Pulse — MOAS conflict (multiple-origin AS)
Two or more origin ASNs announcing the same prefix while the usual origin is still active — often legitimate (anycast, multi-homing, or a migration), sometimes a misconfiguration or hijack.
Events last 24h
9,022
Most recent
Showing
200
Refresh
● every 60s
What is MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Geographic distribution
Flagged events
Showing 200 most recent of 9,022 · last 24h| When | Severity | Prefix | Primary AS |
|---|---|---|---|
| Aug 17, 05:33 UTC | 70 | 147.75.42.0/24 | AS15830 |
| Aug 17, 05:33 UTC | 60 | 218.96.128.0/24 | AS4812 |
| Aug 17, 05:33 UTC | 60 | 94.183.170.0/24 | AS212743 |
| Aug 17, 05:33 UTC | 60 | 209.112.127.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 185.133.64.0/24 | AS9050 |
| Aug 17, 05:33 UTC | 60 | 103.243.179.0/24 | AS150787 |
| Aug 17, 05:33 UTC | 60 | 217.60.3.0/24 | AS56971 |
| Aug 17, 05:33 UTC | 60 | 199.7.71.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 101.33.176.0/22 | AS132203 |
| Aug 17, 05:33 UTC | 60 | 162.14.47.0/24 | AS139341 |
| Aug 17, 05:33 UTC | 70 | 125.254.168.0/21 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 192.68.130.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 193.186.11.0/24 | AS8903 |
| Aug 17, 05:33 UTC | 60 | 38.159.229.0/24 | AS174 |
| Aug 17, 05:33 UTC | 60 | 43.231.161.0/24 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 38.47.44.0/24 | AS133524 |
| Aug 17, 05:33 UTC | 60 | 120.136.184.0/24 | AS4812 |
| Aug 17, 05:33 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 70 | 209.112.127.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 45.153.249.0/24 | AS202365 |
| Aug 17, 05:33 UTC | 60 | 31.187.68.0/24 | AS21057 |
| Aug 17, 05:33 UTC | 60 | 208.72.27.0/24 | AS23096 |
| Aug 17, 05:33 UTC | 70 | 192.42.93.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 70 | 114.113.144.0/21 | AS4847 |
| Aug 17, 05:33 UTC | 60 | 166.0.100.0/24 | AS7488 |
| Aug 17, 05:33 UTC | 60 | 129.33.188.0/24 | AS812 |
| Aug 17, 05:33 UTC | 70 | 211.99.192.0/19 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 207.201.20.0/24 | AS209 |
| Aug 17, 05:33 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 185.117.184.0/22 | AS200873 |
| Aug 17, 05:33 UTC | 60 | 113.209.130.0/24 | AS4847 |
| Aug 17, 05:33 UTC | 70 | 85.49.173.0/24 | AS12479 |
| Aug 17, 05:33 UTC | 60 | 95.164.251.0/24 | AS8772 |
| Aug 17, 05:33 UTC | 60 | 82.39.144.0/24 | AS42831 |
| Aug 17, 05:33 UTC | 60 | 185.155.64.0/24 | AS8903 |
| Aug 17, 05:33 UTC | 60 | 192.68.130.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 179.1.123.0/24 | AS18678 |
| Aug 17, 05:33 UTC | 60 | 212.103.44.0/24 | AS202280 |
| Aug 17, 05:33 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 129.227.160.0/21 | AS4229 |
| Aug 17, 05:33 UTC | 60 | 123.49.239.0/24 | AS4515 |
| Aug 17, 05:33 UTC | 70 | 103.56.76.0/24 | AS58466 |
| Aug 17, 05:33 UTC | 60 | 63.222.41.0/24 | AS3491 |
| Aug 17, 05:33 UTC | 60 | 38.67.19.0/24 | AS62610 |
| Aug 17, 05:33 UTC | 60 | 43.229.48.0/24 | AS55996 |
| Aug 17, 05:33 UTC | 60 | 156.154.103.0/24 | AS12008 |
| Aug 17, 05:33 UTC | 60 | 217.117.37.0/24 | AS204013 |
| Aug 17, 05:33 UTC | 70 | 199.7.71.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 136.0.34.0/24 | AS213840 |
| Aug 17, 05:33 UTC | 60 | 204.217.233.0/24 | AS20454 |
| Aug 17, 05:33 UTC | 60 | 211.148.24.0/23 | AS17428 |
| Aug 17, 05:33 UTC | 70 | 211.151.180.0/23 | AS9308 |
| Aug 17, 05:33 UTC | 60 | 43.255.84.0/22 | AS138950 |
| Aug 17, 05:33 UTC | 60 | 71.18.95.0/24 | AS396986 |
| Aug 17, 05:33 UTC | 70 | 103.84.169.0/24 | AS41095 |
| Aug 17, 05:33 UTC | 60 | 45.194.63.0/24 | AS134963 |
| Aug 17, 05:33 UTC | 60 | 103.225.106.0/24 | AS133088 |
| Aug 17, 05:33 UTC | 60 | 103.85.86.0/24 | AS131483 |
| Aug 17, 05:33 UTC | 60 | 45.12.244.0/24 | AS39572 |
| Aug 17, 05:33 UTC | 60 | 192.35.51.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 155.28.128.0/24 | AS1516 |
| Aug 17, 05:33 UTC | 60 | 34.112.0.0/14 | AS15169 |
| Aug 17, 05:33 UTC | 60 | 195.93.138.0/23 | AS39822 |
| Aug 17, 05:33 UTC | 70 | 192.68.126.0/24 | AS19836 |
| Aug 17, 05:33 UTC | 70 | 103.248.154.0/24 | AS131516 |
| Aug 17, 05:33 UTC | 60 | 192.184.72.0/24 | AS14618 |
| Aug 17, 05:33 UTC | 70 | 216.87.145.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 70 | 114.118.24.0/21 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 80.242.59.0/24 | AS43278 |
| Aug 17, 05:33 UTC | 70 | 35.210.0.0/16 | AS15169 |
| Aug 17, 05:33 UTC | 60 | 198.204.120.0/24 | AS209 |
| Aug 17, 05:33 UTC | 60 | 157.15.16.0/24 | AS152341 |
| Aug 17, 05:33 UTC | 60 | 66.22.28.0/24 | AS25773 |
| Aug 17, 05:33 UTC | 60 | 63.217.168.0/24 | AS31713 |
| Aug 17, 05:33 UTC | 60 | 209.23.91.0/24 | AS15065 |
| Aug 17, 05:33 UTC | 60 | 63.222.154.0/24 | AS3491 |
| Aug 17, 05:33 UTC | 70 | 195.209.208.0/20 | AS35598 |
| Aug 17, 05:33 UTC | 60 | 120.92.72.0/21 | AS59019 |
| Aug 17, 05:33 UTC | 60 | 112.137.171.0/24 | AS17971 |
| Aug 17, 05:33 UTC | 60 | 34.190.240.0/21 | AS43515 |
| Aug 17, 05:33 UTC | 60 | 192.43.172.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 70 | 192.82.134.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 185.127.54.0/24 | AS65066 |
| Aug 17, 05:33 UTC | 60 | 5.42.211.0/24 | AS43278 |
| Aug 17, 05:33 UTC | 60 | 103.243.179.0/24 | AS150787 |
| Aug 17, 05:33 UTC | 60 | 64.26.28.0/24 | AS3064 |
| Aug 17, 05:33 UTC | 60 | 38.130.80.0/22 | AS21788 |
| Aug 17, 05:33 UTC | 60 | 204.209.208.0/22 | AS6327 |
| Aug 17, 05:33 UTC | 60 | 57.140.193.0/24 | AS15169 |
| Aug 17, 05:33 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 63.217.87.0/24 | AS31713 |
| Aug 17, 05:33 UTC | 70 | 106.3.136.0/21 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 72.14.83.0/24 | AS32505 |
| Aug 17, 05:33 UTC | 70 | 175.102.134.0/24 | AS4811 |
| Aug 17, 05:33 UTC | 60 | 213.9.224.0/20 | AS8903 |
| Aug 17, 05:33 UTC | 60 | 34.0.0.0/15 | AS15169 |
| Aug 17, 05:33 UTC | 70 | 38.211.254.0/24 | AS274248 |
| Aug 17, 05:33 UTC | 60 | 202.177.157.0/24 | AS132215 |
| Aug 17, 05:33 UTC | 60 | 63.219.0.0/20 | AS31713 |
| Aug 17, 05:33 UTC | 60 | 192.68.130.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 192.35.51.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 209.23.94.0/24 | AS15065 |
| Aug 17, 05:33 UTC | 60 | 106.13.246.0/23 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 204.145.245.0/24 | AS33651 |
| Aug 17, 05:33 UTC | 60 | 63.222.104.0/24 | AS3491 |
| Aug 17, 05:33 UTC | 60 | 199.5.64.0/18 | AS10753 |
| Aug 17, 05:33 UTC | 60 | 194.156.162.0/23 | AS23961 |
| Aug 17, 05:33 UTC | 60 | 211.148.22.0/24 | AS17428 |
| Aug 17, 05:33 UTC | 60 | 58.68.236.0/24 | AS4847 |
| Aug 17, 05:33 UTC | 60 | 45.172.126.0/24 | AS28598 |
| Aug 17, 05:33 UTC | 60 | 185.151.204.0/24 | AS205184 |
| Aug 17, 05:33 UTC | 60 | 192.55.83.0/24 | AS396566 |
| Aug 17, 05:33 UTC | 60 | 202.112.49.0/24 | AS4538 |
| Aug 17, 05:33 UTC | 60 | 185.245.200.0/24 | AS207316 |
| Aug 17, 05:33 UTC | 60 | 185.199.241.0/24 | AS21887 |
| Aug 17, 05:33 UTC | 60 | 63.222.106.0/24 | AS31713 |
| Aug 17, 05:33 UTC | 60 | 177.130.116.0/24 | AS22381 |
| Aug 17, 05:33 UTC | 60 | 36.255.215.0/24 | AS33667 |
| Aug 17, 05:33 UTC | 60 | 77.88.8.0/24 | AS208398 |
| Aug 17, 05:33 UTC | 80 | 91.196.35.236/32 | AS207957 |
| Aug 17, 05:33 UTC | 60 | 185.135.16.0/24 | AS28889 |
| Aug 17, 05:33 UTC | 60 | 154.62.128.0/24 | AS199452 |
| Aug 17, 05:33 UTC | 60 | 202.113.0.0/16 | AS4538 |
| Aug 17, 05:33 UTC | 60 | 101.251.240.0/21 | AS56048 |
| Aug 17, 05:33 UTC | 60 | 67.221.16.0/20 | AS11584 |
| Aug 17, 05:33 UTC | 60 | 202.112.9.0/24 | AS4538 |
| Aug 17, 05:33 UTC | 60 | 1.119.178.0/23 | AS4847 |
| Aug 17, 05:33 UTC | 60 | 218.96.128.0/24 | AS4812 |
| Aug 17, 05:33 UTC | 60 | 153.76.221.0/24 | AS219429 |
| Aug 17, 05:33 UTC | 60 | 156.240.32.0/20 | AS54801 |
| Aug 17, 05:33 UTC | 60 | 181.215.229.0/24 | AS42831 |
| Aug 17, 05:33 UTC | 70 | 119.254.0.0/17 | AS23724 |
| Aug 17, 05:33 UTC | 70 | 38.59.231.0/24 | AS60024 |
| Aug 17, 05:33 UTC | 60 | 211.99.103.0/24 | AS134763 |
| Aug 17, 05:33 UTC | 60 | 185.238.172.0/24 | AS51865 |
| Aug 17, 05:33 UTC | 60 | 180.150.184.0/22 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 192.30.45.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 216.177.30.0/24 | AS10367 |
| Aug 17, 05:33 UTC | 60 | 199.244.90.0/24 | AS40355 |
| Aug 17, 05:33 UTC | 70 | 154.90.52.0/23 | AS154177 |
| Aug 17, 05:33 UTC | 60 | 192.42.93.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 199.7.71.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 63.223.44.0/24 | AS31713 |
| Aug 17, 05:33 UTC | 60 | 34.4.128.0/18 | AS19527 |
| Aug 17, 05:33 UTC | 60 | 45.116.11.0/24 | AS41095 |
| Aug 17, 05:33 UTC | 60 | 102.129.92.0/24 | AS37451 |
| Aug 17, 05:33 UTC | 70 | 192.31.80.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 185.108.93.0/24 | AS205402 |
| Aug 17, 05:33 UTC | 60 | 120.92.224.0/20 | AS59019 |
| Aug 17, 05:33 UTC | 60 | 45.13.126.0/24 | AS1299 |
| Aug 17, 05:33 UTC | 60 | 45.250.180.0/23 | AS4816 |
| Aug 17, 05:33 UTC | 60 | 104.153.254.0/24 | AS32505 |
| Aug 17, 05:33 UTC | 60 | 200.23.6.0/24 | AS28414 |
| Aug 17, 05:33 UTC | 60 | 34.188.0.0/16 | AS15169 |
| Aug 17, 05:33 UTC | 60 | 23.178.1.0/24 | AS396879 |
| Aug 17, 05:33 UTC | 60 | 119.161.123.0/24 | AS4847 |
| Aug 17, 05:33 UTC | 60 | 192.55.83.0/24 | AS396566 |
| Aug 17, 05:33 UTC | 60 | 85.209.124.0/23 | AS21430 |
| Aug 17, 05:33 UTC | 60 | 213.9.246.0/24 | AS8903 |
| Aug 17, 05:33 UTC | 70 | 124.251.48.0/22 | AS9308 |
| Aug 17, 05:33 UTC | 60 | 168.92.1.0/24 | AS16399 |
| Aug 17, 05:33 UTC | 70 | 192.82.134.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 23.19.52.0/24 | AS205544 |
| Aug 17, 05:33 UTC | 70 | 151.245.100.0/24 | AS274249 |
| Aug 17, 05:33 UTC | 60 | 204.76.172.0/24 | AS13620 |
| Aug 17, 05:33 UTC | 60 | 177.130.117.0/24 | AS22381 |
| Aug 17, 05:33 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 17, 05:33 UTC | 60 | 43.231.96.0/24 | AS4816 |
| Aug 17, 05:33 UTC | 60 | 38.254.109.0/24 | AS174 |
| Aug 17, 05:33 UTC | 70 | 34.191.56.0/21 | AS43515 |
| Aug 17, 05:33 UTC | 60 | 211.151.180.0/23 | AS9308 |
| Aug 17, 05:33 UTC | 60 | 49.236.205.0/24 | AS17971 |
| Aug 17, 05:33 UTC | 60 | 213.108.96.0/21 | AS57208 |
| Aug 17, 05:33 UTC | 60 | 123.58.240.0/20 | AS133119 |
| Aug 17, 05:33 UTC | 60 | 192.41.162.0/24 | AS396566 |
| Aug 17, 05:33 UTC | 60 | 154.43.165.0/24 | AS211691 |
| Aug 17, 05:33 UTC | 60 | 202.160.140.0/23 | AS132168 |
| Aug 17, 05:33 UTC | 60 | 211.148.30.0/23 | AS17428 |
| Aug 17, 05:33 UTC | 60 | 122.200.120.0/22 | AS4847 |
| Aug 17, 05:33 UTC | 70 | 110.43.128.0/21 | AS4811 |
| Aug 17, 05:33 UTC | 60 | 14.103.192.0/21 | AS4811 |
| Aug 17, 05:33 UTC | 60 | 219.223.0.0/16 | AS4538 |
| Aug 17, 05:33 UTC | 60 | 45.140.6.0/24 | AS49505 |
| Aug 17, 05:33 UTC | 70 | 209.112.127.0/24 | AS397197 |
| Aug 17, 05:33 UTC | 60 | 192.31.80.0/24 | AS396549 |
| Aug 17, 05:33 UTC | 60 | 63.222.184.0/24 | AS31713 |
| Aug 17, 05:33 UTC | 60 | 118.196.232.0/21 | AS4811 |
| Aug 17, 05:33 UTC | 70 | 95.20.28.0/22 | AS12479 |
| Aug 17, 05:33 UTC | 70 | 0.0.0.0/0 | AS212271 |
| Aug 17, 05:33 UTC | 60 | 216.77.68.0/24 | AS13342 |
| Aug 17, 05:33 UTC | 60 | 92.189.240.0/20 | AS12479 |
| Aug 17, 05:33 UTC | 60 | 192.55.83.0/24 | AS396566 |
| Aug 17, 05:33 UTC | 60 | 185.242.157.0/24 | AS42831 |
| Aug 17, 05:33 UTC | 60 | 120.92.194.0/23 | AS23724 |
| Aug 17, 05:33 UTC | 60 | 82.29.44.0/24 | AS16509 |
| Aug 17, 05:33 UTC | 70 | 117.51.172.0/22 | AS58466 |
| Aug 17, 05:33 UTC | 60 | 103.197.3.0/24 | AS55996 |
| Aug 17, 05:33 UTC | 70 | 87.218.55.0/24 | AS12479 |
| Aug 17, 05:33 UTC | 60 | 181.233.125.0/24 | AS64160 |
| Aug 17, 05:33 UTC | 70 | 106.13.254.0/23 | AS58466 |
Frequently Asked Questions
What is a BGP MOAS conflict (multiple-origin AS)?
A MOAS (Multiple-Origin AS) conflict is when the same IP prefix is announced into BGP by more than one origin Autonomous System at the same time. It can be benign multi-homing or anycast — or the signature of a route leak or prefix hijack. WorldIP.io flags a MOAS when a prefix with a long-stable origin (7-day, >100-sample baseline) starts being announced by a different ASN.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the MOAS conflict (multiple-origin AS) feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-08-17 05:35 UTC.
How do I subscribe to MOAS conflict (multiple-origin AS) events?
Subscribe to the Atom feed at /pulse/bgp/moas.atom or poll the JSON endpoint at /api/pulse/bgp/moas.