Pulse — Sudden withdrawal event
ASNs whose active prefix count dropped by ≥50% in the last hour vs. the 1–7h baseline — outages, DDoS-blackhole, route leak fallout.
What is Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Geographic distribution
Flagged events
Showing 200 most recent of 2,709 · last 24h| When | Severity | Prefix | AS |
|---|---|---|---|
| Aug 31, 03:54 UTC | 70 | * | AS32829 |
| Aug 31, 03:54 UTC | 80 | * | AS51020 |
| Aug 31, 03:54 UTC | 70 | * | AS11676 |
| Aug 31, 03:54 UTC | 70 | * | AS26881 |
| Aug 31, 03:54 UTC | 80 | * | AS202651 |
| Aug 31, 03:54 UTC | 70 | * | AS205889 |
| Aug 31, 03:54 UTC | 70 | * | AS51500 |
| Aug 31, 03:54 UTC | 70 | * | AS264479 |
| Aug 31, 03:54 UTC | 70 | * | AS138152 |
| Aug 31, 03:54 UTC | 80 | * | AS17040 |
| Aug 31, 03:54 UTC | 80 | * | AS40727 |
| Aug 31, 03:54 UTC | 80 | * | AS198735 |
| Aug 31, 03:54 UTC | 70 | * | AS397735 |
| Aug 31, 03:54 UTC | 70 | * | AS40861 |
| Aug 31, 03:54 UTC | 80 | * | AS55045 |
| Aug 31, 03:54 UTC | 80 | * | AS262252 |
| Aug 31, 03:54 UTC | 70 | * | AS147019 |
| Aug 31, 03:54 UTC | 70 | * | AS263888 |
| Aug 31, 03:54 UTC | 80 | * | AS210022 |
| Aug 31, 03:54 UTC | 70 | * | AS262428 |
| Aug 31, 03:54 UTC | 70 | * | AS35213 |
| Aug 31, 03:54 UTC | 80 | * | AS212330 |
| Aug 31, 03:54 UTC | 80 | * | AS7821 |
| Aug 31, 03:54 UTC | 80 | * | AS4249 |
| Aug 31, 03:54 UTC | 70 | * | AS37009 |
| Aug 31, 03:54 UTC | 80 | * | AS12041 |
| Aug 31, 03:54 UTC | 80 | * | AS393526 |
| Aug 31, 03:54 UTC | 80 | * | AS197421 |
| Aug 31, 03:54 UTC | 70 | * | AS43925 |
| Aug 31, 03:54 UTC | 80 | * | AS18801 |
| Aug 31, 03:54 UTC | 70 | * | AS55189 |
| Aug 31, 03:54 UTC | 70 | * | AS30021 |
| Aug 31, 03:54 UTC | 70 | * | AS57537 |
| Aug 31, 03:54 UTC | 80 | * | AS20243 |
| Aug 31, 03:54 UTC | 70 | * | AS40564 |
| Aug 31, 03:54 UTC | 70 | * | AS207234 |
| Aug 31, 03:54 UTC | 80 | * | AS203214 |
| Aug 31, 03:54 UTC | 80 | * | AS201749 |
| Aug 31, 03:54 UTC | 90 | * | AS5786 |
| Aug 31, 03:54 UTC | 80 | * | AS46414 |
| Aug 31, 03:54 UTC | 80 | * | AS208365 |
| Aug 31, 03:54 UTC | 70 | * | AS40026 |
| Aug 31, 03:54 UTC | 80 | * | AS211908 |
| Aug 31, 03:54 UTC | 70 | * | AS25273 |
| Aug 31, 03:54 UTC | 70 | * | AS11700 |
| Aug 31, 03:54 UTC | 80 | * | AS210402 |
| Aug 31, 03:54 UTC | 70 | * | AS27650 |
| Aug 31, 03:54 UTC | 70 | * | AS265279 |
| Aug 31, 03:54 UTC | 80 | * | AS36504 |
| Aug 31, 03:54 UTC | 70 | * | AS28589 |
| Aug 31, 03:54 UTC | 80 | * | AS24492 |
| Aug 31, 03:54 UTC | 80 | * | AS32524 |
| Aug 31, 03:54 UTC | 70 | * | AS48326 |
| Aug 31, 03:54 UTC | 70 | * | AS28876 |
| Aug 31, 03:54 UTC | 80 | * | AS198589 |
| Aug 31, 03:54 UTC | 90 | * | AS199739 |
| Aug 31, 03:54 UTC | 70 | * | AS998 |
| Aug 31, 03:54 UTC | 80 | * | AS54706 |
| Aug 31, 03:54 UTC | 80 | * | AS205800 |
| Aug 31, 03:54 UTC | 70 | * | AS211970 |
| Aug 31, 03:54 UTC | 80 | * | AS3194 |
| Aug 31, 03:54 UTC | 80 | * | AS57324 |
| Aug 31, 03:54 UTC | 70 | * | AS24527 |
| Aug 31, 03:54 UTC | 80 | * | AS210016 |
| Aug 31, 03:54 UTC | 70 | * | AS201603 |
| Aug 31, 03:54 UTC | 80 | * | AS262212 |
| Aug 31, 03:54 UTC | 70 | * | AS28089 |
| Aug 31, 03:54 UTC | 70 | * | AS19863 |
| Aug 31, 03:54 UTC | 70 | * | AS262565 |
| Aug 31, 03:54 UTC | 80 | * | AS200200 |
| Aug 31, 03:54 UTC | 70 | * | AS50597 |
| Aug 31, 03:54 UTC | 70 | * | AS56400 |
| Aug 31, 03:54 UTC | 70 | * | AS27482 |
| Aug 31, 03:54 UTC | 80 | * | AS17400 |
| Aug 31, 03:54 UTC | 70 | * | AS28227 |
| Aug 31, 03:54 UTC | 70 | * | AS60815 |
| Aug 31, 03:54 UTC | 80 | * | AS209193 |
| Aug 31, 03:54 UTC | 80 | * | AS36225 |
| Aug 31, 03:54 UTC | 80 | * | AS153391 |
| Aug 31, 03:54 UTC | 80 | * | AS394541 |
| Aug 31, 03:54 UTC | 80 | * | AS264592 |
| Aug 31, 03:54 UTC | 70 | * | AS44521 |
| Aug 31, 03:54 UTC | 80 | * | AS33236 |
| Aug 31, 03:54 UTC | 70 | * | AS199284 |
| Aug 31, 03:54 UTC | 80 | * | AS134729 |
| Aug 31, 03:54 UTC | 70 | * | AS327700 |
| Aug 31, 03:54 UTC | 70 | * | AS12355 |
| Aug 31, 03:54 UTC | 70 | * | AS9751 |
| Aug 31, 03:54 UTC | 80 | * | AS269655 |
| Aug 31, 03:54 UTC | 70 | * | AS11183 |
| Aug 31, 03:54 UTC | 70 | * | AS35399 |
| Aug 31, 03:54 UTC | 80 | * | AS394284 |
| Aug 31, 03:54 UTC | 80 | * | AS208324 |
| Aug 31, 03:54 UTC | 80 | * | AS205906 |
| Aug 31, 03:54 UTC | 70 | * | AS8257 |
| Aug 31, 03:39 UTC | 80 | * | AS8376 |
| Aug 31, 03:39 UTC | 80 | * | AS152194 |
| Aug 31, 03:39 UTC | 70 | * | AS48101 |
| Aug 31, 03:39 UTC | 70 | * | AS8280 |
| Aug 31, 03:39 UTC | 70 | * | AS141679 |
| Aug 31, 03:39 UTC | 80 | * | AS15557 |
| Aug 31, 03:39 UTC | 70 | * | AS8030 |
| Aug 31, 03:39 UTC | 70 | * | AS20738 |
| Aug 31, 03:39 UTC | 80 | * | AS3462 |
| Aug 31, 03:39 UTC | 80 | * | AS6830 |
| Aug 31, 03:39 UTC | 70 | * | AS33874 |
| Aug 31, 03:39 UTC | 80 | * | AS36884 |
| Aug 31, 03:39 UTC | 80 | * | AS55960 |
| Aug 31, 03:39 UTC | 70 | * | AS136199 |
| Aug 31, 03:39 UTC | 80 | * | AS10396 |
| Aug 31, 03:39 UTC | 80 | * | AS35592 |
| Aug 31, 03:39 UTC | 80 | * | AS131591 |
| Aug 31, 03:39 UTC | 80 | * | AS33339 |
| Aug 31, 03:39 UTC | 90 | * | AS213382 |
| Aug 31, 03:39 UTC | 70 | * | AS393336 |
| Aug 31, 03:39 UTC | 80 | * | AS396420 |
| Aug 31, 03:39 UTC | 80 | * | AS42689 |
| Aug 31, 03:39 UTC | 70 | * | AS141771 |
| Aug 31, 03:39 UTC | 70 | * | AS139201 |
| Aug 31, 03:39 UTC | 80 | * | AS36947 |
| Aug 31, 03:39 UTC | 70 | * | AS201776 |
| Aug 31, 03:39 UTC | 70 | * | AS136209 |
| Aug 31, 03:39 UTC | 80 | * | AS10175 |
| Aug 31, 03:39 UTC | 80 | * | AS47589 |
| Aug 31, 03:39 UTC | 80 | * | AS12663 |
| Aug 31, 03:39 UTC | 70 | * | AS395748 |
| Aug 31, 03:39 UTC | 80 | * | AS14813 |
| Aug 31, 03:39 UTC | 70 | * | AS133385 |
| Aug 31, 03:39 UTC | 80 | * | AS32432 |
| Aug 31, 03:39 UTC | 80 | * | AS4213 |
| Aug 31, 03:39 UTC | 80 | * | AS24400 |
| Aug 31, 03:39 UTC | 80 | * | AS3257 |
| Aug 31, 03:39 UTC | 70 | * | AS140309 |
| Aug 31, 03:39 UTC | 70 | * | AS197071 |
| Aug 31, 03:39 UTC | 70 | * | AS32133 |
| Aug 31, 03:39 UTC | 70 | * | AS27338 |
| Aug 31, 03:39 UTC | 80 | * | AS29518 |
| Aug 31, 03:39 UTC | 80 | * | AS131429 |
| Aug 31, 03:39 UTC | 80 | * | AS54600 |
| Aug 31, 03:39 UTC | 90 | * | AS35994 |
| Aug 31, 03:39 UTC | 70 | * | AS136557 |
| Aug 31, 03:39 UTC | 70 | * | AS5778 |
| Aug 31, 03:39 UTC | 80 | * | AS29066 |
| Aug 31, 03:39 UTC | 80 | * | AS22773 |
| Aug 31, 03:39 UTC | 80 | * | AS41201 |
| Aug 31, 03:39 UTC | 80 | * | AS54075 |
| Aug 31, 03:39 UTC | 80 | * | AS10013 |
| Aug 31, 03:39 UTC | 70 | * | AS18182 |
| Aug 31, 03:39 UTC | 80 | * | AS29084 |
| Aug 31, 03:39 UTC | 80 | * | AS140638 |
| Aug 31, 03:39 UTC | 70 | * | AS10143 |
| Aug 31, 03:39 UTC | 70 | * | AS9141 |
| Aug 31, 03:39 UTC | 80 | * | AS30985 |
| Aug 31, 03:39 UTC | 80 | * | AS51964 |
| Aug 31, 03:39 UTC | 80 | * | AS15805 |
| Aug 31, 03:39 UTC | 80 | * | AS16625 |
| Aug 31, 03:39 UTC | 70 | * | AS47253 |
| Aug 31, 03:39 UTC | 80 | * | AS14265 |
| Aug 31, 03:39 UTC | 80 | * | AS19108 |
| Aug 31, 03:39 UTC | 70 | * | AS269820 |
| Aug 31, 03:39 UTC | 70 | * | AS265721 |
| Aug 31, 03:39 UTC | 80 | * | AS200876 |
| Aug 31, 03:39 UTC | 80 | * | AS40306 |
| Aug 31, 03:39 UTC | 80 | * | AS58466 |
| Aug 31, 03:39 UTC | 70 | * | AS38105 |
| Aug 31, 03:39 UTC | 80 | * | AS7296 |
| Aug 31, 03:39 UTC | 70 | * | AS36180 |
| Aug 31, 03:39 UTC | 70 | * | AS38705 |
| Aug 31, 03:39 UTC | 80 | * | AS8764 |
| Aug 31, 03:39 UTC | 80 | * | AS33070 |
| Aug 31, 03:39 UTC | 80 | * | AS9155 |
| Aug 31, 03:39 UTC | 80 | * | AS48951 |
| Aug 31, 03:39 UTC | 80 | * | AS14051 |
| Aug 31, 03:39 UTC | 80 | * | AS8796 |
| Aug 31, 03:39 UTC | 70 | * | AS8092 |
| Aug 31, 03:39 UTC | 80 | * | AS3 |
| Aug 31, 03:39 UTC | 80 | * | AS6256 |
| Aug 31, 03:39 UTC | 80 | * | AS42926 |
| Aug 31, 03:39 UTC | 80 | * | AS3329 |
| Aug 31, 03:39 UTC | 70 | * | AS8680 |
| Aug 31, 03:39 UTC | 70 | * | AS208951 |
| Aug 31, 03:39 UTC | 80 | * | AS13977 |
| Aug 31, 03:39 UTC | 80 | * | AS55592 |
| Aug 31, 03:39 UTC | 80 | * | AS137735 |
| Aug 31, 03:39 UTC | 70 | * | AS11398 |
| Aug 31, 03:39 UTC | 70 | * | AS7385 |
| Aug 31, 03:39 UTC | 80 | * | AS39891 |
| Aug 31, 03:39 UTC | 80 | * | AS55286 |
| Aug 31, 03:39 UTC | 70 | * | AS134763 |
| Aug 31, 03:39 UTC | 90 | * | AS9070 |
| Aug 31, 03:39 UTC | 80 | * | AS4816 |
| Aug 31, 03:39 UTC | 80 | * | AS37254 |
| Aug 31, 03:39 UTC | 80 | * | AS153252 |
| Aug 31, 03:39 UTC | 80 | * | AS26410 |
| Aug 31, 03:39 UTC | 80 | * | AS11976 |
| Aug 31, 03:39 UTC | 70 | * | AS42973 |
| Aug 31, 03:39 UTC | 80 | * | AS30036 |
| Aug 31, 03:39 UTC | 90 | * | AS45271 |
| Aug 31, 03:39 UTC | 90 | * | AS35699 |
| Aug 31, 03:39 UTC | 70 | * | AS219427 |
Frequently Asked Questions
What is a BGP Sudden withdrawal event?
A withdrawal event is when an origin AS stops announcing prefixes it was routing. We flag ASNs whose active-prefix count dropped by 50% or more in the last hour versus the 1–7h baseline, because large sudden withdrawals can indicate an outage, a fibre cut, a de-peering, or route-leak fallout.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the Sudden withdrawal event feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-31 04:05 UTC.
How do I subscribe to Sudden withdrawal event events?
Subscribe to the Atom feed at /pulse/bgp/withdrawal.atom or poll the JSON endpoint at /api/pulse/bgp/withdrawal.