29.0/24 | AS132203 |
| Aug 15, 03:12 UTC | 60 | 113.31.112.0/20 | AS4811 |
| Aug 15, 03:12 UTC | 60 | 64.41.117.0/24 | AS3064 |
| Aug 15, 03:12 UTC | 60 | 43.255.84.0/22 | AS138950 |
| Aug 15, 03:12 UTC | 70 | 201.28.0.0/17 | AS10429 |
| Aug 15, 03:12 UTC | 60 | 179.1.123.0/24 | AS18678 |
| Aug 15, 03:12 UTC | 60 | 45.87.225.0/24 | AS215624 |
| Aug 15, 03:12 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 15, 03:12 UTC | 60 | 185.117.184.0/22 | AS200873 |
| Aug 15, 03:12 UTC | 60 | 82.39.144.0/24 | AS42831 |
| Aug 15, 03:12 UTC | 60 | 113.209.130.0/24 | AS4847 |
| Aug 15, 03:12 UTC | 60 | 129.33.188.0/24 | AS812 |
| Aug 15, 03:12 UTC | 70 | 103.56.76.0/24 | AS58466 |
| Aug 15, 03:12 UTC | 60 | 43.229.48.0/24 | AS55996 |
| Aug 15, 03:12 UTC | 70 | 36.140.76.0/22 | AS9808 |
| Aug 15, 03:12 UTC | 60 | 103.85.86.0/24 | AS131483 |
| Aug 15, 03:12 UTC | 60 | 192.68.130.0/24 | AS396549 |
| Aug 15, 03:12 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 15, 03:12 UTC | 60 | 129.227.160.0/21 | AS4229 |
| Aug 15, 03:12 UTC | 70 | 154.205.198.0/24 | AS140227 |
| Aug 15, 03:12 UTC | 60 | 63.222.41.0/24 | AS3491 |
| Aug 15, 03:12 UTC | 60 | 124.251.230.0/24 | AS9308 |
| Aug 15, 03:12 UTC | 60 | 38.67.19.0/24 | AS62610 |
| Aug 15, 03:12 UTC | 70 | 211.99.192.0/19 | AS23724 |
| Aug 15, 03:12 UTC | 60 | 207.201.20.0/24 | AS209 |
| Aug 15, 03:12 UTC | 60 | 105.234.154.0/23 | AS327708 |
| Aug 15, 03:12 UTC | 60 | 43.226.57.0/24 | AS151302 |
| Aug 15, 03:12 UTC | 60 | 156.154.103.0/24 | AS12008 |
| Aug 15, 03:12 UTC | 60 | 71.18.95.0/24 | AS396986 |
| Aug 15, 03:12 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 15, 03:12 UTC | 70 | 144.34.224.0/20 | AS25820 |
| Aug 15, 03:12 UTC | 60 | 204.217.233.0/24 | AS20454 |
| Aug 15, 03:12 UTC | 60 | 45.194.63.0/24 | AS134963 |
| Aug 15, 03:12 UTC | 80 | 103.147.32.0/24 | AS140389 |
| Aug 15, 03:12 UTC | 60 | 118.196.112.0/21 | AS4811 |
| Aug 15, 03:12 UTC | 70 | 204.157.236.0/24 | AS52511 |
| Aug 15, 03:12 UTC | 80 | 177.2.188.0/22 | AS137535 |
| Aug 15, 03:12 UTC | 60 | 163.253.23.0/24 | AS396955 |
| Aug 15, 03:12 UTC | 70 | 176.222.82.0/24 | AS15704 |
| Aug 15, 03:12 UTC | 60 | 199.5.59.0/24 | AS19409 |
| Aug 15, 03:12 UTC | 70 | 123.108.89.0/24 | AS131274 |
| Aug 15, 03:12 UTC | 60 | 63.219.0.0/20 | AS3491 |
| Aug 15, 03:12 UTC | 70 | 120.132.80.0/22 | AS23724 |
| Aug 15, 03:12 UTC | 60 | 187.249.32.0/24 | AS32098 |
| Aug 15, 03:12 UTC | 60 | 190.90.19.0/24 | AS18678 |
| Aug 15, 03:12 UTC | 60 | 14.103.56.0/21 | AS4811 |
| Aug 15, 03:12 UTC | 60 | 63.223.16.0/24 | AS3491 |
| Aug 15, 03:12 UTC | 60 | 121.52.208.0/20 | AS4847 |
| Aug 15, 03:12 UTC | 70 | 123.103.48.0/21 | AS23724 |
| Aug 15, 03:12 UTC | 60 | 45.117.153.0/24 | AS18222 |
| Aug 15, 03:12 UTC | 60 | 121.46.4.0/22 | AS58466 |
| Aug 15, 03:12 UTC | 60 | 207.56.230.0/24 | AS137535 |
| Aug 15, 03:12 UTC | 60 | 23.141.228.0/24 | AS174 |
| Aug 15, 03:12 UTC | 60 | 2.27.158.0/24 | AS213791 |
| Aug 15, 03:12 UTC | 60 | 219.232.120.0/24 | AS4847 |
| Aug 15, 03:12 UTC | 70 | 200.168.160.0/19 | AS10429 |
| Aug 15, 03:12 UTC | 60 | 86.109.8.0/24 | AS15830 |
| Aug 15, 03:12 UTC | 60 | 147.28.194.0/24 | AS15830 |
| Aug 15, 03:12 UTC | 60 | 147.28.200.0/24 | AS15830 |
| Aug 15, 03:12 UTC | 60 | 58.68.247.0/24 | AS4847 |
| Aug 15, 03:12 UTC | 70 | 201.0.244.0/24 | AS10429 |
| Aug 15, 03:12 UTC | 60 | 42.83.130.0/24 | AS24406 |
| Aug 15, 03:12 UTC | 60 | 195.184.244.0/24 | AS207230 |
| Aug 15, 03:12 UTC | 60 | 23.144.60.0/24 | AS174 |
| Aug 15, 03:12 UTC | 60 | 103.229.8.0/24 | AS16509 |
| Aug 15, 03:12 UTC | 70 | 192.16.134.0/24 | AS25181 |
| Aug 15, 03:12 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 15, 03:12 UTC | 60 | 103.202.108.0/22 | AS4811 |
| Aug 15, 03:12 UTC | 70 | 134.255.199.0/24 | AS48678 |
| Aug 15, 03:12 UTC | 60 | 106.3.139.0/24 | AS63199 |
| Aug 15, 03:12 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 15, 03:12 UTC | 60 | 204.74.104.0/23 | AS399169 |
| Aug 15, 03:12 UTC | 60 | 223.196.112.0/24 | AS55410 |
| Aug 15, 03:12 UTC | 70 | 185.148.13.0/24 | AS41378 |
| Aug 15, 03:12 UTC | 60 | 5.45.205.0/24 | AS208398 |
| Aug 15, 03:12 UTC | 70 | 34.2.76.0/23 | AS43515 |
| Aug 15, 03:12 UTC | 60 | 37.26.72.0/23 | AS47443 |
| Aug 15, 03:12 UTC | 70 | 102.135.27.0/24 | AS9009 |
| Aug 15, 03:12 UTC | 60 | 103.202.120.0/22 | AS4811 |
| Aug 15, 03:12 UTC | 60 | 185.67.167.0/24 | AS40966 |
| Aug 15, 03:12 UTC | 60 | 192.33.14.0/24 | AS396748 |
| Aug 15, 03:12 UTC | 60 | 83.243.16.0/21 | AS4455 |
| Aug 15, 03:12 UTC | 70 | 185.231.226.0/24 | AS197555 |
| Aug 15, 03:12 UTC | 70 | 103.154.127.0/24 | AS131111 |
| Aug 15, 03:12 UTC | 60 | 177.4.82.0/24 | AS137535 |
| Aug 15, 03:12 UTC | 60 | 209.23.81.0/24 | AS15065 |
| Aug 15, 03:12 UTC | 60 | 192.42.93.0/24 | AS397197 |
| Aug 15, 03:12 UTC | 60 | 195.5.84.0/22 | AS8903 |
| Aug 15, 03:12 UTC | 60 | 120.132.40.0/22 | AS23724 |
| Aug 15, 03:12 UTC | 60 | 66.22.29.0/24 | AS25773 |
| Aug 15, 03:12 UTC | 60 | 170.33.88.0/24 | AS45102 |
| Aug 15, 03:12 UTC | 70 | 115.186.0.0/24 | AS38616 |
| Aug 15, 03:12 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 15, 03:12 UTC | 60 | 128.1.28.0/24 | AS62610 |
| Aug 15, 03:12 UTC | 60 | 174.46.68.0/23 | AS15065 |
| Aug 15, 03:12 UTC | 80 | 201.139.115.0/24 | AS32098 |
| Aug 15, 03:12 UTC | 70 | 64.186.244.0/24 | AS906 |
| Aug 15, 03:12 UTC | 60 | 202.63.123.0/24 | AS150008 |
| Aug 15, 03:12 UTC | 70 | 117.122.240.0/24 | AS4847 |
| Aug 15, 03:12 UTC | 70 | 154.39.82.0/24 | AS140227 |
| Aug 15, 03:12 UTC | 70 | 52.82.184.0/23 | AS135629 |
| Aug 15, 03:12 UTC | 70 | 185.218.6.0/24 | AS51089 |
| Aug 15, 03:12 UTC | 70 | 2.27.98.0/24 | AS9304 |
| Aug 15, 03:12 UTC | 60 | 192.33.14.0/24 | AS396748 |
| Aug 15, 03:12 UTC | 60 | 185.218.1.0/24 | AS58061 |
| Aug 15, 03:12 UTC | 60 | 103.213.64.0/19 | AS4808 |
| Aug 15, 03:12 UTC | 70 | 159.153.56.0/23 | AS393342 |
| Aug 15, 03:12 UTC | 70 | 36.140.108.0/23 | AS9808 |
| Aug 15, 03:12 UTC | 70 | 104.249.173.0/24 | AS41378 |
| Aug 15, 03:12 UTC | 60 | 200.57.95.0/24 | AS22908 |
| Aug 15, 03:12 UTC | 60 | 118.196.96.0/21 | AS4811 |
| Aug 15, 03:12 UTC | 60 | 159.49.159.0/24 | AS29702 |
| Aug 15, 03:12 UTC | 60 | 95.177.63.0/24 | AS3257 |
| Aug 15, 03:12 UTC | 60 | 34.2.114.0/23 | AS19527 |
| Aug 15, 03:12 UTC | 70 | 154.205.209.0/24 | AS140227 |
| Aug 15, 03:12 UTC | 60 | 103.6.222.0/24 | AS4811 |
| Aug 15, 03:12 UTC | 60 | 34.0.32.0/20 | AS19527 |
| Aug 15, 03:12 UTC | 60 | 34.0.228.0/24 | AS15169 |
| Aug 15, 03:12 UTC | 60 | 199.233.244.0/22 | AS10753 |
| Aug 15, 03:12 UTC | 60 | 117.122.214.0/24 | AS4847 |
| Aug 15, 03:12 UTC | 70 | 207.56.226.0/23 | AS137535 |
| Aug 15, 03:12 UTC | 60 | 114.113.152.0/21 | AS4847 |
| Aug 15, 03:12 UTC | 70 | 177.7.133.0/24 | AS140227 |
| Aug 15, 03:12 UTC | 70 | 192.68.126.0/24 | AS19836 |
| Aug 15, 03:12 UTC | 60 | 147.75.35.0/24 | AS15830 |
| Aug 15, 03:12 UTC | 60 | 80.66.121.0/24 | AS8903 |
| Aug 15, 03:12 UTC | 60 | 170.33.72.0/24 | AS45102 |
| Aug 15, 03:12 UTC | 70 | 87.217.135.0/24 | AS12479 |
| Aug 15, 03:12 UTC | 60 | 192.82.134.0/24 | AS397197 |
| Aug 15, 03:12 UTC | 70 | 154.205.221.0/24 | AS140227 |
| Aug 15, 03:12 UTC | 60 | 216.145.222.0/24 | AS30031 |
| Aug 15, 03:12 UTC | 60 | 154.86.0.0/24 | AS54801 |
| Aug 15, 03:12 UTC | 60 | 103.23.127.0/24 | AS211559 |
| Aug 15, 03:12 UTC | 60 | 91.204.144.0/22 | AS44266 |
| Aug 15, 03:12 UTC | 70 | 200.168.192.0/18 | AS10429 |
| Aug 15, 03:12 UTC | 60 | 34.1.108.0/24 | AS19527 |
| Aug 15, 03:12 UTC | 70 | 173.242.116.0/22 | AS25820 |
| Aug 15, 03:12 UTC | 70 | 200.162.52.0/24 | AS10429 |
| Aug 15, 03:12 UTC | 70 | 77.91.122.0/24 | AS201814 |
| Aug 15, 03:12 UTC | 60 | 205.198.43.0/24 | AS134963 |
| Aug 15, 03:12 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 15, 03:12 UTC | 60 | 103.202.55.0/24 | AS931 |
| Aug 15, 03:12 UTC | 60 | 104.234.192.0/24 | AS270187 |
| Aug 15, 03:12 UTC | 70 | 110.43.152.0/21 | AS4811 |
| Aug 15, 03:12 UTC | 60 | 63.222.161.0/24 | AS31713 |
| Aug 15, 03:12 UTC | 60 | 57.140.192.0/18 | AS19527 |
| Aug 15, 03:12 UTC | 60 | 50.118.136.0/24 | AS5511 |
| Aug 15, 03:12 UTC | 60 | 45.239.177.0/24 | AS273593 |
| Aug 15, 03:12 UTC | 60 | 103.28.82.0/24 | AS45723 |
| Aug 15, 03:12 UTC | 60 | 208.33.25.0/24 | AS174 |
| Aug 15, 03:12 UTC | 60 | 194.28.206.0/24 | AS49505 |
| Aug 15, 03:12 UTC | 60 | 179.255.189.0/24 | AS214238 |
| Aug 15, 03:12 UTC | 60 | 181.215.152.0/24 | AS61317 |
| Aug 15, 03:12 UTC | 60 | 164.236.10.0/24 | AS27047 |
| Aug 15, 03:12 UTC | 70 | 120.133.16.0/21 | AS133119 |
| Aug 15, 03:12 UTC | 60 | 34.0.232.0/24 | AS43515 |
| Aug 15, 03:12 UTC | 70 | 95.214.99.0/24 | AS205888 |
| Aug 15, 03:12 UTC | 60 | 189.50.144.0/20 | AS271724 |
| Aug 15, 03:12 UTC | 60 | 193.46.135.0/24 | AS207021 |
| Aug 15, 03:12 UTC | 60 | 122.9.0.0/19 | AS23724 |
| Aug 15, 03:12 UTC | 60 | 202.47.109.0/24 | AS4812 |
| Aug 15, 03:12 UTC | 60 | 114.112.104.0/22 | AS23724 |
| Aug 15, 03:12 UTC | 70 | 103.127.242.0/23 | AS137535 |
| Aug 15, 03:12 UTC | 60 | 133.88.76.0/24 | AS131950 |
| Aug 15, 03:12 UTC | 60 | 188.65.30.0/24 | AS15679 |
| Aug 15, 03:12 UTC | 70 | 192.34.234.0/24 | AS397197 |
| Aug 15, 03:12 UTC | 60 | 192.12.94.0/24 | AS396549 |
| Aug 15, 03:12 UTC | 60 | 205.70.128.0/20 | AS647 |
| Aug 15, 03:12 UTC | 60 | 216.87.165.0/24 | AS3064 |
| Aug 15, 03:12 UTC | 60 | 105.234.154.0/23 | AS327708 |
| Aug 15, 03:12 UTC | 60 | 170.0.204.0/22 | AS271724 |
| Aug 15, 03:12 UTC | 60 | 63.218.124.0/23 | AS3491 |
| Aug 15, 03:12 UTC | 60 | 46.253.44.0/24 | AS43926 |
| Aug 15, 03:12 UTC | 60 | 160.48.160.0/23 | AS3257 |
| Aug 15, 03:12 UTC | 80 | 103.150.61.0/24 | AS140389 |
| Aug 15, 03:12 UTC | 60 | 192.122.175.0/24 | AS1312 |
| Aug 15, 03:12 UTC | 60 | 156.245.1.0/24 | AS17561 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-15 03:25 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
