Doug Madory
dougmadory@infosec.exchange
<p>Internet analysis at Kentik</p>
Posts
-
View post
Multiple waves of internet outages in #Ukraine yesterday captured by @IODA@mastodon.social: Wave 1 (02:12 UTC on Sep-27): Affected networks: AS51622, AS20934, AS21312, AS50581, AS208139, AS35562, AS25082, AS42824, AS43497, and several more. https://ioda.inetintel.cc.gatech.edu/asn/51622?from=1790011111&until=1790615911&view=view1
-
View post
Taking a look at this BGP hijack of 162.55.80.0/24 that targeted Virtualizor in recent days. Hijackers forged the origin to make the route RPKI-valid: ... 6204 62390 24940 (hijack AS path) ... 24940 (legit AS path) More from the victim here: https://www.virtualizor.com/blog/security-incident-bgp-hijacking/
-
View post
These leased IP ranges originated by Canadian telecom Rogers (AS812) belong to Ukrtelecom, had their registration changed to "Rogers Communications" and, of course, are full of proxies. https://bgp.tools/as/812#prefixes Part of the ongoing Exodus of IPv4 from Ukraine: https://www.kentik.com/blog/exodus-of-ipv4-from-war-torn-ukraine/
-
View post
At 06:05 UTC on Jul-27, DDoS mitigation service Voxility (AS3223) leaked over 30k BGP prefixes to its transit provider Lumen (AS3356) for up to 40 minutes causing traffic to affected prefixes to be disrupted or misdirected. Same thing happened last year: https://www.kentik.com/blog/beyond-their-intended-scope-ddos-mitigation-leak/
-
View post
Latest chart for traffic to Iran since December 2025. After two shutdowns, traffic levels have not returned to pre-Jan-8 levels, and is unlikely to do so in the foreseeable future. #DigitalBlackOutIran
-
View post
An RPKI ROV laggard no more, China's ROA coverage jumped from 4% to 81% since April, a major advance in the country's BGP security. @job@bsd.network and I break down the numbers behind China's unprecedented ROA rollout, now covering nearly the entire country. https://www.kentik.com/blog/china-rolls-out-the-roas/
-
View post
See my analysis of the rise of whitelisted traffic during Iran's shutdown here: https://www.kentik.com/blog/irans-internet-blackout-peering-into-the-worlds-worst-internet-shutdown/
-
View post
Internet shutdown in Iran is in its 46th day.👀 While only a fraction of normal traffic levels, the volume of whitelisted traffic has been slowly growing in the past month as the IR govt expands its program of selectively authorizing access to certain individuals and companies.
-
View post
In my latest post for @kentikinc , I introduce the concept of ephemeral leaks, short-lived routing anomalies that appear briefly during #BGP convergence and fill the output of public leak detection tools like @cloudflareradar and its predecessors. https://www.kentik.com/blog/ephemeral-leaks-and-automated-bgp-route-leak-detection/
-
View post
Iran’s Internet Blackout: Peering into The World’s Worst Internet Shutdown Some are calling it Digital Apartheid. Our latest post uses traffic data to show how expanded whitelisting is reshaping internet access in Iran. https://www.kentik.com/blog/irans-internet-blackout-peering-into-the-worlds-worst-internet-shutdown/
-
View post
Continuing nationwide power outage in #Cuba is resulting in reduced internet traffic volumes as residents cannot get online. Outage began at 17:40 UTC (1:40pm local) on Mar-16.
-
View post
Some of the traffic lost on Mar-15 was recovered on Mar-18.
-
View post
https://www.kentik.com/blog/internet-and-airstrikes-tracking-irans-extended-communication-blackout/
-
View post
James Cowie on the Geopolitics of Internet Infrastructure Recently came across this old talk (Nov 2011) at Harvard by @jimcowie, a mentor of mine and pioneer in exploring the intersection of internet measurement and geopolitics. Check it out here: https://www.youtube.com/watch?v=xx13GO2kJU0
-
View post
A recent target of airstrikes, Sharif University of Technology (AS12660) went offline at 23:12 UTC (2:42am local) today. https://apnews.com/video/ict-building-at-tehrans-sharif-university-of-technology-reduced-to-rubble-after-more-us-israeli-strikes-b9a5dcd64f444ad193f8b68dd08b9be7 @IODA view: https://ioda.inetintel.cc.gatech.edu/asn/12660-IR?from=1775395741&amp;until=1775482141
-
View post
On Feb-4, Starlink disabled terminals in Russian-occupied parts of Ukraine that weren&#39;t on Ukrainian Ministry of Defense&#39;s approved list. We saw a 75% drop in Starlink traffic to Ukraine as a result. 🤯 https://www.politico.com/news/2026/02/25/elon-musk-russian-army-starlink-00793742
-
View post
Another internet outage in Iran at 12:00 UTC further reduced the small amount of traffic being let out of the country. #IranUSWar #DigitalBlackOutIran Numerous networks impacted.
-
View post
Iran is currently enduring its longest-ever internet shutdown, which began shortly after the Feb-28 airstrikes. My latest post covers all of 2026, outages within the whitelisted traffic, and other observations from our data. #DigitalBlackOutIran https://www.kentik.com/blog/internet-and-airstrikes-tracking-irans-extended-communication-blackout/
-
View post
I spoke with AL-Monitor for their story on the ongoing internet shutdown in Iran: https://www.al-monitor.com/originals/2026/03/irans-longest-ever-internet-blackout-leaves-99-offline-what-know?gift_code=KDCGAnTkNQvme2XZ-qSaj1RY3s4
-
View post
ICYMI: In December, I published a long-form piece based on the firsthand experiences of a Syria Telecom insider during the height of the civil war. Only after the fall of Bashar al-Assad in December 2024 did this senior telecom engineer feel safe enough to tell his remarkable story. Read it here: https://syriauntold.com/2025/12/27/keeping-syria-connected-during-war/
-
View post
Iran&#39;s shutdown is now 15 days and counting. Small amounts of service have been restored in recent days. #DigitalBlackoutIran #IranRevoIution2026 State telecom TIC (A49666) re-established many of its lost connections with outside providers, such as GBI (AS200612) at 22:02 UTC on Jan-22.
-
View post
BGP routes belonging to the network of the Islamic Republic of Iran Broadcasting (AS42586) were completely down between ~17:00 UTC on Mar-1 and ~10:00 UTC on Mar-2. Pings (blue line) was already down due to the shutdown. The BGP outage (green line) might be indicative of technical failure (fiber cut, power outage) or cyberattack. See @IODA view: https://ioda.inetintel.cc.gatech.edu/asn/42586?from=1771874802&amp;until=1772479602&amp;view=view1 https://themedialine.org/top-stories/broa...