Glossary term
MOAS (Multi-Origin Autonomous System)
A MOAS event occurs when the same IP prefix is announced into the global routing table by more than one origin Autonomous System at the same time.
What MOAS (Multi-Origin Autonomous System) means
MOAS stands for Multi-Origin Autonomous System, and it names a specific, observable condition in internet routing: a single IP prefix appearing in the global Border Gateway Protocol (BGP) table with more than one origin Autonomous System. In a clean routing world, each prefix has exactly one origin — the Autonomous System that legitimately holds the address space and announces it. When two or more different origin ASNs claim the same prefix at the same time, that prefix is in a MOAS state.
MOAS matters because it is one of the clearest machine-detectable fingerprints of a routing problem. The most serious cause is a prefix hijack, in which a network announces address space it does not hold, either by accident or maliciously, and pulls some or all of the traffic destined for that space toward itself. Hijacks have been used to intercept traffic, to send spam from address space that looks reputable, and to disrupt services. Because BGP largely accepts announcements on trust, a hijacked prefix can propagate widely before anyone notices, and the MOAS signal — two origins for one prefix — is often the first automated alarm.
Not every MOAS event is malicious, and this is the crucial nuance. There are entirely legitimate reasons for a prefix to be originated by more than one ASN. Some organizations operate multiple Autonomous Systems and intentionally originate the same space from several of them for redundancy. Anycast deployments, in which the same address is advertised from many locations to route users to the nearest one, can show up as multi-origin depending on how the operator structures its ASNs. Mergers, acquisitions, and provider migrations create transitional periods where address space is announced from both the old and new origins. A monitoring system that treats every MOAS as an attack will drown operators in false positives.
The right way to read a MOAS event is therefore as a question rather than a verdict: why does this prefix have two origins right now? Answering it means looking at who the two origin ASNs are, whether they belong to the same organization, whether the relationship is stable or sudden, and whether the more-specific announcement is taking over traffic from a legitimate less-specific one. A sudden new origin for a prefix that has been stably announced by someone else for years is far more suspicious than two origins that have coexisted for months.
Closely related to MOAS is the route leak, where a network re-announces routes it learned from one neighbor to another neighbor in violation of intended policy, and the more-specific hijack, where an attacker announces a smaller, more-specific prefix that wins over the legitimate larger block because routers prefer the most specific match. Both can surface alongside MOAS conditions in routing telemetry.
Defenses against malicious MOAS center on origin validation. The Resource Public Key Infrastructure (RPKI) lets the legitimate holder of address space publish a Route Origin Authorization stating which ASN is allowed to originate it; networks that validate against RPKI can then reject announcements from unauthorized origins. As validation adoption grows, the malicious slice of MOAS events shrinks, but coverage is incomplete, so continuous observation of the routing table remains the backbone of routing security.
Whisper Canon treats MOAS as a first-class signal. The directory tracks Multi-Origin AS conditions as they appear in the global table and exposes them through a live conflicts feed, and individual ASN and prefix pages surface the routing relationships that let an analyst judge whether a given multi-origin condition is a benign artifact of how a network is operated or the early sign of a hijack in progress. The term is, in essence, the precise vocabulary for one of the internet's most important early-warning signals.
Examples in Whisper Canon
Concrete pages in the directory that illustrate MOAS (Multi-Origin Autonomous System).