Doug Madory

syriauntold.comKeeping Syria connected during war | SyriaUntold | حكاية ما انحكتA Syria Telecom engineer's account told his story during the war; what was behind internet shut downs? And what happened during students’ exams?

5 Jan

Thrilled to share my latest article: "Keeping Syria connected during civil war." A compelling, years-in-the-making story of "Mahmoud," a Syria Telecom network engineer who was on the front lines of the conflict—literally—to keep the country's internet running. syriauntold.com/2025/12/27/k...

Multiple waves of DDoS attacks caused this week's outage in North Korea. Aggregate traffic data shows a flood of traffic from Vietnam, Philippines, Venezuela and other countries began at 02:01 UTC on Oct-20 when the country's sites went offline. @nknewsorg.bsky.social

Doug Madory@eldomador.bsky.social

Nearly all North Korean websites have been inaccessible for the past day as the country experiences severe Internet disruptions. 175.45.176.0/24 contains the name servers for .kp and has been down repeatedly in the past 24hrs. www.nknews.org/pro/nearly-a...

AS131279 route changes during the attacks: > 175.45.176.0/24 changed from Cenbong to TTK (RU), still going via RU > 175.45.177.0/24 has only been going through TTK > 175.45.178.0/24 changed from Cenbong to TTK back to Cenbong > 175.45.179.0/24 has only been going through Cenbong

IODA (Internet Outage Detection and Analysis)

Looks like the North Koreans changed how 175.45.176.0/24 was transited in the past few hours going via Cenbong (AS134544) to Transtelecom (AS20485) in Russia.

Doug Madory reposted

@ioda.live

Attacks on Internet infrastructure in Ukraine are visible in IODA in near realtime at the county, region, and network level: ioda.inetintel.cc.gatech.edu/asn/41039-UA...

Doug Madory@eldomador.bsky.social

Internet infrastructure keeps getting targeted on both sides of this war. Overnight, a strike hit a data center in Russian-occupied Donetsk. Traffic via AS41039 collapsed at 22:00 UTC and stayed down for more than six hours before service returned.

Outage also visible in @ioda.live: ioda.inetintel.cc.gatech.edu/asn/41039

kyivindependent.comData center in occupied Donetsk destroyed, expert saysUkraine has increasingly used long-range strikes and strikes against data centers to weaken Russia's ability to sustain the war.

Coverage of the strike on the data center: dev.ua/en/news/uhli... kyivindependent.com/data-center-...

Doug Madory reposted

Congrats to @deutschewelle.dw.com for launching the Internet Censorship Monitor! 👏 We're happy that OONI data helps support this effort. 🙏🐙❤️ This builds on our collaboration on the News Media Scan app: play.google.com/store/apps/d... apps.apple.com/us/app/news-... bsky.app/profile/deut...

DW Deutsche Welle@deutschewelle.dw.com

How accessible is dw.com across DW's target regions? 🌐 The Internet Censorship Monitor shows where dw.com is freely available and where access is blocked. Explore the map: p.dw.com/p/5OIWV

Doug Madory reposted

Earlier this week, we had the opportunity to participate in #EmpoderaLIVE2026 and talk about how OONI tools and data are used to safeguard and defend human rights in Europe and beyond. 🐙 empodera.org/live/en/agenda Warm thanks to @cibervoluntarios.bsky.social for organizing an amazing conference! ♥️

Doug Madory reposted

Beginning at 06:20 UTC on Oct-2, a segment of the C2C submarine cable system went down impacting internet service in the Philippines. Service was restored at 05:20 UTC the following day. InfiniVAN (AS135607) was one of the most impacted networks. ioda.inetintel.cc.gatech.edu/asn/135607-P...

Impacts were visible in BGP data as well.

Multiple waves of internet outages in #Ukraine yesterday captured by @ioda.live: Wave 1 (02:12 UTC on Sep-27): Affected networks: AS51622, AS20934, AS21312, AS50581, AS208139, AS35562, AS25082, AS42824, AS43497, and several more. ioda.inetintel.cc.gatech.edu/asn/51622?fr...

Wave 2 (03:52 UTC on Sep-27): Affected networks: AS199995, AS43668, AS48648, AS28858, AS43743, AS51124, AS35689, AS41645, AS44820 and several more. ioda.inetintel.cc.gatech.edu/asn/199995?f...

Wave 3 (21:13 UTC on Sep 27): Affected networks: AS42352, AS35144, AS41062, AS57697, AS30735, and AS209593. ioda.inetintel.cc.gatech.edu/asn/42352?fr...

x.comRadar by Qrator (@Qrator_Radar) on X🚨 BGP Hijack at 2026-09-20 10:04 UTC 🇮🇷AS197207 (MCCI-AS) announced 190 prefixes, creating 10,865 conflicts with 1,524 ASNs in 100🌏. 🌏Max propagation: 100% ⏱️Duration: 8 min (first part) and 15 min ...

20 Sept

Large BGP routing leak out of Iran earlier today. Mobile provider MCCI (AS197207) originated hundreds of routes including some /8s: 19.0.0.0/8 (Ford) 102.0.0.0/8 (AFRINIC) 29.0.0.0/8 (DoD) 26.0.0.0/8 (DoD) 22.0.0.0/8 (DoD) 21.0.0.0/8 (DoD) x.com/Qrator_Radar...

20 Sept

Yesterday's internet outage impacting Russia's four large regions in the Far East was caused by sabotage according to Chairman of the Central Election Commission of Russia. ria.ru/20260919/pam...

20 Sept

The outage, which occurred during regional elections, is also visible on @ioda.live: ioda.inetintel.cc.gatech.edu/region/3490?... ioda.inetintel.cc.gatech.edu/region/3492?... ioda.inetintel.cc.gatech.edu/region/3489?... ioda.inetintel.cc.gatech.edu/region/3417?...

14 Sept

Multiple drops in traffic for Altice's MEO (AS3243) in Portugal in the past 24hrs. Traffic drops coincide with customer networks routing away from MEO's backbone network (AS8657). Perhaps an internal routing problem like what occurred for Rogers (2022) or Optus (2023)?

x.comMEO (@MEOpt) on X@NunoFSantos A MEO foi alvo de um ataque em massa que provocou congestionamento e degradação temporária da rede internacional. Foram ativadas medidas de mitigação e recuperação, permitindo restabelece...

14 Sept

MEO is saying it was an attack: x.com/meopt/status...

Doug Madory reposted

Since publication, Hetzner adjusted the maxLength value of 162.55.0.0/16 to be 16, thus preventing a more-specific to be considered RPKI-valid. It did the same for 213.133.96.0/19 and 213.239.192.0/18, but not for another 50 routes which still have maxLengths greater than the routed prefix length.

Doug Madory@eldomador.bsky.social

Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...

kentik.comkentik.com

Doug Madory@eldomador.bsky.social

Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...

kentik.comkentik.com

Across the internet there are 67,182 prefixes with ROAs that have maxLengths longer than their routed prefix length. 16,569 are fully consumed (no room left) but there are 50,613 cases where a brand-new, never-before-seen more-specific prefix could still appear and be RPKI-valid.

rpki-validator.ripe.netRoutinatorUser interface for Routinator. Perform a Prefix Check, view detailed statistics from the last validation run Routinator has performed and HTTP and RTR connection metrics.

There are also many cases (5,123 IPv4 and 1,340 IPv6) where the maxLength goes all the way down to an individual IP address. Such as this one: rpki-validator.ripe.net/ui/?validate...

3 Sept

The ASN of IBM Watson (AS1747) left the routing table yesterday. The end of an era? ioda.inetintel.cc.gatech.edu/asn/1747?fro...

3 Sept

Was there for 20+ years and now its gone: stat.ripe.net/widget/routi...

Doug Madory reposted

kentik.comLatest BGP Hijack Targets Hosting Software VendorThis post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an ...

2 Sept

Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...

Doug Madory reposted

Great example of a targeted attack using a BGP hijack to obtain a valid TLS certificate. Also shows how limited RPKI is against a determined attacker. They simply spoofed the AS path so the hijack looked RPKI-valid. Nice write-up by @eldomador.bsky.social www.kentik.com/blog/latest-...

Doug Madory reposted

Zoë O'Connell

@zoeoconnell.co.uk

2 Sept

RPKI-valid BGP hijack. Attackers then used that hijack to get LetsEncrypt certificates and distribute malware. Only defences seem to be CAA record based and either toggle on/off for renewal, or block most providers and pay for certs? bsky.app/profile/eldo...

Doug Madory@eldomador.bsky.social

Taking a look at this BGP hijack of 162.55.80.0/24 that targeted Virtualizor in recent days. Hijackers forged the origin to make the route RPKI-valid: ... 6204 62390 24940 (hijack AS path) ... 24940 (legit AS path) More from the victim here: www.virtualizor.com/blog/securit...

2 Sept

Wrote a post about the recent BGP hijack of Softaculous/Virtualizor that enabled the delivery of a malicious software update to some customers. www.kentik.com/blog/latest-...

kentik.comkentik.com

Latest chart for traffic to Iran since December 2025. We saw steady growth between the partial restoration of May-26 and Aug-1, followed by new instability in traffic levels. Still a long way from pre-Jan-8 traffic volume levels. #DigitalBlackOutIran

These leased IP ranges originated by Canadian telecom Rogers (AS812) belong to Ukrtelecom, had their registration changed to "Rogers Communications" and, of course, are full of proxies. bgp.tools/as/812#prefi... Part of the ongoing Exodus of IPv4 from Ukraine: www.kentik.com/blog/exodus-...

kentik.comFrom Ukraine to the Cloud: Stories of IPv4 MigrationThis post expands on our analysis from last year that revealed that as much as 20% of IPv4 space has migrated out of Ukraine in the years following the Russian invasion in February 2022. This update r...

Update to the original analysis: www.kentik.com/blog/from-uk...

Submarine cable failure due to coastal erosion has taken out nearly all internet services for Russia's Kamchatka peninsula. ~300,000 residents are cut off while Rostelecom divers work to repair the connection which is down for the second time this year. www.techtimes.com/articles/323...

The submarine cable to Kamchatka (Far East Submarine Cable System) was activated on October 2016. At the time, I posted the graphic below showing the first evidence of the switchover from high-latency satellite service. www.submarinecablemap.com/submarine-ca...

Kamchatka outage captured in @ioda.live: ioda.inetintel.cc.gatech.edu/region/3492?...

Doug Madory reposted

30 July

‼️ Over the last few days, #Guinea started blocking access to social media… again. OONI data shows the blocking of Facebook, TikTok, and YouTube on Orange Guinée (AS37461) by means of TLS interference. Learn more: explorer.ooni.org/findings/106... 🐙 #ooni #censorship #opendata

Doug Madory reposted

29 July

‼️ Saudi Arabia just blocked Tinder explorer.ooni.org/findings/305... Today, OONI data shows that Tinder started being blocked on Mobily (AS35819) by means of TLS interference. We were alerted of this block through our new Censorship Alert System, an internal prototype we're testing. 🙏🐙 #ooni

29 July

At 06:05 UTC on Jul-27, DDoS mitigation service Voxility (AS3223) leaked over 30k BGP prefixes to its transit provider Lumen (AS3356) for up to 40 minutes causing traffic to affected prefixes to be disrupted or misdirected. Same thing happened last year: www.kentik.com/blog/beyond-...

Doug Madory reposted

kentik.comChina Rolls out the ROAsLong a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explore...

An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. Job Snijders and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. www.kentik.com/blog/china-r...

Doug Madory reposted

Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran‌

It was inevitable that a massive deployment of ROAs like this would create RPKI-invalid due to mismatches on maxlen, causing routes to be withdrawn. Here's one example out of over 600 that I found: bgp.tools/rpki-history...

New Chinese AS0 ROAs knocked out a few routes originated by Windstream (ex: 118.188.144.0/21) 🤔 bgp.tools/rpki-history...

dawn.comPTA says submarine cable fault resolved, internet services back to normalInternet service provider Nayatel says that “international traffic has returned to normal”.

7 July

Last week, Pakistan briefly experienced degraded internet service due to a reported subsea cable fault (SMW-5). At 13:02 UTC on Jul-02, Pakistani international gateway Transworld lost transit from Singtel and China Mobile, before returning to normal at 19:48 UTC. www.dawn.com/news/2012653...

7 July

The impact was visible in @ioda.live active measurement, @kentik.bsky.social's traffic data, and BGP data from RouteViews.