Reposted by Doug MadoryDoug Madory @eldomador.bsky.social · 05/10/2026Beginning at 06:20 UTC on Oct-2, a segment of the C2C submarine cable system went down impacting internet service in the Philippines. Service was restored at 05:20 UTC the following day. InfiniVAN (AS135607) was one of the most impacted networks. ioda.inetintel.cc.gatech.edu/asn/135607-P... 242
Doug Madory @eldomador.bsky.social · 05/10/2026Beginning at 06:20 UTC on Oct-2, a segment of the C2C submarine cable system went down impacting internet service in the Philippines. Service was restored at 05:20 UTC the following day. InfiniVAN (AS135607) was one of the most impacted networks. ioda.inetintel.cc.gatech.edu/asn/135607-P... 242
Doug Madory @eldomador.bsky.social · 28/09/2026Wave 3 (21:13 UTC on Sep 27): Affected networks: AS42352, AS35144, AS41062, AS57697, AS30735, and AS209593. ioda.inetintel.cc.gatech.edu/asn/42352?fr... 020
Doug Madory @eldomador.bsky.social · 28/09/2026Wave 2 (03:52 UTC on Sep-27): Affected networks: AS199995, AS43668, AS48648, AS28858, AS43743, AS51124, AS35689, AS41645, AS44820 and several more. ioda.inetintel.cc.gatech.edu/asn/199995?f... 130
Doug Madory @eldomador.bsky.social · 28/09/2026Multiple waves of internet outages in #Ukraine yesterday captured by @ioda.live: Wave 1 (02:12 UTC on Sep-27): Affected networks: AS51622, AS20934, AS21312, AS50581, AS208139, AS35562, AS25082, AS42824, AS43497, and several more. ioda.inetintel.cc.gatech.edu/asn/51622?fr... 132
Doug Madory @eldomador.bsky.social · 20/09/2026Large BGP routing leak out of Iran earlier today. Mobile provider MCCI (AS197207) originated hundreds of routes including some /8s: 19.0.0.0/8 (Ford) 102.0.0.0/8 (AFRINIC) 29.0.0.0/8 (DoD) 26.0.0.0/8 (DoD) 22.0.0.0/8 (DoD) 21.0.0.0/8 (DoD) x.com/Qrator_Radar...x.comRadar by Qrator (@Qrator_Radar) on X🚨 BGP Hijack at 2026-09-20 10:04 UTC 🇮🇷AS197207 (MCCI-AS) announced 190 prefixes, creating 10,865 conflicts with 1,524 ASNs in 100🌏. 🌏Max propagation: 100% ⏱️Duration: 8 min (first part) and 15 min ... 0103
Doug Madory @eldomador.bsky.social · 20/09/2026The outage, which occurred during regional elections, is also visible on @ioda.live: ioda.inetintel.cc.gatech.edu/region/3490?... ioda.inetintel.cc.gatech.edu/region/3492?... ioda.inetintel.cc.gatech.edu/region/3489?... ioda.inetintel.cc.gatech.edu/region/3417?... 031
Doug Madory @eldomador.bsky.social · 20/09/2026Yesterday's internet outage impacting Russia's four large regions in the Far East was caused by sabotage according to Chairman of the Central Election Commission of Russia. ria.ru/20260919/pam... 130
Doug Madory @eldomador.bsky.social · 14/09/2026MEO is saying it was an attack: x.com/meopt/status...x.comMEO (@MEOpt) on X@NunoFSantos A MEO foi alvo de um ataque em massa que provocou congestionamento e degradação temporária da rede internacional. Foram ativadas medidas de mitigação e recuperação, permitindo restabelece... 021
Doug Madory @eldomador.bsky.social · 14/09/2026Multiple drops in traffic for Altice's MEO (AS3243) in Portugal in the past 24hrs. Traffic drops coincide with customer networks routing away from MEO's backbone network (AS8657). Perhaps an internal routing problem like what occurred for Rogers (2022) or Optus (2023)? 120
Reposted by Doug MadoryDoug Madory @eldomador.bsky.social · 09/09/2026Since publication, Hetzner adjusted the maxLength value of 162.55.0.0/16 to be 16, thus preventing a more-specific to be considered RPKI-valid. It did the same for 213.133.96.0/19 and 213.239.192.0/18, but not for another 50 routes which still have maxLengths greater than the routed prefix length. 131
Doug Madory @eldomador.bsky.social · 09/09/2026There are also many cases (5,123 IPv4 and 1,340 IPv6) where the maxLength goes all the way down to an individual IP address. Such as this one: rpki-validator.ripe.net/ui/?validate...rpki-validator.ripe.netRoutinatorUser interface for Routinator. Perform a Prefix Check, view detailed statistics from the last validation run Routinator has performed and HTTP and RTR connection metrics. 020
Doug Madory @eldomador.bsky.social · 09/09/2026Across the internet there are 67,182 prefixes with ROAs that have maxLengths longer than their routed prefix length. 16,569 are fully consumed (no room left) but there are 50,613 cases where a brand-new, never-before-seen more-specific prefix could still appear and be RPKI-valid. 131
Doug Madory @eldomador.bsky.social · 09/09/2026Since publication, Hetzner adjusted the maxLength value of 162.55.0.0/16 to be 16, thus preventing a more-specific to be considered RPKI-valid. It did the same for 213.133.96.0/19 and 213.239.192.0/18, but not for another 50 routes which still have maxLengths greater than the routed prefix length. 131
Doug Madory @eldomador.bsky.social · 04/09/2026Was there for 20+ years and now its gone: stat.ripe.net/widget/routi... 030
Doug Madory @eldomador.bsky.social · 03/09/2026The ASN of IBM Watson (AS1747) left the routing table yesterday. The end of an era? ioda.inetintel.cc.gatech.edu/asn/1747?fro... 141
Reposted by Doug MadoryDoug Madory @eldomador.bsky.social · 02/09/2026Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...kentik.com 0122
Reposted by Doug MadoryAndree Toonk @atoonk.bsky.social · 02/09/2026Great example of a targeted attack using a BGP hijack to obtain a valid TLS certificate. Also shows how limited RPKI is against a determined attacker. They simply spoofed the AS path so the hijack looked RPKI-valid. Nice write-up by @eldomador.bsky.social www.kentik.com/blog/latest-...kentik.comLatest BGP Hijack Targets Hosting Software VendorThis post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an ... 21910
Reposted by Doug MadoryZoë O'Connell @zoeoconnell.co.uk · 02/09/2026RPKI-valid BGP hijack. Attackers then used that hijack to get LetsEncrypt certificates and distribute malware. Only defences seem to be CAA record based and either toggle on/off for renewal, or block most providers and pay for certs? bsky.app/profile/eldo... 232
Doug Madory @eldomador.bsky.social · 02/09/2026Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...kentik.com 0122
Doug Madory @eldomador.bsky.social · 31/08/2026Taking a look at this BGP hijack of 162.55.80.0/24 that targeted Virtualizor in recent days. Hijackers forged the origin to make the route RPKI-valid: ... 6204 62390 24940 (hijack AS path) ... 24940 (legit AS path) More from the victim here: www.virtualizor.com/blog/securit... 161
Doug Madory @eldomador.bsky.social · 31/08/2026Latest chart for traffic to Iran since December 2025. We saw steady growth between the partial restoration of May-26 and Aug-1, followed by new instability in traffic levels. Still a long way from pre-Jan-8 traffic volume levels. #DigitalBlackOutIran 030
Doug Madory @eldomador.bsky.social · 31/08/2026Update to the original analysis: www.kentik.com/blog/from-uk...kentik.comFrom Ukraine to the Cloud: Stories of IPv4 MigrationThis post expands on our analysis from last year that revealed that as much as 20% of IPv4 space has migrated out of Ukraine in the years following the Russian invasion in February 2022. This update r... 031
Doug Madory @eldomador.bsky.social · 31/08/2026These leased IP ranges originated by Canadian telecom Rogers (AS812) belong to Ukrtelecom, had their registration changed to "Rogers Communications" and, of course, are full of proxies. bgp.tools/as/812#prefi... Part of the ongoing Exodus of IPv4 from Ukraine: www.kentik.com/blog/exodus-... 151
Doug Madory @eldomador.bsky.social · 13/08/2026The submarine cable to Kamchatka (Far East Submarine Cable System) was activated on October 2016. At the time, I posted the graphic below showing the first evidence of the switchover from high-latency satellite service. www.submarinecablemap.com/submarine-ca... 050
Doug Madory @eldomador.bsky.social · 13/08/2026Kamchatka outage captured in @ioda.live: ioda.inetintel.cc.gatech.edu/region/3492?... 051
Doug Madory @eldomador.bsky.social · 13/08/2026Submarine cable failure due to coastal erosion has taken out nearly all internet services for Russia's Kamchatka peninsula. ~300,000 residents are cut off while Rostelecom divers work to repair the connection which is down for the second time this year. www.techtimes.com/articles/323... 3123
Reposted by Doug MadoryOONI @ooni.org · 30/07/2026‼️ Over the last few days, #Guinea started blocking access to social media… again. OONI data shows the blocking of Facebook, TikTok, and YouTube on Orange Guinée (AS37461) by means of TLS interference. Learn more: explorer.ooni.org/findings/106... 🐙 #ooni #censorship #opendata 054
Reposted by Doug MadoryOONI @ooni.org · 29/07/2026‼️ Saudi Arabia just blocked Tinder explorer.ooni.org/findings/305... Today, OONI data shows that Tinder started being blocked on Mobily (AS35819) by means of TLS interference. We were alerted of this block through our new Censorship Alert System, an internal prototype we're testing. 🙏🐙 #ooni 0135
Doug Madory @eldomador.bsky.social · 29/07/2026At 06:05 UTC on Jul-27, DDoS mitigation service Voxility (AS3223) leaked over 30k BGP prefixes to its transit provider Lumen (AS3356) for up to 40 minutes causing traffic to affected prefixes to be disrupted or misdirected. Same thing happened last year: www.kentik.com/blog/beyond-... 020
Reposted by Doug MadoryDoug Madory @eldomador.bsky.social · 23/07/2026An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. Job Snijders and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. www.kentik.com/blog/china-r...kentik.comChina Rolls out the ROAsLong a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explore... 1104
Reposted by Doug MadoryDoug Madory @eldomador.bsky.social · 23/07/2026Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran 165
Doug Madory @eldomador.bsky.social · 23/07/2026New Chinese AS0 ROAs knocked out a few routes originated by Windstream (ex: 118.188.144.0/21) 🤔 bgp.tools/rpki-history... 020
Doug Madory @eldomador.bsky.social · 23/07/2026Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran 165
Doug Madory @eldomador.bsky.social · 23/07/2026It was inevitable that a massive deployment of ROAs like this would create RPKI-invalid due to mismatches on maxlen, causing routes to be withdrawn. Here's one example out of over 600 that I found: bgp.tools/rpki-history... 121
Doug Madory @eldomador.bsky.social · 23/07/2026An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. Job Snijders and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. www.kentik.com/blog/china-r...kentik.comChina Rolls out the ROAsLong a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explore... 1104
Doug Madory @eldomador.bsky.social · 07/07/2026The impact was visible in @ioda.live active measurement, @kentik.bsky.social's traffic data, and BGP data from RouteViews. 040
Doug Madory @eldomador.bsky.social · 07/07/2026Last week, Pakistan briefly experienced degraded internet service due to a reported subsea cable fault (SMW-5). At 13:02 UTC on Jul-02, Pakistani international gateway Transworld lost transit from Singtel and China Mobile, before returning to normal at 19:48 UTC. www.dawn.com/news/2012653...dawn.comPTA says submarine cable fault resolved, internet services back to normalInternet service provider Nayatel says that “international traffic has returned to normal”. 130
Doug Madory @eldomador.bsky.social · 06/07/2026Here's a glimpse the impact of yesterday's World Cup games on traffic from our Brazilian customers. For more World Cup traffic analysis, check our my recent post for @kentik.bsky.social : www.kentik.com/blog/what-th... 0142
Reposted by Doug MadoryOONI @ooni.org · 06/07/2026From Heuristics to Anonymous Credentials: Assessing OONI's Approach to Bad Measurements ooni.org/post/2026-fa... In our latest blog post, we share: • New heuristics & strategies for mitigating faulty measurements • An evaluation of the effectiveness of our new Anonymous Credential System 🐙✨ #ooni 052
Reposted by Doug MadoryOONI @ooni.org · 26/06/2026🎉 We're excited to announce the new OONI Probe Desktop App for Windows and macOS! ooni.org/post/2026-ne... New features include a new dashboard, a new "OONI News" section with censorship reports, support for OONI Run links, and more! ✨ Download OONI Probe Desktop today: ooni.org/install/ 🐙 #ooni 052
Doug Madory @eldomador.bsky.social · 25/06/2026Abrupt drop in internet traffic to Venezuela at 22:04 UTC (6:04pm VET) after two devastating earthquakes struck the country yesterday evening. Our thoughts are with everyone affected. 🙏 031
Doug Madory @eldomador.bsky.social · 24/06/2026Some recent daily views of traffic volume for FOX Sports, the exclusive English-language broadcaster of the #WorldCup2026 in the US. These graphs are based on @kentik.bsky.social OTT service tracking and are marked with the day's games (incl dips for halftimes and hydration breaks). 030
Doug Madory @eldomador.bsky.social · 24/06/2026Latest traffic statistics for Iran, which is still in a state of partial restoration. 020
Doug Madory @eldomador.bsky.social · 24/06/2026A look at today's Meta outage affecting Facebook, WhatsApp, and Instagram between 21:00–22:10 UTC Jun-23. www.the-independent.com/tech/instagr... 051