Sign in

Doug Madory

@eldomador.bsky.social
1.2K followers 300 following 506 posts

Internet Analysis (BGP/NetFlow) at @kentik.bsky.social (formerly of Dyn Research and Renesys). www.linkedin.com/in/dougmadory

PostsRepliesMedia
Doug Madory @eldomador.bsky.social · 28/09/2026
Multiple waves of internet outages in #Ukraine yesterday captured by @ioda.live: Wave 1 (02:12 UTC on Sep-27): Affected networks: AS51622, AS20934, AS21312, AS50581, AS208139, AS35562, AS25082, AS42824, AS43497, and several more. ioda.inetintel.cc.gatech.edu/asn/51622?fr...
132
Doug Madory @eldomador.bsky.social · 20/09/2026
Large BGP routing leak out of Iran earlier today. Mobile provider MCCI (AS197207) originated hundreds of routes including some /8s: 19.0.0.0/8 (Ford) 102.0.0.0/8 (AFRINIC) 29.0.0.0/8 (DoD) 26.0.0.0/8 (DoD) 22.0.0.0/8 (DoD) 21.0.0.0/8 (DoD) x.com/Qrator_Radar...
x.com
Radar by Qrator (@Qrator_Radar) on X
🚨 BGP Hijack at 2026-09-20 10:04 UTC 🇮🇷AS197207 (MCCI-AS) announced 190 prefixes, creating 10,865 conflicts with 1,524 ASNs in 100🌏. 🌏Max propagation: 100% ⏱️Duration: 8 min (first part) and 15 min ...
0103
Doug Madory @eldomador.bsky.social · 20/09/2026
Yesterday's internet outage impacting Russia's four large regions in the Far East was caused by sabotage according to Chairman of the Central Election Commission of Russia. ria.ru/20260919/pam...
130
Doug Madory @eldomador.bsky.social · 14/09/2026
Multiple drops in traffic for Altice's MEO (AS3243) in Portugal in the past 24hrs. Traffic drops coincide with customer networks routing away from MEO's backbone network (AS8657). Perhaps an internal routing problem like what occurred for Rogers (2022) or Optus (2023)?
120
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 09/09/2026
Since publication, Hetzner adjusted the maxLength value of 162.55.0.0/16 to be 16, thus preventing a more-specific to be considered RPKI-valid. It did the same for 213.133.96.0/19 and 213.239.192.0/18, but not for another 50 routes which still have maxLengths greater than the routed prefix length.
131
Doug Madory @eldomador.bsky.social · 09/09/2026
Since publication, Hetzner adjusted the maxLength value of 162.55.0.0/16 to be 16, thus preventing a more-specific to be considered RPKI-valid. It did the same for 213.133.96.0/19 and 213.239.192.0/18, but not for another 50 routes which still have maxLengths greater than the routed prefix length.
131
Doug Madory @eldomador.bsky.social · 03/09/2026
The ASN of IBM Watson (AS1747) left the routing table yesterday. The end of an era? ioda.inetintel.cc.gatech.edu/asn/1747?fro...
141
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 02/09/2026
Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...
kentik.com
0122
Reposted by Doug Madory
Andree Toonk @atoonk.bsky.social · 02/09/2026
Great example of a targeted attack using a BGP hijack to obtain a valid TLS certificate. Also shows how limited RPKI is against a determined attacker. They simply spoofed the AS path so the hijack looked RPKI-valid. Nice write-up by @eldomador.bsky.social www.kentik.com/blog/latest-...
kentik.com
Latest BGP Hijack Targets Hosting Software Vendor
This post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an ...
21910
Reposted by Doug Madory
Zoë O'Connell @zoeoconnell.co.uk · 02/09/2026
RPKI-valid BGP hijack. Attackers then used that hijack to get LetsEncrypt certificates and distribute malware. Only defences seem to be CAA record based and either toggle on/off for renewal, or block most providers and pay for certs? bsky.app/profile/eldo...
232
Doug Madory @eldomador.bsky.social · 02/09/2026
Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...
kentik.com
0122
Doug Madory @eldomador.bsky.social · 31/08/2026
Taking a look at this BGP hijack of 162.55.80.0/24 that targeted Virtualizor in recent days. Hijackers forged the origin to make the route RPKI-valid: ... 6204 62390 24940 (hijack AS path) ... 24940 (legit AS path) More from the victim here: www.virtualizor.com/blog/securit...
161
Doug Madory @eldomador.bsky.social · 31/08/2026
Latest chart for traffic to Iran since December 2025. We saw steady growth between the partial restoration of May-26 and Aug-1, followed by new instability in traffic levels. Still a long way from pre-Jan-8 traffic volume levels. #DigitalBlackOutIran
030
Doug Madory @eldomador.bsky.social · 31/08/2026
These leased IP ranges originated by Canadian telecom Rogers (AS812) belong to Ukrtelecom, had their registration changed to "Rogers Communications" and, of course, are full of proxies. bgp.tools/as/812#prefi... Part of the ongoing Exodus of IPv4 from Ukraine: www.kentik.com/blog/exodus-...
151
Doug Madory @eldomador.bsky.social · 13/08/2026
Submarine cable failure due to coastal erosion has taken out nearly all internet services for Russia's Kamchatka peninsula. ~300,000 residents are cut off while Rostelecom divers work to repair the connection which is down for the second time this year. www.techtimes.com/articles/323...
3123
Reposted by Doug Madory
OONI @ooni.org · 30/07/2026
‼️ Over the last few days, #Guinea started blocking access to social media… again. OONI data shows the blocking of Facebook, TikTok, and YouTube on Orange Guinée (AS37461) by means of TLS interference. Learn more: explorer.ooni.org/findings/106... 🐙 #ooni #censorship #opendata
OONI data on the blocking of Facebook, TikTok, and YouTube in Guinea.
054
Reposted by Doug Madory
OONI @ooni.org · 29/07/2026
‼️ Saudi Arabia just blocked Tinder explorer.ooni.org/findings/305... Today, OONI data shows that Tinder started being blocked on Mobily (AS35819) by means of TLS interference. We were alerted of this block through our new Censorship Alert System, an internal prototype we're testing. 🙏🐙 #ooni
OONI data on the blocking of Tinder in Saudi Arabia
0135
Doug Madory @eldomador.bsky.social · 29/07/2026
At 06:05 UTC on Jul-27, DDoS mitigation service Voxility (AS3223) leaked over 30k BGP prefixes to its transit provider Lumen (AS3356) for up to 40 minutes causing traffic to affected prefixes to be disrupted or misdirected. Same thing happened last year: www.kentik.com/blog/beyond-...
020
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 23/07/2026
An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. Job Snijders and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. www.kentik.com/blog/china-r...
kentik.com
China Rolls out the ROAs
Long a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explore...
1104
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 23/07/2026
Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran‌
165
Doug Madory @eldomador.bsky.social · 23/07/2026
Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran‌
165
Doug Madory @eldomador.bsky.social · 23/07/2026
An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. Job Snijders and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. www.kentik.com/blog/china-r...
kentik.com
China Rolls out the ROAs
Long a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explore...
1104
Doug Madory @eldomador.bsky.social · 07/07/2026
Last week, Pakistan briefly experienced degraded internet service due to a reported subsea cable fault (SMW-5). At 13:02 UTC on Jul-02, Pakistani international gateway Transworld lost transit from Singtel and China Mobile, before returning to normal at 19:48 UTC. www.dawn.com/news/2012653...
dawn.com
PTA says submarine cable fault resolved, internet services back to normal
Internet service provider Nayatel says that “international traffic has returned to normal”.
130
Doug Madory @eldomador.bsky.social · 06/07/2026
Here's a glimpse the impact of yesterday's World Cup games on traffic from our Brazilian customers. For more World Cup traffic analysis, check our my recent post for @kentik.bsky.social : www.kentik.com/blog/what-th...
0142
Reposted by Doug Madory
OONI @ooni.org · 06/07/2026
From Heuristics to Anonymous Credentials: Assessing OONI's Approach to Bad Measurements ooni.org/post/2026-fa... In our latest blog post, we share: • New heuristics & strategies for mitigating faulty measurements • An evaluation of the effectiveness of our new Anonymous Credential System 🐙✨ #ooni
052
Reposted by Doug Madory
OONI @ooni.org · 26/06/2026
🎉 We're excited to announce the new OONI Probe Desktop App for Windows and macOS! ooni.org/post/2026-ne... New features include a new dashboard, a new "OONI News" section with censorship reports, support for OONI Run links, and more! ✨ Download OONI Probe Desktop today: ooni.org/install/ 🐙 #ooni
052
Doug Madory @eldomador.bsky.social · 25/06/2026
Abrupt drop in internet traffic to Venezuela at 22:04 UTC (6:04pm VET) after two devastating earthquakes struck the country yesterday evening. Our thoughts are with everyone affected. 🙏
031
Doug Madory @eldomador.bsky.social · 24/06/2026
Some recent daily views of traffic volume for FOX Sports, the exclusive English-language broadcaster of the #WorldCup2026 in the US. These graphs are based on @kentik.bsky.social OTT service tracking and are marked with the day's games (incl dips for halftimes and hydration breaks).
030
Doug Madory @eldomador.bsky.social · 24/06/2026
A look at today's Meta outage affecting Facebook, WhatsApp, and Instagram between 21:00–22:10 UTC Jun-23. www.the-independent.com/tech/instagr...
051
Doug Madory @eldomador.bsky.social · 23/06/2026
Syrian Subsea Cable Link Downed in Latest Act of Telecom Sabotage The Aletar cable was sabotaged on land, a move consistent with a broader pattern of infrastructure attacks targeting the country since the 2024 change in government. www.kentik.com/blog/syrian-...
kentik.com
Syrian Subsea Cable Link Downed in Latest Act of Telecom Sabotage
Syria’s internet recently faced a significant disruption after the Aletar fiber cable was sabotaged on land, a move consistent with a broader pattern of infrastructure attacks targeting the country si...
010
Doug Madory @eldomador.bsky.social · 23/06/2026
Iran played Belgium in the #WorldCup2026FIFA on June 21st at 19:00 UTC (10:30pm local). Despite having only a partially restored internet, domestic traffic spiked and international traffic dipped as Iranians tuned in to see their country participate in the global event.
140
Reposted by Doug Madory
OONI @ooni.org · 19/06/2026
📢 Only 15 hours left to support OONI in the internet freedom quadratic funding campaign: internetfreedom.torproject.org/projects/ooni/ 🐙✨ Every contribution helps. Even small donations can have an outsized impact. Thank you for your support 🙏❤️ #FundInternetFreedom #ooni
033
Reposted by Doug Madory
IODA (Internet Outage Detection and Analysis) @ioda.live · 18/06/2026
The ongoing Internet shutdown in Pakistan's Azad Jammu and Kashmir is nearing 2-week duration. The shutdown was put into place after protests related to electoral representation for Pakistan-administered Kashmir. Follow connectivity in near realtime: ioda.inetintel.cc.gatech.edu/region/3083?...
041
Reposted by Doug Madory
OONI @ooni.org · 18/06/2026
‼️ Two days ago, #India began blocking access to Telegram across multiple networks amid concerns over exam fraud. OONI data shows that ISPs in India are implementing the block through DNS tampering, as well as TLS and IP-level interference. Learn more: explorer.ooni.org/findings/321... 🐙 #ooni
082
Reposted by Doug Madory
routingmanrs.bsky.social @routingmanrs.bsky.social · 17/06/2026
An excellent recap by @eldomador.bsky.social of the #BGP incident in India this week.
032
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 17/06/2026
The BGP hijack may be over, but Telegram is still getting blocked in India according to measurements from @ooni.org: explorer.ooni.org/chart/mat?pr...
033
Doug Madory @eldomador.bsky.social · 17/06/2026
Internet service in #Iran is still only partially restored following the biggest internet shutdown in history. We're seeing only about half of the traffic volume we were seeing prior to January 8th, when the first shutdown of 2026 began. #digitalblackoutiran‌
021
Doug Madory @eldomador.bsky.social · 17/06/2026
When Local Blocks Go Global: The India-Telegram BGP Incident In this post, I dig into the leaked hijack intended to block Telegram in India — the latest intentional, but also accidental BGP mishap, in which a domestic block escapes, disrupting a service worldwide. www.kentik.com/blog/when-lo...
kentik.com
When Local Blocks Go Global: The India-Telegram BGP Incident
Yesterday’s leak of a BGP hijack intended to block Telegram in India is the latest routing mishap best described as intentional, but also accidental — a pattern dating back to Pakistan Telecom’s infam...
192
Doug Madory @eldomador.bsky.social · 17/06/2026
As part of an effort to block Telegram, AS18101 of India hijacked BGP routes of the messaging service — with limited propagation due to route filtering. The red sliver in the dotted box represents the propagation of AS18101's hijack — not nothing but RPKI ROV helped to limit the impact.
285
Reposted by Doug Madory
David Belson @dbelson.com · 02/06/2026
In a Facebook post, Syria's Ministry of Communications & Information Technology announced that there will be no communication cuts during the general exams this year, in contrast to #Internet shutdowns implemented in past years. www.facebook.com/SyMOCAIT/pos... www.google.com/search?q=syr...
152
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 15/06/2026
The subsea cable linking Syria to Egypt was severed yesterday (Jun-14) at 18:50 UTC — part of what is being called a "systematic sabotage campaign" against the nation's infrastructure. Overall traffic dropped, routes shifted from Telecom Egypt (AS8452) at the time of the cut.
33723
Reposted by Doug Madory
Jonas Franken @jonasfranken.eurosky.social · 16/06/2026
There has been a subsea data cable system „Aletar“ fault close to Syrias coast off Tartous on Sunday. Sabotage has been suspected by Syrian authorities but not proven. Rerouting works, but recognizable traffic drops. The cable is from 1997, one of the oldest lit subsea cables.
041
Doug Madory @eldomador.bsky.social · 15/06/2026
The subsea cable linking Syria to Egypt was severed yesterday (Jun-14) at 18:50 UTC — part of what is being called a "systematic sabotage campaign" against the nation's infrastructure. Overall traffic dropped, routes shifted from Telecom Egypt (AS8452) at the time of the cut.
33723
Doug Madory @eldomador.bsky.social · 12/06/2026
At 13:34 UTC today, Facebook suffered a widespread, partial outage affecting its services. Instagram and WhatsApp appear to have been unaffected. Service began recovering at 14:16 UTC, over 40min later. Facebook traffic has yet to recover to the level seen prior to the outage.
150
Reposted by Doug Madory
OONI @ooni.org · 11/06/2026
Abortion Access Denied: Investigating the Global Censorship of Women on Web ooni.org/post/2026-wo... We joined forces w/ @womenonweb.bsky.social to investigate the blocking of their domains around the world based on OONI data. 🧵 Learn more 👇 #ooni #censorship #opendata
146
Doug Madory @eldomador.bsky.social · 11/06/2026
This time-of-day graphic for Snapchat, built from @kentik.bsky.social OTT traffic data, reveals a clear dip in usage during school hours. Have a young person in your life who's glued to this app?
120
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 10/06/2026
Yesterday, Claude released Fable 5, a Mythos-class model said to be "safe for general use." In @kentik.bsky.social OTT traffic metrics, we observed peaks of concurrent Claude users trying it out, briefly generating more traffic than ChatGPT usage despite never having more users.
171
Doug Madory @eldomador.bsky.social · 10/06/2026
Yesterday, Claude released Fable 5, a Mythos-class model said to be "safe for general use." In @kentik.bsky.social OTT traffic metrics, we observed peaks of concurrent Claude users trying it out, briefly generating more traffic than ChatGPT usage despite never having more users.
171
Reposted by Doug Madory
Oliver Linow @oliverlinow.bsky.social · 09/06/2026
Das Internet im Iran ist seit 20 Jahren zensiert. Webseiten ausländischer Medien sind blockiert. Auch wird das Internet zeitweise komplett abgeschaltet, was zu humanitären Schäden führt. Aktuell ist der Shutdown etwas gelockert, aber der Traffic nur auf einem Niveau von 60% von vor dem Shutdown.
011
Doug Madory @eldomador.bsky.social · 08/06/2026
Internet in Iran is still only partially restored following the end of the 88-day shutdown on May 26, at most 60% of pre Jan 8th levels measured in bits/sec. Traffic volumes into Iran were stable over the weekend despite recent airstrikes. #DigitalBlackOutIran‌
011