Pulse — Sudden withdrawal event
ASNs whose active prefix count dropped by ≥50% in the last hour vs. the 1–7h baseline — outages, DDoS-blackhole, route leak fallout.
What is Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Geographic distribution
Flagged events
Most recent first · last 24h| When | Severity | Prefix | AS |
|---|---|---|---|
| Oct 18, 12:44 UTC | 80 | * | AS215858 |
| Oct 18, 12:44 UTC | 80 | * | AS7821 |
| Oct 18, 12:44 UTC | 80 | * | AS215721 |
| Oct 18, 12:44 UTC | 70 | * | AS267013 |
| Oct 18, 12:44 UTC | 80 | * | AS272162 |
| Oct 18, 12:44 UTC | 70 | * | AS132369 |
| Oct 18, 12:44 UTC | 70 | * | AS37073 |
| Oct 18, 12:29 UTC | 90 | * | AS6648 |
| Oct 18, 12:29 UTC | 70 | * | AS28227 |
| Oct 18, 12:14 UTC | 80 | * | AS132806 |
| Oct 18, 12:14 UTC | 70 | * | AS40098 |
| Oct 18, 12:14 UTC | 70 | * | AS53134 |
| Oct 18, 11:59 UTC | 70 | * | AS28215 |
| Oct 18, 11:44 UTC | 70 | * | AS213732 |
| Oct 18, 11:29 UTC | 80 | * | AS27981 |
| Oct 18, 11:14 UTC | 80 | * | AS201520 |
| Oct 18, 10:59 UTC | 70 | * | AS12654 |
| Oct 18, 10:44 UTC | 70 | * | AS27893 |
| Oct 18, 10:29 UTC | 80 | * | AS209596 |
| Oct 18, 10:29 UTC | 70 | * | AS135444 |
| Oct 18, 10:14 UTC | 80 | * | AS329805 |
| Oct 18, 09:44 UTC | 70 | * | AS263390 |
| Oct 18, 09:29 UTC | 80 | * | AS31960 |
| Oct 18, 09:14 UTC | 70 | * | AS32824 |
| Oct 18, 09:14 UTC | 70 | * | AS9830 |
| Oct 18, 08:59 UTC | 80 | * | AS48948 |
| Oct 18, 08:29 UTC | 80 | * | AS270322 |
| Oct 18, 08:29 UTC | 80 | * | AS6620 |
| Oct 18, 08:29 UTC | 80 | * | AS9916 |
| Oct 18, 08:29 UTC | 70 | * | AS12291 |
| Oct 18, 08:14 UTC | 80 | * | AS10353 |
| Oct 18, 07:44 UTC | 70 | * | AS36901 |
| Oct 18, 07:44 UTC | 80 | * | AS137331 |
| Oct 18, 07:29 UTC | 70 | * | AS201739 |
| Oct 18, 07:29 UTC | 70 | * | AS56147 |
| Oct 18, 06:59 UTC | 70 | * | AS44032 |
| Oct 18, 06:59 UTC | 80 | * | AS266035 |
| Oct 18, 06:59 UTC | 80 | * | AS133279 |
| Oct 18, 06:44 UTC | 80 | * | AS37215 |
| Oct 18, 06:29 UTC | 80 | * | AS138462 |
| Oct 18, 05:59 UTC | 70 | * | AS14187 |
| Oct 18, 05:44 UTC | 70 | * | AS50780 |
| Oct 18, 04:59 UTC | 70 | * | AS199324 |
| Oct 18, 04:14 UTC | 80 | * | AS264147 |
| Oct 18, 03:59 UTC | 70 | * | AS25620 |
| Oct 18, 03:59 UTC | 80 | * | AS52495 |
| Oct 18, 03:59 UTC | 70 | * | AS262159 |
| Oct 18, 03:14 UTC | 80 | * | AS265676 |
| Oct 18, 02:59 UTC | 70 | * | AS400759 |
| Oct 18, 02:59 UTC | 80 | * | AS198471 |
| Oct 18, 02:29 UTC | 80 | * | AS268632 |
| Oct 18, 01:59 UTC | 80 | * | AS199782 |
| Oct 18, 01:29 UTC | 80 | * | AS37604 |
| Oct 18, 00:59 UTC | 70 | * | AS262480 |
| Oct 18, 00:59 UTC | 70 | * | AS58477 |
| Oct 18, 00:59 UTC | 70 | * | AS263411 |
| Oct 18, 00:59 UTC | 70 | * | AS262689 |
| Oct 18, 00:44 UTC | 70 | * | AS141985 |
| Oct 18, 00:14 UTC | 80 | * | AS134886 |
| Oct 17, 23:29 UTC | 70 | * | AS13882 |
| Oct 17, 23:14 UTC | 70 | * | AS133706 |
| Oct 17, 22:44 UTC | 70 | * | AS38077 |
| Oct 17, 22:29 UTC | 80 | * | AS269360 |
| Oct 17, 22:29 UTC | 80 | * | AS263522 |
| Oct 17, 22:29 UTC | 70 | * | AS52873 |
| Oct 17, 22:14 UTC | 70 | * | AS205638 |
| Oct 17, 21:59 UTC | 80 | * | AS139923 |
| Oct 17, 21:44 UTC | 80 | * | AS18245 |
| Oct 17, 21:29 UTC | 70 | * | AS198721 |
| Oct 17, 21:14 UTC | 80 | * | AS27759 |
| Oct 17, 21:14 UTC | 80 | * | AS270584 |
| Oct 17, 19:29 UTC | 80 | * | AS270521 |
| Oct 17, 18:59 UTC | 70 | * | AS47586 |
| Oct 17, 18:14 UTC | 80 | * | AS37506 |
| Oct 17, 18:14 UTC | 80 | * | AS139205 |
| Oct 17, 18:14 UTC | 80 | * | AS139989 |
| Oct 17, 18:14 UTC | 70 | * | AS262213 |
| Oct 17, 18:14 UTC | 80 | * | AS271564 |
| Oct 17, 18:14 UTC | 80 | * | AS141983 |
| Oct 17, 17:59 UTC | 80 | * | AS329101 |
| Oct 17, 17:59 UTC | 80 | * | AS262974 |
| Oct 17, 17:44 UTC | 70 | * | AS262808 |
| Oct 17, 17:44 UTC | 70 | * | AS28309 |
| Oct 17, 17:44 UTC | 70 | * | AS262600 |
| Oct 17, 17:44 UTC | 70 | * | AS28577 |
| Oct 17, 17:44 UTC | 80 | * | AS263664 |
| Oct 17, 17:44 UTC | 70 | * | AS267458 |
| Oct 17, 17:44 UTC | 70 | * | AS263566 |
| Oct 17, 17:44 UTC | 80 | * | AS402069 |
| Oct 17, 17:44 UTC | 80 | * | AS263067 |
| Oct 17, 17:44 UTC | 70 | * | AS269690 |
| Oct 17, 17:44 UTC | 70 | * | AS263472 |
| Oct 17, 17:44 UTC | 70 | * | AS267034 |
| Oct 17, 17:29 UTC | 80 | * | AS39529 |
| Oct 17, 17:29 UTC | 80 | * | AS264996 |
| Oct 17, 17:29 UTC | 70 | * | AS52505 |
| Oct 17, 17:14 UTC | 70 | * | AS263145 |
| Oct 17, 15:44 UTC | 70 | * | AS4546 |
| Oct 17, 15:29 UTC | 80 | * | AS47516 |
| Oct 17, 15:29 UTC | 80 | * | AS44547 |
| Oct 17, 15:29 UTC | 80 | * | AS211422 |
| Oct 17, 15:29 UTC | 80 | * | AS215411 |
| Oct 17, 15:29 UTC | 80 | * | AS56515 |
| Oct 17, 14:59 UTC | 80 | * | AS33004 |
| Oct 17, 14:44 UTC | 80 | * | AS57144 |
| Oct 17, 14:44 UTC | 80 | * | AS12559 |
| Oct 17, 14:29 UTC | 70 | * | AS262491 |
| Oct 17, 14:29 UTC | 70 | * | AS207353 |
| Oct 17, 14:29 UTC | 80 | * | AS11471 |
| Oct 17, 14:29 UTC | 70 | * | AS20058 |
| Oct 17, 14:14 UTC | 70 | * | AS7054 |
| Oct 17, 14:14 UTC | 70 | * | AS135705 |
| Oct 17, 14:14 UTC | 70 | * | AS209554 |
| Oct 17, 13:29 UTC | 70 | * | AS6082 |
| Oct 17, 12:59 UTC | 70 | * | AS36955 |
| Oct 17, 12:59 UTC | 80 | * | AS58404 |
| Oct 17, 12:59 UTC | 70 | * | AS328866 |
Frequently Asked Questions
What is a BGP Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the Sudden withdrawal event feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-10-18 12:45 UTC.
How do I subscribe to Sudden withdrawal event events?
Subscribe to the Atom feed at /pulse/bgp/withdrawal.atom or poll the JSON endpoint at /api/pulse/bgp/withdrawal.