Sign in

Doug Madory

@eldomador.bsky.social
1.2K followers 300 following 508 posts

Internet Analysis (BGP/NetFlow) at @kentik.bsky.social (formerly of Dyn Research and Renesys). www.linkedin.com/in/dougmadory

PostsRepliesMedia
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 05/10/2026
Beginning at 06:20 UTC on Oct-2, a segment of the C2C submarine cable system went down impacting internet service in the Philippines. Service was restored at 05:20 UTC the following day. InfiniVAN (AS135607) was one of the most impacted networks. ioda.inetintel.cc.gatech.edu/asn/135607-P...
242
Doug Madory @eldomador.bsky.social · 05/10/2026
Impacts were visible in BGP data as well.
040
Doug Madory @eldomador.bsky.social · 05/10/2026
Beginning at 06:20 UTC on Oct-2, a segment of the C2C submarine cable system went down impacting internet service in the Philippines. Service was restored at 05:20 UTC the following day. InfiniVAN (AS135607) was one of the most impacted networks. ioda.inetintel.cc.gatech.edu/asn/135607-P...
242
Doug Madory @eldomador.bsky.social · 28/09/2026
Wave 3 (21:13 UTC on Sep 27): Affected networks: AS42352, AS35144, AS41062, AS57697, AS30735, and AS209593. ioda.inetintel.cc.gatech.edu/asn/42352?fr...
020
Doug Madory @eldomador.bsky.social · 28/09/2026
Wave 2 (03:52 UTC on Sep-27): Affected networks: AS​​199995, AS43668, AS48648, AS28858, AS43743, AS51124, AS35689, AS41645, AS44820 and several more. ioda.inetintel.cc.gatech.edu/asn/199995?f...
130
Doug Madory @eldomador.bsky.social · 28/09/2026
Multiple waves of internet outages in #Ukraine yesterday captured by @ioda.live: Wave 1 (02:12 UTC on Sep-27): Affected networks: AS51622, AS20934, AS21312, AS50581, AS208139, AS35562, AS25082, AS42824, AS43497, and several more. ioda.inetintel.cc.gatech.edu/asn/51622?fr...
132
Doug Madory @eldomador.bsky.social · 20/09/2026
Large BGP routing leak out of Iran earlier today. Mobile provider MCCI (AS197207) originated hundreds of routes including some /8s: 19.0.0.0/8 (Ford) 102.0.0.0/8 (AFRINIC) 29.0.0.0/8 (DoD) 26.0.0.0/8 (DoD) 22.0.0.0/8 (DoD) 21.0.0.0/8 (DoD) x.com/Qrator_Radar...
x.com
Radar by Qrator (@Qrator_Radar) on X
🚨 BGP Hijack at 2026-09-20 10:04 UTC 🇮🇷AS197207 (MCCI-AS) announced 190 prefixes, creating 10,865 conflicts with 1,524 ASNs in 100🌏. 🌏Max propagation: 100% ⏱️Duration: 8 min (first part) and 15 min ...
0103
Doug Madory @eldomador.bsky.social · 20/09/2026
The outage, which occurred during regional elections, is also visible on @ioda.live: ioda.inetintel.cc.gatech.edu/region/3490?... ioda.inetintel.cc.gatech.edu/region/3492?... ioda.inetintel.cc.gatech.edu/region/3489?... ioda.inetintel.cc.gatech.edu/region/3417?...
031
Doug Madory @eldomador.bsky.social · 20/09/2026
Yesterday's internet outage impacting Russia's four large regions in the Far East was caused by sabotage according to Chairman of the Central Election Commission of Russia. ria.ru/20260919/pam...
130
Doug Madory @eldomador.bsky.social · 14/09/2026
MEO is saying it was an attack: x.com/meopt/status...
x.com
MEO (@MEOpt) on X
@NunoFSantos A MEO foi alvo de um ataque em massa que provocou congestionamento e degradação temporária da rede internacional. Foram ativadas medidas de mitigação e recuperação, permitindo restabelece...
021
Doug Madory @eldomador.bsky.social · 14/09/2026
Multiple drops in traffic for Altice's MEO (AS3243) in Portugal in the past 24hrs. Traffic drops coincide with customer networks routing away from MEO's backbone network (AS8657). Perhaps an internal routing problem like what occurred for Rogers (2022) or Optus (2023)?
120
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 09/09/2026
Since publication, Hetzner adjusted the maxLength value of 162.55.0.0/16 to be 16, thus preventing a more-specific to be considered RPKI-valid. It did the same for 213.133.96.0/19 and 213.239.192.0/18, but not for another 50 routes which still have maxLengths greater than the routed prefix length.
131
Doug Madory @eldomador.bsky.social · 09/09/2026
There are also many cases (5,123 IPv4 and 1,340 IPv6) where the maxLength goes all the way down to an individual IP address. Such as this one: rpki-validator.ripe.net/ui/?validate...
rpki-validator.ripe.net
Routinator
User interface for Routinator. Perform a Prefix Check, view detailed statistics from the last validation run Routinator has performed and HTTP and RTR connection metrics.
020
Doug Madory @eldomador.bsky.social · 09/09/2026
Across the internet there are 67,182 prefixes with ROAs that have maxLengths longer than their routed prefix length. 16,569 are fully consumed (no room left) but there are 50,613 cases where a brand-new, never-before-seen more-specific prefix could still appear and be RPKI-valid.
131
Doug Madory @eldomador.bsky.social · 09/09/2026
Since publication, Hetzner adjusted the maxLength value of 162.55.0.0/16 to be 16, thus preventing a more-specific to be considered RPKI-valid. It did the same for 213.133.96.0/19 and 213.239.192.0/18, but not for another 50 routes which still have maxLengths greater than the routed prefix length.
131
Doug Madory @eldomador.bsky.social · 04/09/2026
020
Doug Madory @eldomador.bsky.social · 04/09/2026
Was there for 20+ years and now its gone: stat.ripe.net/widget/routi...
030
Doug Madory @eldomador.bsky.social · 03/09/2026
The ASN of IBM Watson (AS1747) left the routing table yesterday. The end of an era? ioda.inetintel.cc.gatech.edu/asn/1747?fro...
141
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 02/09/2026
Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...
kentik.com
0122
Reposted by Doug Madory
Andree Toonk @atoonk.bsky.social · 02/09/2026
Great example of a targeted attack using a BGP hijack to obtain a valid TLS certificate. Also shows how limited RPKI is against a determined attacker. They simply spoofed the AS path so the hijack looked RPKI-valid. Nice write-up by @eldomador.bsky.social www.kentik.com/blog/latest-...
kentik.com
Latest BGP Hijack Targets Hosting Software Vendor
This post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an ...
21910
Doug Madory @eldomador.bsky.social · 02/09/2026
bsky.app/profile/did:...
010
Reposted by Doug Madory
Zoë O'Connell @zoeoconnell.co.uk · 02/09/2026
RPKI-valid BGP hijack. Attackers then used that hijack to get LetsEncrypt certificates and distribute malware. Only defences seem to be CAA record based and either toggle on/off for renewal, or block most providers and pay for certs? bsky.app/profile/eldo...
232
Doug Madory @eldomador.bsky.social · 02/09/2026
Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...
kentik.com
0122
Doug Madory @eldomador.bsky.social · 01/09/2026
Well that certainly didn’t help
010
Doug Madory @eldomador.bsky.social · 31/08/2026
Taking a look at this BGP hijack of 162.55.80.0/24 that targeted Virtualizor in recent days. Hijackers forged the origin to make the route RPKI-valid: ... 6204 62390 24940 (hijack AS path) ... 24940 (legit AS path) More from the victim here: www.virtualizor.com/blog/securit...
161
Doug Madory @eldomador.bsky.social · 31/08/2026
bsky.app/profile/eldo...
010
Doug Madory @eldomador.bsky.social · 31/08/2026
Latest chart for traffic to Iran since December 2025. We saw steady growth between the partial restoration of May-26 and Aug-1, followed by new instability in traffic levels. Still a long way from pre-Jan-8 traffic volume levels. #DigitalBlackOutIran
030
Doug Madory @eldomador.bsky.social · 31/08/2026
Update to the original analysis: www.kentik.com/blog/from-uk...
kentik.com
From Ukraine to the Cloud: Stories of IPv4 Migration
This post expands on our analysis from last year that revealed that as much as 20% of IPv4 space has migrated out of Ukraine in the years following the Russian invasion in February 2022. This update r...
031
Doug Madory @eldomador.bsky.social · 31/08/2026
These leased IP ranges originated by Canadian telecom Rogers (AS812) belong to Ukrtelecom, had their registration changed to "Rogers Communications" and, of course, are full of proxies. bgp.tools/as/812#prefi... Part of the ongoing Exodus of IPv4 from Ukraine: www.kentik.com/blog/exodus-...
151
Doug Madory @eldomador.bsky.social · 13/08/2026
The submarine cable to Kamchatka (Far East Submarine Cable System) was activated on October 2016. At the time, I posted the graphic below showing the first evidence of the switchover from high-latency satellite service. www.submarinecablemap.com/submarine-ca...
050
Doug Madory @eldomador.bsky.social · 13/08/2026
Kamchatka outage captured in @ioda.live: ioda.inetintel.cc.gatech.edu/region/3492?...
051
Doug Madory @eldomador.bsky.social · 13/08/2026
Submarine cable failure due to coastal erosion has taken out nearly all internet services for Russia's Kamchatka peninsula. ~300,000 residents are cut off while Rostelecom divers work to repair the connection which is down for the second time this year. www.techtimes.com/articles/323...
3123
Reposted by Doug Madory
OONI @ooni.org · 30/07/2026
‼️ Over the last few days, #Guinea started blocking access to social media… again. OONI data shows the blocking of Facebook, TikTok, and YouTube on Orange Guinée (AS37461) by means of TLS interference. Learn more: explorer.ooni.org/findings/106... 🐙 #ooni #censorship #opendata
OONI data on the blocking of Facebook, TikTok, and YouTube in Guinea.
054
Reposted by Doug Madory
OONI @ooni.org · 29/07/2026
‼️ Saudi Arabia just blocked Tinder explorer.ooni.org/findings/305... Today, OONI data shows that Tinder started being blocked on Mobily (AS35819) by means of TLS interference. We were alerted of this block through our new Censorship Alert System, an internal prototype we're testing. 🙏🐙 #ooni
OONI data on the blocking of Tinder in Saudi Arabia
0135
Doug Madory @eldomador.bsky.social · 29/07/2026
At 06:05 UTC on Jul-27, DDoS mitigation service Voxility (AS3223) leaked over 30k BGP prefixes to its transit provider Lumen (AS3356) for up to 40 minutes causing traffic to affected prefixes to be disrupted or misdirected. Same thing happened last year: www.kentik.com/blog/beyond-...
020
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 23/07/2026
An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. Job Snijders and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. www.kentik.com/blog/china-r...
kentik.com
China Rolls out the ROAs
Long a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explore...
1104
Reposted by Doug Madory
Doug Madory @eldomador.bsky.social · 23/07/2026
Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran‌
165
Doug Madory @eldomador.bsky.social · 23/07/2026
New Chinese AS0 ROAs knocked out a few routes originated by Windstream (ex: 118.188.144.0/21) 🤔 bgp.tools/rpki-history...
020
Doug Madory @eldomador.bsky.social · 23/07/2026
Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran‌
165
Doug Madory @eldomador.bsky.social · 23/07/2026
It was inevitable that a massive deployment of ROAs like this would create RPKI-invalid due to mismatches on maxlen, causing routes to be withdrawn. Here's one example out of over 600 that I found: bgp.tools/rpki-history...
121
Doug Madory @eldomador.bsky.social · 23/07/2026
An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. Job Snijders and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. www.kentik.com/blog/china-r...
kentik.com
China Rolls out the ROAs
Long a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explore...
1104
Doug Madory @eldomador.bsky.social · 07/07/2026
The impact was visible in @ioda.live active measurement, @kentik.bsky.social's traffic data, and BGP data from RouteViews.
040
Doug Madory @eldomador.bsky.social · 07/07/2026
Last week, Pakistan briefly experienced degraded internet service due to a reported subsea cable fault (SMW-5). At 13:02 UTC on Jul-02, Pakistani international gateway Transworld lost transit from Singtel and China Mobile, before returning to normal at 19:48 UTC. www.dawn.com/news/2012653...
dawn.com
PTA says submarine cable fault resolved, internet services back to normal
Internet service provider Nayatel says that “international traffic has returned to normal”.
130
Doug Madory @eldomador.bsky.social · 06/07/2026
Here's a glimpse the impact of yesterday's World Cup games on traffic from our Brazilian customers. For more World Cup traffic analysis, check our my recent post for @kentik.bsky.social : www.kentik.com/blog/what-th...
0142
Reposted by Doug Madory
OONI @ooni.org · 06/07/2026
From Heuristics to Anonymous Credentials: Assessing OONI's Approach to Bad Measurements ooni.org/post/2026-fa... In our latest blog post, we share: • New heuristics & strategies for mitigating faulty measurements • An evaluation of the effectiveness of our new Anonymous Credential System 🐙✨ #ooni
052
Reposted by Doug Madory
OONI @ooni.org · 26/06/2026
🎉 We're excited to announce the new OONI Probe Desktop App for Windows and macOS! ooni.org/post/2026-ne... New features include a new dashboard, a new "OONI News" section with censorship reports, support for OONI Run links, and more! ✨ Download OONI Probe Desktop today: ooni.org/install/ 🐙 #ooni
052
Doug Madory @eldomador.bsky.social · 25/06/2026
Abrupt drop in internet traffic to Venezuela at 22:04 UTC (6:04pm VET) after two devastating earthquakes struck the country yesterday evening. Our thoughts are with everyone affected. 🙏
031
Doug Madory @eldomador.bsky.social · 24/06/2026
Some recent daily views of traffic volume for FOX Sports, the exclusive English-language broadcaster of the #WorldCup2026 in the US. These graphs are based on @kentik.bsky.social OTT service tracking and are marked with the day's games (incl dips for halftimes and hydration breaks).
030
Doug Madory @eldomador.bsky.social · 24/06/2026
Latest traffic statistics for Iran, which is still in a state of partial restoration.
020
Doug Madory @eldomador.bsky.social · 24/06/2026
A look at today's Meta outage affecting Facebook, WhatsApp, and Instagram between 21:00–22:10 UTC Jun-23. www.the-independent.com/tech/instagr...
051