Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
11,868
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 11,868 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Aug 29, 20:53 UTC | 60 | 38.188.165.0/24 | AS273113 |
| Aug 29, 20:53 UTC | 60 | 89.130.128.0/22 | AS12479 |
| Aug 29, 20:53 UTC | 60 | 102.208.230.0/24 | AS328882 |
| Aug 29, 20:53 UTC | 60 | 110.43.48.0/21 | AS58466 |
| Aug 29, 20:53 UTC | 60 | 147.28.174.0/23 | AS15830 |
| Aug 29, 20:53 UTC | 60 | 192.82.134.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 103.118.52.0/22 | AS4847 |
| Aug 29, 20:53 UTC | 70 | 192.31.80.0/24 | AS396549 |
| Aug 29, 20:53 UTC | 60 | 45.12.35.0/24 | AS200313 |
| Aug 29, 20:53 UTC | 60 | 103.12.55.0/24 | AS40605 |
| Aug 29, 20:53 UTC | 60 | 63.218.148.0/23 | AS31713 |
| Aug 29, 20:53 UTC | 60 | 192.34.234.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 70 | 192.54.112.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 34.190.88.0/21 | AS15169 |
| Aug 29, 20:53 UTC | 60 | 170.61.128.0/18 | AS11911 |
| Aug 29, 20:53 UTC | 70 | 163.5.53.0/24 | AS215898 |
| Aug 29, 20:53 UTC | 60 | 154.86.0.0/24 | AS54801 |
| Aug 29, 20:53 UTC | 60 | 103.36.168.0/24 | AS4811 |
| Aug 29, 20:53 UTC | 60 | 201.91.0.0/17 | AS10429 |
| Aug 29, 20:53 UTC | 60 | 43.231.169.0/24 | AS23724 |
| Aug 29, 20:53 UTC | 60 | 192.33.14.0/24 | AS396748 |
| Aug 29, 20:53 UTC | 60 | 177.2.185.0/24 | AS137535 |
| Aug 29, 20:53 UTC | 60 | 154.223.134.0/23 | AS13335 |
| Aug 29, 20:53 UTC | 60 | 192.82.133.0/24 | AS19836 |
| Aug 29, 20:53 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 29, 20:53 UTC | 60 | 173.245.150.0/24 | AS15065 |
| Aug 29, 20:53 UTC | 60 | 38.95.121.0/24 | AS152672 |
| Aug 29, 20:53 UTC | 60 | 66.148.24.0/24 | AS395177 |
| Aug 29, 20:53 UTC | 60 | 197.89.196.0/24 | AS20011 |
| Aug 29, 20:53 UTC | 60 | 163.253.23.0/24 | AS396955 |
| Aug 29, 20:53 UTC | 60 | 222.167.35.0/24 | AS211392 |
| Aug 29, 20:53 UTC | 60 | 120.131.12.0/23 | AS59019 |
| Aug 29, 20:53 UTC | 60 | 34.2.76.0/23 | AS43515 |
| Aug 29, 20:53 UTC | 60 | 38.19.214.0/24 | AS53107 |
| Aug 29, 20:53 UTC | 60 | 103.56.78.0/24 | AS58466 |
| Aug 29, 20:53 UTC | 70 | 69.25.152.0/24 | AS21734 |
| Aug 29, 20:53 UTC | 60 | 216.133.108.0/22 | AS2914 |
| Aug 29, 20:53 UTC | 60 | 103.61.60.0/24 | AS138457 |
| Aug 29, 20:53 UTC | 60 | 117.51.172.0/22 | AS58466 |
| Aug 29, 20:53 UTC | 60 | 194.67.75.0/24 | AS197695 |
| Aug 29, 20:53 UTC | 60 | 88.254.140.0/24 | AS47331 |
| Aug 29, 20:53 UTC | 80 | 31.217.225.0/24 | AS198392 |
| Aug 29, 20:53 UTC | 60 | 63.218.192.0/23 | AS31713 |
| Aug 29, 20:53 UTC | 60 | 34.112.0.0/14 | AS15169 |
| Aug 29, 20:53 UTC | 60 | 91.240.219.0/24 | AS206850 |
| Aug 29, 20:53 UTC | 70 | 197.89.7.0/24 | AS20011 |
| Aug 29, 20:53 UTC | 60 | 180.184.148.0/22 | AS4811 |
| Aug 29, 20:53 UTC | 60 | 210.77.144.0/21 | AS9308 |
| Aug 29, 20:53 UTC | 60 | 209.40.88.0/24 | AS397765 |
| Aug 29, 20:53 UTC | 60 | 63.216.140.0/24 | AS31713 |
| Aug 29, 20:53 UTC | 60 | 34.1.90.0/24 | AS15169 |
| Aug 29, 20:53 UTC | 60 | 192.52.178.0/24 | AS396566 |
| Aug 29, 20:53 UTC | 70 | 123.108.88.0/24 | AS55996 |
| Aug 29, 20:53 UTC | 60 | 156.154.101.0/24 | AS12008 |
| Aug 29, 20:53 UTC | 70 | 160.236.166.0/24 | AS136969 |
| Aug 29, 20:53 UTC | 60 | 197.89.195.0/24 | AS20011 |
| Aug 29, 20:53 UTC | 60 | 192.54.112.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 88.237.252.0/24 | AS47331 |
| Aug 29, 20:53 UTC | 60 | 192.35.51.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 213.9.128.0/24 | AS8903 |
| Aug 29, 20:53 UTC | 70 | 154.194.200.0/22 | AS19318 |
| Aug 29, 20:53 UTC | 60 | 63.221.240.0/24 | AS31713 |
| Aug 29, 20:53 UTC | 70 | 45.204.192.0/19 | AS62468 |
| Aug 29, 20:53 UTC | 60 | 103.212.30.0/24 | AS134909 |
| Aug 29, 20:53 UTC | 70 | 152.175.214.0/24 | AS8143 |
| Aug 29, 20:53 UTC | 60 | 120.136.17.0/24 | AS4847 |
| Aug 29, 20:53 UTC | 60 | 63.218.156.0/23 | AS31713 |
| Aug 29, 20:53 UTC | 60 | 89.30.121.0/24 | AS4455 |
| Aug 29, 20:53 UTC | 60 | 139.159.110.0/24 | AS4811 |
| Aug 29, 20:53 UTC | 60 | 195.39.194.0/23 | AS60798 |
| Aug 29, 20:53 UTC | 60 | 34.0.16.0/20 | AS19527 |
| Aug 29, 20:53 UTC | 70 | 23.180.136.0/24 | AS209242 |
| Aug 29, 20:53 UTC | 60 | 170.33.20.0/24 | AS45102 |
| Aug 29, 20:53 UTC | 60 | 41.191.239.0/24 | AS37123 |
| Aug 29, 20:53 UTC | 60 | 195.5.78.0/24 | AS8903 |
| Aug 29, 20:53 UTC | 60 | 123.103.72.0/21 | AS23724 |
| Aug 29, 20:53 UTC | 60 | 38.247.27.0/24 | AS152672 |
| Aug 29, 20:53 UTC | 60 | 38.127.93.0/24 | AS174 |
| Aug 29, 20:53 UTC | 60 | 200.112.128.0/24 | AS22080 |
| Aug 29, 20:53 UTC | 60 | 175.107.240.0/24 | AS24440 |
| Aug 29, 20:53 UTC | 60 | 192.42.177.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 192.16.136.0/24 | AS25181 |
| Aug 29, 20:53 UTC | 60 | 110.43.144.0/21 | AS4811 |
| Aug 29, 20:53 UTC | 80 | 185.25.95.0/24 | AS207231 |
| Aug 29, 20:53 UTC | 60 | 121.251.0.0/20 | AS24362 |
| Aug 29, 20:53 UTC | 60 | 23.27.114.0/24 | AS199550 |
| Aug 29, 20:53 UTC | 60 | 102.129.92.0/24 | AS37451 |
| Aug 29, 20:53 UTC | 70 | 80.174.162.0/24 | AS197646 |
| Aug 29, 20:53 UTC | 60 | 203.19.219.0/24 | AS7575 |
| Aug 29, 20:53 UTC | 60 | 37.135.0.0/16 | AS12479 |
| Aug 29, 20:53 UTC | 70 | 41.173.24.0/21 | AS30844 |
| Aug 29, 20:53 UTC | 60 | 59.79.0.0/16 | AS4538 |
| Aug 29, 20:53 UTC | 70 | 101.52.216.0/22 | AS4811 |
| Aug 29, 20:53 UTC | 70 | 154.53.208.0/24 | AS328500 |
| Aug 29, 20:53 UTC | 60 | 192.42.176.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 71.18.162.0/24 | AS396986 |
| Aug 29, 20:53 UTC | 60 | 118.145.44.0/22 | AS58466 |
| Aug 29, 20:53 UTC | 60 | 222.204.0.0/16 | AS4538 |
| Aug 29, 20:53 UTC | 60 | 35.206.3.0/24 | AS19527 |
| Aug 29, 20:53 UTC | 60 | 34.1.93.0/24 | AS15169 |
| Aug 29, 20:53 UTC | 60 | 209.87.172.0/24 | AS142240 |
| Aug 29, 20:53 UTC | 60 | 34.1.91.0/24 | AS15169 |
| Aug 29, 20:53 UTC | 60 | 154.43.165.0/24 | AS211691 |
| Aug 29, 20:53 UTC | 70 | 192.35.51.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 64.38.253.0/24 | AS32164 |
| Aug 29, 20:53 UTC | 70 | 114.116.96.0/19 | AS23724 |
| Aug 29, 20:53 UTC | 60 | 45.74.56.0/24 | AS140641 |
| Aug 29, 20:53 UTC | 60 | 223.203.100.0/24 | AS4847 |
| Aug 29, 20:53 UTC | 60 | 23.19.53.0/24 | AS205544 |
| Aug 29, 20:53 UTC | 60 | 102.220.88.0/22 | AS55933 |
| Aug 29, 20:53 UTC | 60 | 216.87.145.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 70 | 206.147.186.0/24 | AS5715 |
| Aug 29, 20:53 UTC | 60 | 34.0.236.0/23 | AS19527 |
| Aug 29, 20:53 UTC | 60 | 27.123.2.0/24 | AS45706 |
| Aug 29, 20:53 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 63.217.208.0/22 | AS31713 |
| Aug 29, 20:53 UTC | 60 | 63.216.152.0/22 | AS31713 |
| Aug 29, 20:53 UTC | 60 | 187.188.140.0/24 | AS17072 |
| Aug 29, 20:53 UTC | 60 | 107.163.56.0/24 | AS395776 |
| Aug 29, 20:53 UTC | 60 | 5.182.34.0/24 | AS201030 |
| Aug 29, 20:53 UTC | 60 | 164.156.20.0/22 | AS10753 |
| Aug 29, 20:53 UTC | 80 | 23.26.16.0/22 | AS401152 |
| Aug 29, 20:53 UTC | 70 | 101.124.22.0/24 | AS23724 |
| Aug 29, 20:53 UTC | 60 | 139.159.168.0/22 | AS58466 |
| Aug 29, 20:53 UTC | 60 | 190.90.218.0/24 | AS262589 |
| Aug 29, 20:53 UTC | 60 | 120.132.88.0/22 | AS23724 |
| Aug 29, 20:53 UTC | 70 | 192.33.14.0/24 | AS396748 |
| Aug 29, 20:53 UTC | 80 | 192.42.178.0/24 | AS396566 |
| Aug 29, 20:53 UTC | 60 | 124.251.128.0/21 | AS9308 |
| Aug 29, 20:53 UTC | 60 | 120.133.30.0/24 | AS4835 |
| Aug 29, 20:53 UTC | 80 | 38.95.112.0/24 | AS152672 |
| Aug 29, 20:53 UTC | 60 | 74.200.186.0/24 | AS22645 |
| Aug 29, 20:53 UTC | 60 | 12.185.7.0/24 | AS4185 |
| Aug 29, 20:53 UTC | 60 | 41.79.248.0/24 | AS31713 |
| Aug 29, 20:53 UTC | 60 | 118.197.56.0/21 | AS4811 |
| Aug 29, 20:53 UTC | 60 | 124.250.244.0/23 | AS9308 |
| Aug 29, 20:53 UTC | 60 | 192.12.94.0/24 | AS396549 |
| Aug 29, 20:53 UTC | 60 | 90.77.224.0/22 | AS12479 |
| Aug 29, 20:53 UTC | 60 | 197.89.198.0/24 | AS20011 |
| Aug 29, 20:53 UTC | 60 | 35.206.32.0/19 | AS43515 |
| Aug 29, 20:53 UTC | 60 | 156.154.150.0/23 | AS399169 |
| Aug 29, 20:53 UTC | 60 | 170.140.99.0/24 | AS3512 |
| Aug 29, 20:53 UTC | 70 | 192.34.234.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 80 | 185.194.173.0/24 | AS203543 |
| Aug 29, 20:53 UTC | 70 | 89.30.26.0/24 | AS4455 |
| Aug 29, 20:53 UTC | 60 | 83.118.224.0/22 | AS209242 |
| Aug 29, 20:53 UTC | 60 | 170.46.155.0/24 | AS18697 |
| Aug 29, 20:53 UTC | 80 | 192.238.236.90/32 | AS138995 |
| Aug 29, 20:53 UTC | 60 | 128.65.136.0/21 | AS44266 |
| Aug 29, 20:53 UTC | 60 | 78.169.38.0/23 | AS47331 |
| Aug 29, 20:53 UTC | 60 | 82.108.73.0/24 | AS151338 |
| Aug 29, 20:53 UTC | 70 | 34.1.69.0/24 | AS43515 |
| Aug 29, 20:53 UTC | 60 | 113.21.236.0/24 | AS4812 |
| Aug 29, 20:53 UTC | 60 | 24.248.247.0/24 | AS19905 |
| Aug 29, 20:53 UTC | 60 | 42.240.160.0/20 | AS58466 |
| Aug 29, 20:53 UTC | 60 | 167.219.58.0/24 | AS132384 |
| Aug 29, 20:53 UTC | 60 | 195.49.142.0/24 | AS31216 |
| Aug 29, 20:53 UTC | 60 | 170.168.20.0/24 | AS43278 |
| Aug 29, 20:53 UTC | 60 | 192.41.162.0/24 | AS396566 |
| Aug 29, 20:53 UTC | 70 | 192.43.172.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 57.140.192.0/18 | AS19527 |
| Aug 29, 20:53 UTC | 60 | 62.76.74.0/24 | AS49199 |
| Aug 29, 20:53 UTC | 60 | 212.163.8.0/24 | AS12541 |
| Aug 29, 20:53 UTC | 60 | 163.171.65.0/24 | AS4775 |
| Aug 29, 20:53 UTC | 60 | 93.88.176.0/20 | AS44868 |
| Aug 29, 20:53 UTC | 60 | 181.119.118.0/24 | AS52468 |
| Aug 29, 20:53 UTC | 70 | 120.132.177.0/24 | AS58466 |
| Aug 29, 20:53 UTC | 70 | 192.26.92.0/24 | AS396549 |
| Aug 29, 20:53 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 29, 20:53 UTC | 60 | 201.50.114.0/24 | AS214833 |
| Aug 29, 20:53 UTC | 60 | 208.52.177.0/24 | AS400196 |
| Aug 29, 20:53 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 29, 20:53 UTC | 60 | 123.59.192.0/19 | AS23724 |
| Aug 29, 20:53 UTC | 60 | 45.202.120.0/22 | AS11427 |
| Aug 29, 20:53 UTC | 60 | 88.227.240.0/21 | AS47331 |
| Aug 29, 20:53 UTC | 60 | 154.62.234.0/23 | AS8903 |
| Aug 29, 20:53 UTC | 80 | 192.82.134.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 70 | 185.100.0.0/24 | AS396566 |
| Aug 29, 20:53 UTC | 70 | 192.5.6.0/24 | AS396549 |
| Aug 29, 20:53 UTC | 60 | 192.33.14.0/24 | AS396748 |
| Aug 29, 20:53 UTC | 60 | 192.82.133.0/24 | AS19836 |
| Aug 29, 20:53 UTC | 60 | 120.92.144.0/21 | AS4811 |
| Aug 29, 20:53 UTC | 60 | 38.253.90.0/24 | AS272027 |
| Aug 29, 20:53 UTC | 60 | 206.191.180.0/22 | AS14636 |
| Aug 29, 20:53 UTC | 60 | 198.160.150.0/24 | AS4867 |
| Aug 29, 20:53 UTC | 60 | 192.33.14.0/24 | AS396748 |
| Aug 29, 20:53 UTC | 60 | 107.163.58.0/24 | AS395776 |
| Aug 29, 20:53 UTC | 70 | 43.248.118.0/24 | AS151300 |
| Aug 29, 20:53 UTC | 60 | 161.129.228.0/24 | AS27348 |
| Aug 29, 20:53 UTC | 60 | 118.196.48.0/21 | AS4811 |
| Aug 29, 20:53 UTC | 60 | 103.85.86.0/24 | AS131483 |
| Aug 29, 20:53 UTC | 60 | 192.82.134.0/24 | AS397197 |
| Aug 29, 20:53 UTC | 60 | 38.203.0.0/22 | AS9009 |
| Aug 29, 20:53 UTC | 60 | 92.190.0.0/20 | AS12479 |
| Aug 29, 20:53 UTC | 60 | 74.116.139.0/24 | AS23096 |
| Aug 29, 20:53 UTC | 70 | 109.176.255.0/24 | AS399989 |
| Aug 29, 20:53 UTC | 60 | 203.196.0.0/23 | AS9308 |
| Aug 29, 20:53 UTC | 60 | 34.190.160.0/21 | AS19527 |
| Aug 29, 20:53 UTC | 60 | 81.19.195.0/24 | AS396555 |
| Aug 29, 20:53 UTC | 60 | 194.33.68.0/24 | AS43766 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-29 20:55 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.
