All, Anyone know what caused the large impact in the US at around noon ET today? regards, Vector K
Impact to what? Can you provide a little more info? There was/is a Microsoft Azure issue going on. https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts... On Wed, Oct 29, 2025 at 1:38 PM Victor Kuarsingh via NANOG < nanog@lists.nanog.org> wrote:
All,
Anyone know what caused the large impact in the US at around noon ET today?
regards,
Vector K _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU...
Possibly this as seen on the outages list? https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts... Microsoft is suffering an ongoing DNS outage affecting customers worldwide, preventing them from logging into company networks and accessing Microsoft Azure and Microsoft 365 services. According to reports on DownDetector <https://downdetector.com/status/windows-azure/> and social <https://www.reddit.com/r/sysadmin/comments/1oj86h5/azure_portal_down/> networks <https://www.reddit.com/r/sysadmin/comments/1oj8sgk/so_how_much_of_microsoft_is_down/>, this incident began impacting Microsoft's services almost 1 hour ago and is currently causing server and website connection issues for tens of thousands of users. Some of those affected are having issues accessing the Intune and Azure portals, as well as the Exchange admin center, while others report that Microsoft's Azure Front Door Content Delivery Network (CDN) service is also down. On Wed, Oct 29, 2025 at 10:38 AM Victor Kuarsingh via NANOG < nanog@lists.nanog.org> wrote:
All,
Anyone know what caused the large impact in the US at around noon ET today?
regards,
Vector K _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU...
-- Jeff Shultz Central Office Technician SCTC (503) 769-2125 Go Big - Ask for 2.5 Gig -- Like us on Social Media for News, Promotions, and other information!! <https://www.facebook.com/SCTCWEB/> <https://www.instagram.com/sctc_sctc/> <https://www.yelp.com/biz/sctc-stayton-3> <https://www.youtube.com/c/sctcvideos> _**** This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. ****_
I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts... Microsoft is investigating an ongoing DNS outage affecting customers worldwide, preventing them from accessing Microsoft Azure and Microsoft 365 services. According to reports on DownDetector and social networks, this incident began impacting Microsoft's services almost 1 hour ago and is currently causing server and website connection issues for tens of thousands of users. Some of those affected are having issues accessing the Intune and Azure portals, as well as the Exchange admin center, while others report that Microsoft's Azure Front Door Content Delivery Network (CDN) service is also down. Thanks, John "Life is good when you are happy; but much better when others are happy because of you." ~ Pope Francis [signature_1786569038] John Stuppi Engineering Program Manager – Incident Response CISSP #25525 CCIE, Security #11154 [signature_773777294] Security & Trust Organization Cisco Systems, Inc. jstuppi@cisco.com<mailto:jstuppi@cisco.com> Mobile: +1 732 319 3886<tel:+17323193886> Cisco.com<http://www.cisco.com/> [cidimage003.gif@01D977FE.D040DA90] Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please click here<http://www.cisco.com/c/en/us/about/legal/terms-sale-software-license-agreement/company-registration-information.html> for Company Registration Information. From: Victor Kuarsingh via NANOG <nanog@lists.nanog.org> Date: Wednesday, October 29, 2025 at 13:38 To: nanog@lists.nanog.org <nanog@lists.nanog.org> Cc: Victor Kuarsingh <victor@jvknet.com> Subject: US Impact - October 29 2025 All, Anyone know what caused the large impact in the US at around noon ET today? regards, Vector K _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU...
Has anyone noticed this BGP event? BGP Origin Hijack event: 121786 | Cloudflare Radar<https://radar.cloudflare.com/routing/anomalies/hijack-121786> BGP Origin Hijack: 121786Copy link Details of the BGP hijack eventShare this... Hijacker ASN AS400320 - Valley Center Wireless (US) Victim ASNs AS2386 - AT&T Data Communications Services (US) Prefixes 12.13.233[.]0/24, 12.144.222[.]0/24, 12.221.212[.]0/22, 12.229.22[.]0/24 Messages 192 Earliest message time 10/29/2025, 15:46 Latest message time 10/29/2025, 19:08 Peers observed 17% Confidence Low Tags * IRR Invalid * RPKI Unknown * RPKI Old Origin Unknown * IRR Old Origin Invalid ________________________________ From: John Stuppi (jstuppi) via NANOG <nanog@lists.nanog.org> Sent: Wednesday, October 29, 2025 1:39 PM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: John Stuppi (jstuppi) <jstuppi@cisco.com> Subject: Re: US Impact - October 29 2025 I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts... Microsoft is investigating an ongoing DNS out [cid:inky-injection-inliner-03755809cc10337ec572b1f12a6beedf] Caution: External (nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>) Graymail Details<removed-link> [cid:inky-injection-inliner-023b0474c934d83d8d52155624827a68] Report This Email<removed-link> I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts-azure-and-microsoft-365-services/<https://shared.outlook.inky.com/link?domain=www.bleepingcomputer.com&t=h.eJxFkNGKwyAQRX-l-LxqEmts-tRfcXWSlSQanEmFLv33xsJuYR4Oc4d7YH7Znhd2PbEfog2vUpZSxPcCsIU4ubRuO0EWB8gIBeUaXE6YRvoQ9xF52slOwMO6WUfI7WPPwG30_HOmes0R8j04QMm-Tmyu2oAeg6QZYDmEtxDHbCNQSXnGt7ZTVrUX5TWAH86dac04GN1oZaxrvFWyNf0xzeVsRK871Q-mlkMtjzam6bYEJBRvFilPNfX_6d-G6hPa5wttoljs.MEYCIQCueFu8u72fLfe-ltS5swG8RovkNPvHbvev5tHfY455tQIhAO0CG5__iFooyG3yLholtdOE-nk6jBhtfOTua2sdGkFe> Microsoft is investigating an ongoing DNS outage affecting customers worldwide, preventing them from accessing Microsoft Azure and Microsoft 365 services. According to reports on DownDetector and social networks, this incident began impacting Microsoft's services almost 1 hour ago and is currently causing server and website connection issues for tens of thousands of users. Some of those affected are having issues accessing the Intune and Azure portals, as well as the Exchange admin center, while others report that Microsoft's Azure Front Door Content Delivery Network (CDN) service is also down. Thanks, John "Life is good when you are happy; but much better when others are happy because of you." ~ Pope Francis [signature_1786569038] John Stuppi Engineering Program Manager – Incident Response CISSP #25525 CCIE, Security #11154 [signature_773777294] Security & Trust Organization Cisco Systems, Inc. jstuppi@cisco.com<mailto:jstuppi@cisco.com<mailto:jstuppi@cisco.com>> Mobile: +1 732 319 3886<tel:+17323193886> Cisco.com<http://www.cisco.com/<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9jksKwyAYhK8SXBcfMfonWeUqoiYVrRY1uCi9e2ughVkM8w3DvNCZA1oHdK_1uRLSWsPaFZ2wTg-CbgPynbpiiiPVWxtcPDYX96yirS1lX67myBVnMzfCWrNMIzDYFxBUcFCaGsUJA_kVnSfAUoxcLtDHbR-PKqZjC67Ugi-PUz46NX_6S2r_yt4fNmQ2ig.MEUCIB9kOGDjHsduICvASU8Q4bWsk2I29FNjkrHrrel8kgaoAiEA0Y037nhIgeEY00LiUj2IMubCWJmvIZvFK69D9ET0PM0>> [cidimage003.gif@01D977FE.D040DA90] Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please click here<http://www.cisco.com/c/en/us/about/legal/terms-sale-software-license-agreement/company-registration-information.html<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9UEGOgzAM_ErFeRMDKaT01K-4waQRIaliI7Ra9e8LSLuSDyOPPTOan2otsbpfqpfI-w6wbZt2gV3WLi_ggBKsDPjMq0AkjxGEysKKMZLiPMmGhVQMjhKTQl-IFkoC-_cb07cq5ANLQQk5qZCmXJYT65cssfq6VPNhHnjkADITxZD8Y78rmEi2XGY-g7QGTXMzY0c0DtfWNnYabFd3xqKrRzTQ2H6f-na1uu9a0w_2EKdDPGHK_hH3GKxPrHPxBzv-s38bOapoPr-fulth.MEUCIQCAAv5IQ2yzfhc3zCc987hjJpOGiVOzGtarsDtRRxQFkQIgBqVDrlLKE-oJEtytv87t1wyXsayo_CqmGWpCNFO38Fo>> for Company Registration Information. From: Victor Kuarsingh via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Date: Wednesday, October 29, 2025 at 13:38 To: nanog@lists.nanog.org<mailto:nanog@lists.nanog.org> <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Cc: Victor Kuarsingh <victor@jvknet.com<mailto:victor@jvknet.com>> Subject: US Impact - October 29 2025 All, Anyone know what caused the large impact in the US at around noon ET today? regards, Vector K _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU4D43YYJOX5CUDIQNCA7HKW6B/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtj8FuwjAQRH8F-YyySRzHhBNtOLQUtaoQIuFmxUuwkjjI69JD1X9vHakcKqQ9zRvN7HyxD9ez5Yydvb_QEqA35Cmyyo5tNLoWlGvO5oo0AZj01X_PgESqRdjt-LasjvtsnfG63rxVotyvn99fywf59HLIH4HNZ6wLbYY0GfAdYm9suzL25JRF_zm6jqJmHCDliicLrgWiLrJUJvJUSBELLlUTa8UhkfnvxYtMRrlIeV7IEI4h_O6Tgeob_VN82J58_wBjlVHz.MEUCIDYh0ExXYMe1yK4-PFvEMl1h0_Ftak8u46xsNV1qOMlzAiEA6GSXQgwTEmfKNLRvIgnthqKQDMnt5cd9-9FikPH0wto> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/2V2N65DY5VJUM3MGDL77MWSC2DP3GXAJ/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtj8FqwzAQRH8l6Fy8thR5Y59SagiEuBRC0-YorI0j7MhBq7aH0n9vFGgOobCnecPMzrf4CKOoZ-IY45lrgNFx5MwbP_XZFHowoTu6T-IrgKu-vPeciNn0BHInn0vd7PVu_dqqdtVsENu37ZNsXtTq_XEN4mEmhtTm2LKDOBCNzvdL5w_BeIpfUxg466YTSGVUsVBWE9lqLrHAQ4U61wpNl1ujoMDycvlijlmppSorTOGUwv99MlF7o39KTNuLn18hiFGV.MEQCICRGDTLAmGn9o-vhkwcFBK55PXbP8e6Pbwb3gTNGsrNcAiAomSrNztbRV6AezZ8ZpSc_Sige-deOQrNbb4zn69LDXg>
Looks like a small time WISP that may be trying to implement BGP. 3 /24’s and a /22 — not really much of an “event”… nor would it have any impact leading to the Azure situation today. On Oct 29, 2025, at 3:05 PM, Terry Keeling via NANOG <nanog@lists.nanog.org> wrote: Has anyone noticed this BGP event? BGP Origin Hijack event: 121786 | Cloudflare Radar<https://radar.cloudflare.com/routing/anomalies/hijack-121786> BGP Origin Hijack: 121786Copy link Details of the BGP hijack eventShare this... Hijacker ASN AS400320 - Valley Center Wireless (US) Victim ASNs AS2386 - AT&T Data Communications Services (US) Prefixes 12.13.233[.]0/24, 12.144.222[.]0/24, 12.221.212[.]0/22, 12.229.22[.]0/24 Messages 192 Earliest message time 10/29/2025, 15:46 Latest message time 10/29/2025, 19:08 Peers observed 17% Confidence Low Tags * IRR Invalid * RPKI Unknown * RPKI Old Origin Unknown * IRR Old Origin Invalid ________________________________ From: John Stuppi (jstuppi) via NANOG <nanog@lists.nanog.org> Sent: Wednesday, October 29, 2025 1:39 PM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: John Stuppi (jstuppi) <jstuppi@cisco.com> Subject: Re: US Impact - October 29 2025 I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts... Microsoft is investigating an ongoing DNS out [cid:inky-injection-inliner-03755809cc10337ec572b1f12a6beedf] Caution: External (nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>) Graymail Details<removed-link> [cid:inky-injection-inliner-023b0474c934d83d8d52155624827a68] Report This Email<removed-link> I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts-azure-and-microsoft-365-services/<https://shared.outlook.inky.com/link?domain=www.bleepingcomputer.com&t=h.eJxFkNGKwyAQRX-l-LxqEmts-tRfcXWSlSQanEmFLv33xsJuYR4Oc4d7YH7Znhd2PbEfog2vUpZSxPcCsIU4ubRuO0EWB8gIBeUaXE6YRvoQ9xF52slOwMO6WUfI7WPPwG30_HOmes0R8j04QMm-Tmyu2oAeg6QZYDmEtxDHbCNQSXnGt7ZTVrUX5TWAH86dac04GN1oZaxrvFWyNf0xzeVsRK871Q-mlkMtjzam6bYEJBRvFilPNfX_6d-G6hPa5wttoljs.MEYCIQCueFu8u72fLfe-ltS5swG8RovkNPvHbvev5tHfY455tQIhAO0CG5__iFooyG3yLholtdOE-nk6jBhtfOTua2sdGkFe> Microsoft is investigating an ongoing DNS outage affecting customers worldwide, preventing them from accessing Microsoft Azure and Microsoft 365 services. According to reports on DownDetector and social networks, this incident began impacting Microsoft's services almost 1 hour ago and is currently causing server and website connection issues for tens of thousands of users. Some of those affected are having issues accessing the Intune and Azure portals, as well as the Exchange admin center, while others report that Microsoft's Azure Front Door Content Delivery Network (CDN) service is also down. Thanks, John "Life is good when you are happy; but much better when others are happy because of you." ~ Pope Francis [signature_1786569038] John Stuppi Engineering Program Manager – Incident Response CISSP #25525 CCIE, Security #11154 [signature_773777294] Security & Trust Organization Cisco Systems, Inc. jstuppi@cisco.com<mailto:jstuppi@cisco.com<mailto:jstuppi@cisco.com>> Mobile: +1 732 319 3886<tel:+17323193886> Cisco.com<http://www.cisco.com/<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9jksKwyAYhK8SXBcfMfonWeUqoiYVrRY1uCi9e2ughVkM8w3DvNCZA1oHdK_1uRLSWsPaFZ2wTg-CbgPynbpiiiPVWxtcPDYX96yirS1lX67myBVnMzfCWrNMIzDYFxBUcFCaGsUJA_kVnSfAUoxcLtDHbR-PKqZjC67Ugi-PUz46NX_6S2r_yt4fNmQ2ig.MEUCIB9kOGDjHsduICvASU8Q4bWsk2I29FNjkrHrrel8kgaoAiEA0Y037nhIgeEY00LiUj2IMubCWJmvIZvFK69D9ET0PM0>> [cidimage003.gif@01D977FE.D040DA90] Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please click here<http://www.cisco.com/c/en/us/about/legal/terms-sale-software-license-agreement/company-registration-information.html<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9UEGOgzAM_ErFeRMDKaT01K-4waQRIaliI7Ra9e8LSLuSDyOPPTOan2otsbpfqpfI-w6wbZt2gV3WLi_ggBKsDPjMq0AkjxGEysKKMZLiPMmGhVQMjhKTQl-IFkoC-_cb07cq5ANLQQk5qZCmXJYT65cssfq6VPNhHnjkADITxZD8Y78rmEi2XGY-g7QGTXMzY0c0DtfWNnYabFd3xqKrRzTQ2H6f-na1uu9a0w_2EKdDPGHK_hH3GKxPrHPxBzv-s38bOapoPr-fulth.MEUCIQCAAv5IQ2yzfhc3zCc987hjJpOGiVOzGtarsDtRRxQFkQIgBqVDrlLKE-oJEtytv87t1wyXsayo_CqmGWpCNFO38Fo>> for Company Registration Information. From: Victor Kuarsingh via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Date: Wednesday, October 29, 2025 at 13:38 To: nanog@lists.nanog.org<mailto:nanog@lists.nanog.org> <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Cc: Victor Kuarsingh <victor@jvknet.com<mailto:victor@jvknet.com>> Subject: US Impact - October 29 2025 All, Anyone know what caused the large impact in the US at around noon ET today? regards, Vector K _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU4D43YYJOX5CUDIQNCA7HKW6B/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtj8FuwjAQRH8F-YyySRzHhBNtOLQUtaoQIuFmxUuwkjjI69JD1X9vHakcKqQ9zRvN7HyxD9ez5Yydvb_QEqA35Cmyyo5tNLoWlGvO5oo0AZj01X_PgESqRdjt-LasjvtsnfG63rxVotyvn99fywf59HLIH4HNZ6wLbYY0GfAdYm9suzL25JRF_zm6jqJmHCDliicLrgWiLrJUJvJUSBELLlUTa8UhkfnvxYtMRrlIeV7IEI4h_O6Tgeob_VN82J58_wBjlVHz.MEUCIDYh0ExXYMe1yK4-PFvEMl1h0_Ftak8u46xsNV1qOMlzAiEA6GSXQgwTEmfKNLRvIgnthqKQDMnt5cd9-9FikPH0wto> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/2V2N65DY5VJUM3MGDL77MWSC2DP3GXAJ/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtj8FqwzAQRH8l6Fy8thR5Y59SagiEuBRC0-YorI0j7MhBq7aH0n9vFGgOobCnecPMzrf4CKOoZ-IY45lrgNFx5MwbP_XZFHowoTu6T-IrgKu-vPeciNn0BHInn0vd7PVu_dqqdtVsENu37ZNsXtTq_XEN4mEmhtTm2LKDOBCNzvdL5w_BeIpfUxg466YTSGVUsVBWE9lqLrHAQ4U61wpNl1ujoMDycvlijlmppSorTOGUwv99MlF7o39KTNuLn18hiFGV.MEQCICRGDTLAmGn9o-vhkwcFBK55PXbP8e6Pbwb3gTNGsrNcAiAomSrNztbRV6AezZ8ZpSc_Sige-deOQrNbb4zn69LDXg> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/NJ34QFKZ...
Quick correction: In my earlier message, I mistakenly linked to the wrong BGP event. I meant to draw attention to a different incident, which was part of a broader pattern of route leaks and propagation anomalies observed globally throughout October 29. With that clarified, I wanted to raise awareness of a substantial BGP route leak that occurred on October 29, 2025, with indications of broad propagation and potential global impact. The event appears to have originated from AS23470 (ReliableSite) and propagated through several Tier 1 providers, including AS174 (Cogent), AS6453 (Tata), AS2914 (NTT), AS3257 (GTT), and AS3356 (Lumen). Based on timeline analysis and route anomaly logs, the incident persisted for over 10 hours, affecting routing paths across North America, Latin America, Europe, and Asia. I've compiled a timeline of 100+ BGP events, including: * Timestamps (UTC) * Originating and propagating ASNs * Regional context * BGP message volume * Notes on Tier 1 and critical infrastructure involvement Some notable paths observed: * AS23470 → AS30058 → AS2914 / AS3257 (ReliableSite → NTT / GTT) * AS174 → AS38040 → AS4637 (Cogent → Asia → HK) * AS6939 → AS9318 (KR) → AS6461 (HE.net → Korea → Zayo) * Various Brazilian and Indonesian ASNs leaking routes back into Tier 1s like Cogent, Lumen, and Tata These anomalies were observed from multiple vantage points, suggesting wide propagation. However, the extent to which these reached end-user routing tables or caused visible service impact remains unclear. If anyone observed reachability issues, path changes, or control plane anomalies related to this event, I'd appreciate any insights or correlation. The full event timeline was compiled using Cloudflare Radar's BGP route leak data can be viewed here [https://res-1.cdn.office.net/assets/mail/file-icon/v2/xlsx_16x16.png]BGP_10_29_25.xlsx<https://isdsi-my.sharepoint.com/:x:/g/personal/tkeeling_infranetworks_com/EW8OYwt0PR1IgiC2kOW7MlYBmMKdJdOsQ-tZU-AOuwzt7Q?e=F6U0kE> Respectfully, ________________________________ From: Tim Burke via NANOG <nanog@lists.nanog.org> Sent: Wednesday, October 29, 2025 10:16 PM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: Terry Keeling <tkeeling@infranetworks.com>; Tim Burke <tim@mid.net> Subject: Re: US Impact - October 29 2025 Looks like a small time WISP that may be trying to implement BGP. 3 /24’s and a /22 — not really much of an “event”… nor would it have any impact leading to the Azure situation today. On Oct 29, 2025, [cid:inky-injection-inliner-6f42d488d348cfcd86bff9497caf9f6a] External (nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>) [cid:inky-injection-inliner-023b0474c934d83d8d52155624827a68] Report This Email<removed-link> Looks like a small time WISP that may be trying to implement BGP. 3 /24’s and a /22 — not really much of an “event”… nor would it have any impact leading to the Azure situation today. On Oct 29, 2025, at 3:05 PM, Terry Keeling via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> wrote: Has anyone noticed this BGP event? BGP Origin Hijack event: 121786 | Cloudflare Radar<https://radar.cloudflare.com/routing/anomalies/hijack-121786<https://shared.outlook.inky.com/link?domain=radar.cloudflare.com&t=h.eJw9jUEOgyAURK9iWLcgaEBdeZWvfJRCoQFMF03vXnHR1UxmJm8-5EieTA3ZS3nlibEEGhJdfTy08ZCQrvHJUjyKDRuDEJ_gLWa22wes7s4FV4Mkt4a4CrFZZ8uKQ_TnfLbBJAhY3jG5fIG6nmuO_WKEGMzQKjgFNMpl6KQY0TCuJFdjK1tBeyXbbqxsrOxwnm-zt7lkenka01Zb_W-v5PsD5mxC_g.MEUCIQC7kNmEFPrtVmSE3HLpjfz-3EahmyKgNjLBUEGqfcVNUAIgB_2wb-hh3Vntr3B28lS6bCV90HA6bSKkJlyRdWPIVJw>> BGP Origin Hijack: 121786Copy link Details of the BGP hijack eventShare this... Hijacker ASN AS400320 - Valley Center Wireless (US) Victim ASNs AS2386 - AT&T Data Communications Services (US) Prefixes 12.13.233[.]0/24, 12.144.222[.]0/24, 12.221.212[.]0/22, 12.229.22[.]0/24 Messages 192 Earliest message time 10/29/2025, 15:46 Latest message time 10/29/2025, 19:08 Peers observed 17% Confidence Low Tags * IRR Invalid * RPKI Unknown * RPKI Old Origin Unknown * IRR Old Origin Invalid ________________________________ From: John Stuppi (jstuppi) via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Sent: Wednesday, October 29, 2025 1:39 PM To: North American Network Operators Group <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Cc: John Stuppi (jstuppi) <jstuppi@cisco.com<mailto:jstuppi@cisco.com>> Subject: Re: US Impact - October 29 2025 I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts-azure-and-microsoft-365-services/<https://shared.outlook.inky.com/link?domain=www.bleepingcomputer.com&t=h.eJxFjcsOgyAQRX-lYV3AV_Gx6q-gDJaoYJixJG3671UX7WpO5t7c82ZbnFl3YQ-iFTspU0qinwFW58chLOtGEMUO0kNCubghBgyW_sSNRx420iNwt6x6IOT6tUXg2hv-r5XqxhHi0w2Akl0vbDq0Dg06SRPAvAvvztuoPVAKccJTW1a5yaHqbVE0tslqvR9tQPVNqYoWrMxrlddtprJCVLXKyvbYhmPbax_G--yQUJwsQhyP1PzS8_P5AjQdV0k.MEUCIQDUwXX_O1HHcK_2sd0AfJ_4-tkyF7S2tm31ruTjKUbkUAIgGjsq28XnZFCIv0OTfd5NcC4FnRjJmsrs7-yMxVxCsN0> Microsoft is investigating an ongoing DNS out [cid:inky-injection-inliner-03755809cc10337ec572b1f12a6beedf] Caution: External (nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>>) Graymail Details<removed-link> [cid:inky-injection-inliner-023b0474c934d83d8d52155624827a68] Report This Email<removed-link> I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts-azure-and-microsoft-365-services/<https://shared.outlook.inky.com/link?domain=www.bleepingcomputer.com&t=h.eJxFjcsOgyAQRX-lYV3AV_Gx6q-gDJaoYJixJG3671UX7WpO5t7c82ZbnFl3YQ-iFTspU0qinwFW58chLOtGEMUO0kNCubghBgyW_sSNRx420iNwt6x6IOT6tUXg2hv-r5XqxhHi0w2Akl0vbDq0Dg06SRPAvAvvztuoPVAKccJTW1a5yaHqbVE0tslqvR9tQPVNqYoWrMxrlddtprJCVLXKyvbYhmPbax_G--yQUJwsQhyP1PzS8_P5AjQdV0k.MEUCIQDUwXX_O1HHcK_2sd0AfJ_4-tkyF7S2tm31ruTjKUbkUAIgGjsq28XnZFCIv0OTfd5NcC4FnRjJmsrs7-yMxVxCsN0><https://shared.outlook.inky.com/link?domain=www.bleepingcomputer.com&t=h.eJxFkNGKwyAQRX-l-LxqEmts-tRfcXWSlSQanEmFLv33xsJuYR4Oc4d7YH7Znhd2PbEfog2vUpZSxPcCsIU4ubRuO0EWB8gIBeUaXE6YRvoQ9xF52slOwMO6WUfI7WPPwG30_HOmes0R8j04QMm-Tmyu2oAeg6QZYDmEtxDHbCNQSXnGt7ZTVrUX5TWAH86dac04GN1oZaxrvFWyNf0xzeVsRK871Q-mlkMtjzam6bYEJBRvFilPNfX_6d-G6hPa5wttoljs.MEYCIQCueFu8u72fLfe-ltS5swG8RovkNPvHbvev5tHfY455tQIhAO0CG5__iFooyG3yLholtdOE-nk6jBhtfOTua2sdGkFe<https://shared.outlook.inky.com/link?domain=www.bleepingcomputer.com&t=h.eJxFjcsOgyAQRX-lYV3AV_Gx6q-gDJaoYJixJG3671UX7WpO5t7c82ZbnFl3YQ-iFTspU0qinwFW58chLOtGEMUO0kNCubghBgyW_sSNRx420iNwt6x6IOT6tUXg2hv-r5XqxhHi0w2Akl0vbDq0Dg06SRPAvAvvztuoPVAKccJTW1a5yaHqbVE0tslqvR9tQPVNqYoWrMxrlddtprJCVLXKyvbYhmPbax_G--yQUJwsQhyP1PzS8_P5AjQdV0k.MEUCICDJJjTejwlIWJ42o-jX0qVGisjbSmPxEnCw8mhtvQyKAiEA5Es9-M7zQZ9xYApF0ZjRy5dyk-QWrkA-tXKsiwixdJ4>> Microsoft is investigating an ongoing DNS outage affecting customers worldwide, preventing them from accessing Microsoft Azure and Microsoft 365 services. According to reports on DownDetector and social networks, this incident began impacting Microsoft's services almost 1 hour ago and is currently causing server and website connection issues for tens of thousands of users. Some of those affected are having issues accessing the Intune and Azure portals, as well as the Exchange admin center, while others report that Microsoft's Azure Front Door Content Delivery Network (CDN) service is also down. Thanks, John "Life is good when you are happy; but much better when others are happy because of you." ~ Pope Francis [signature_1786569038] John Stuppi Engineering Program Manager – Incident Response CISSP #25525 CCIE, Security #11154 [signature_773777294] Security & Trust Organization Cisco Systems, Inc. jstuppi@cisco.com<mailto:jstuppi@cisco.com<mailto:jstuppi@cisco.com<mailto:jstuppi@cisco.com>>> Mobile: +1 732 319 3886<tel:+17323193886> Cisco.com<http://www.cisco.com/<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9jDkOwyAURK9iUUdstlhc-SoYPg6yAxEQUUS5ewJFqhnNG703euULrRO61_pcCWmtYRuKTdimB0G3CZ2dhuJKIPUEuEI8thB9NhFqS_ks4zkvzDFYds-58opK8wvjQOxqFlyDJ0wKJjUVlONFCjrr7obujiamY7tCqQWPjlM-OnV_OpbPF1TCNOc.MEUCIDN9FITkPUKDqBAbTN7PIkDg3uIJVtMlEjj2yY5LoAefAiEA_SSlh4rgShbtdoiDlt-mFhhAsmx4JNv_2lRon7T9T64><https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9jksKwyAYhK8SXBcfMfonWeUqoiYVrRY1uCi9e2ughVkM8w3DvNCZA1oHdK_1uRLSWsPaFZ2wTg-CbgPynbpiiiPVWxtcPDYX96yirS1lX67myBVnMzfCWrNMIzDYFxBUcFCaGsUJA_kVnSfAUoxcLtDHbR-PKqZjC67Ugi-PUz46NX_6S2r_yt4fNmQ2ig.MEUCIB9kOGDjHsduICvASU8Q4bWsk2I29FNjkrHrrel8kgaoAiEA0Y037nhIgeEY00LiUj2IMubCWJmvIZvFK69D9ET0PM0<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9jDkOwyAURK9iUUdstlhc-SoYPg6yAxEQUUS5ewJFqhnNG703euULrRO61_pcCWmtYRuKTdimB0G3CZ2dhuJKIPUEuEI8thB9NhFqS_ks4zkvzDFYds-58opK8wvjQOxqFlyDJ0wKJjUVlONFCjrr7obujiamY7tCqQWPjlM-OnV_OpbPF1TCNOc.MEUCIBFdwiP2l_FwgRDlEJUfiibIZRCXYopalgyu4E1nsFugAiEA-Bcow1TQaXwZs-6wpF8vk6R-9KEXG99AVvxmERJv0iY>>> [cidimage003.gif@01D977FE.D040DA90] Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please click here<http://www.cisco.com/c/en/us/about/legal/terms-sale-software-license-agreement/company-registration-information.html<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9TsluhDAM_ZUR5yZmU4A5za-YYDIRWUaxEaqq_nuBQ09-8lt_qr2E6vmo3iKfJ8BxHNp6tlnbHMECJdgZcM67QCCHAYRKZMUYSHFe5cBCKnhLiUmhK0SRksDp_mD6VoWcZykoPifl05pLvLF-SwzV16ParnLPC3uQjSj45F6nrmAiOXLZ-B7S9c3SUD-vbTuuYz3geXAhM4-daSdaoRlMM0y1qVvdD6bupiubruyEKbtXOFewvrHOxV3s8s_en98_TaNZvg.MEUCIDoW2UfBV0R5S9pkYX_f8TyEhq0hgiE-zFV1X1_tGUMqAiEA3U0RxuZdzBFm600Y5QrbgytHyX6nytRJ4FNhmDJznzw><https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9UEGOgzAM_ErFeRMDKaT01K-4waQRIaliI7Ra9e8LSLuSDyOPPTOan2otsbpfqpfI-w6wbZt2gV3WLi_ggBKsDPjMq0AkjxGEysKKMZLiPMmGhVQMjhKTQl-IFkoC-_cb07cq5ANLQQk5qZCmXJYT65cssfq6VPNhHnjkADITxZD8Y78rmEi2XGY-g7QGTXMzY0c0DtfWNnYabFd3xqKrRzTQ2H6f-na1uu9a0w_2EKdDPGHK_hH3GKxPrHPxBzv-s38bOapoPr-fulth.MEUCIQCAAv5IQ2yzfhc3zCc987hjJpOGiVOzGtarsDtRRxQFkQIgBqVDrlLKE-oJEtytv87t1wyXsayo_CqmGWpCNFO38Fo<https://shared.outlook.inky.com/link?domain=www.cisco.com&t=h.eJw9TsluhDAM_ZUR5yZmU4A5za-YYDIRWUaxEaqq_nuBQ09-8lt_qr2E6vmo3iKfJ8BxHNp6tlnbHMECJdgZcM67QCCHAYRKZMUYSHFe5cBCKnhLiUmhK0SRksDp_mD6VoWcZykoPifl05pLvLF-SwzV16ParnLPC3uQjSj45F6nrmAiOXLZ-B7S9c3SUD-vbTuuYz3geXAhM4-daSdaoRlMM0y1qVvdD6bupiubruyEKbtXOFewvrHOxV3s8s_en98_TaNZvg.MEQCIElRARNVMCaKHwEf0HPkniVD2KLuO4oyB2kP_k25moSVAiBPZFkQUZH6rjWmXK3xidHS88r4Wp6JWCJWV9aHVtFjkg>>> for Company Registration Information. From: Victor Kuarsingh via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>>> Date: Wednesday, October 29, 2025 at 13:38 To: nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>>> Cc: Victor Kuarsingh <victor@jvknet.com<mailto:victor@jvknet.com<mailto:victor@jvknet.com>>> Subject: US Impact - October 29 2025 All, Anyone know what caused the large impact in the US at around noon ET today? regards, Vector K _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU4D43YYJOX5CUDIQNCA7HKW6B/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtjjFvwjAUhP8K8ozykti1EybaMEBBIIRQQzdDXoKV4CA_AwPiv9NkYKiYTrrvdHd3dnENGw3Y0fszjQAaQ54Cq21bBa2rQLvD0VyRegC9P_6fOSGRrhA2G77I8t-tmAi-232v8o9sO5mtl9mnms5_5Bew4YDV3Zqhggz4GrExthobWzpt0d9aV1NwaE_ARVREKPZlHCdlEir9J7pAuU-4jFMsIVIyUmkowzgQSoY87bqx6377saPFi_bO4wlvylBQ.MEUCIHPnMWPOgXbmwYlGyb92JM3bVGeoQ5Bi3JtYfCuctgy-AiEAy4O3LVJLQTaBWSu-y93TRJWDbMq8LqH-ktZu7ePh980><https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtj8FuwjAQRH8F-YyySRzHhBNtOLQUtaoQIuFmxUuwkjjI69JD1X9vHakcKqQ9zRvN7HyxD9ez5Yydvb_QEqA35Cmyyo5tNLoWlGvO5oo0AZj01X_PgESqRdjt-LasjvtsnfG63rxVotyvn99fywf59HLIH4HNZ6wLbYY0GfAdYm9suzL25JRF_zm6jqJmHCDliicLrgWiLrJUJvJUSBELLlUTa8UhkfnvxYtMRrlIeV7IEI4h_O6Tgeob_VN82J58_wBjlVHz.MEUCIDYh0ExXYMe1yK4-PFvEMl1h0_Ftak8u46xsNV1qOMlzAiEA6GSXQgwTEmfKNLRvIgnthqKQDMnt5cd9-9FikPH0wto<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtjjFvwjAUhP8K8ozykti1EybaMEBBIIRQQzdDXoKV4CA_AwPiv9NkYKiYTrrvdHd3dnENGw3Y0fszjQAaQ54Cq21bBa2rQLvD0VyRegC9P_6fOSGRrhA2G77I8t-tmAi-232v8o9sO5mtl9mnms5_5Bew4YDV3Zqhggz4GrExthobWzpt0d9aV1NwaE_ARVREKPZlHCdlEir9J7pAuU-4jFMsIVIyUmkowzgQSoY87bqx6377saPFi_bO4wlvylBQ.MEUCIActu6MvHzZdfPHA6jmadHIbSxfTN_fFaSvRXDxLDv56AiEA5uGwaq_sbLKeuHuSCPqPS2J_JPGcSXGnATAuxdtSYMg>> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/2V2N65DY5VJUM3MGDL77MWSC2DP3GXAJ/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtjs2qwjAUhF9FspaeNqlJ25VyC4LciiD-LaM9raE1veTk6kJ8d20XLsTVwHzDzNzZv2tZNmJn7_8oA2gNeQqstl0ddK4G7U5nc0UaAAz-9DNzQSJdI_AtX8pJfphsF5tCFPP8V6lit_7h-UrM97MFsPGINf2aoZIM-AaxNbaeGls5bdHfOtdQcOouIOKojDA-VpwnVRIq_RJdojwmQvIUK4iUjFQaypAHsZKhSPtu7Lu_fuxp-aaD83gCMWlP8g.MEUCIQCygNjOuvApkPyMrGyFuJohEzUt_w4zeA8vReNGjXI5GAIgMw3nayB-qC35Rz1dewSS7F8rTEutTlt2uCx2Jc6B-6Q><https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtj8FqwzAQRH8l6Fy8thR5Y59SagiEuBRC0-YorI0j7MhBq7aH0n9vFGgOobCnecPMzrf4CKOoZ-IY45lrgNFx5MwbP_XZFHowoTu6T-IrgKu-vPeciNn0BHInn0vd7PVu_dqqdtVsENu37ZNsXtTq_XEN4mEmhtTm2LKDOBCNzvdL5w_BeIpfUxg466YTSGVUsVBWE9lqLrHAQ4U61wpNl1ujoMDycvlijlmppSorTOGUwv99MlF7o39KTNuLn18hiFGV.MEQCICRGDTLAmGn9o-vhkwcFBK55PXbP8e6Pbwb3gTNGsrNcAiAomSrNztbRV6AezZ8ZpSc_Sige-deOQrNbb4zn69LDXg<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtjs2qwjAUhF9FspaeNqlJ25VyC4LciiD-LaM9raE1veTk6kJ8d20XLsTVwHzDzNzZv2tZNmJn7_8oA2gNeQqstl0ddK4G7U5nc0UaAAz-9DNzQSJdI_AtX8pJfphsF5tCFPP8V6lit_7h-UrM97MFsPGINf2aoZIM-AaxNbaeGls5bdHfOtdQcOouIOKojDA-VpwnVRIq_RJdojwmQvIUK4iUjFQaypAHsZKhSPtu7Lu_fuxp-aaD83gCMWlP8g.MEUCIE1iVfUckcXbQCbTlTYsW8LLH5Pu-38wVYCLgPHYewA4AiEAkH9o41oxQRQDxoZf_qLG10CJwAJQVYZ74Ve0_h7bjbU>> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/NJ34QFKZQG2FRALDK7EL3E4HESJ4AAFG/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtjkGPgjAUhP-K6XnDg7ZpwZMkAkaNibu3vVV5YAMU01f1YPzvLhz2sNnTJPNNZubJbr5nywW7hHClJUBvKVDkjBvbaPQtGH--2DvSDGD2V38zAxKZFuGwFfJY7r6PFS8_8_16p4u9KOSm-NrKPC8rYB8L1k1rlmqyEDrE3rp2ZV3jjcPwGH1H0XkcQMikTlCeGs7TJo21-RFTozqlQvEMG0i0SnQWq5hHUqtYZFM3Tt3_fpxo_Utn5_UGK4JP4w.MEQCIHmoJ5yR0LFMTzD9MDsAgnMNRwfy2a2TmnsCktU7BDz7AiBCOcm1R_mOJqwwWJoesIkoLuURHCMoULwP1Ybb5yB-XQ> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/HGR7CUM2SYLMSCUUKGNZMA23GISBDZ74/<https://shared.outlook.inky.com/link?domain=lists.nanog.org&t=h.eJxtjr2ugkAUhF_FbG04sJBdsPLnJlxzxUJCId0qB9yAi9mzVwvjuysUFsZqkvkmM3Nn_7Zjswk7OXehGUCnyZFnlOkbr7cNKHs86SvSCGD055-ZMxKpBuE33clVkfF8v8nyVVH8pdsyW_AwXefLn1JGwKYT1g5rmirS4FrETptmrk1tlUF3621L3rE_QxgFVYDRoeY8rmNfqpeoCsUhDgVPsIZAikAmvvC5F0nhh8nQjUP3148Drd50dB5PdXdQWA.MEUCIHdVLxO8Orbmxi7OYpleUB6jrDZHJYstVJsMRqp7wv7wAiEAy_LULC1oLLil89LgZ3anDqQ262y94W3h2qGdvfgoY1o>
Hi All, I have been pulling more information, and right now I've identified active BGP hijacking/conflicts visible on route-views.ny.routeviews.org involving AS30058 (FDCservers.net) with RPKI invalid announcements. 1. Confirmed Hijack - 45.138.210[.]0/24 * Legitimate Origin: AS2914 (NTT) - RPKI Valid * Invalid Origin: AS30058 (FDCservers) - RPKI Invalid * Both announcements actively visible in global routing table 2. Route Conflict - 103.155.8[.]0/23 * AS3491 (PCCW Global) - RPKI Valid * AS4637 (Telstra/Reach) - RPKI Valid * Dual origination requiring investigation Verification: telnet route-views.ny.routeviews.org show rpki as-number 30058 show rpki as-number 2914 show rpki as-number 3491 show rpki as-number 4637 Pulled at: 2025-11-02T18:41:44Z Additional Concerns: Multiple prefixes showing AS30058 with RPKI invalid status, suggesting a systemic issue: * 216.227.132[.]0/24 * 50.7.104[.]0/22 * 23.237.254[.]0/23 I think there are potentially more conflicts visible from this router, but this is a place to start. ________________________________ From: Terry Keeling <tkeeling@infranetworks.com> Sent: Thursday, October 30, 2025 8:00 AM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: Tim Burke <tim@mid.net> Subject: BGP Route Leak Observed on October 29, 2025 — Multi-AS Propagation Involving Tier 1s Quick correction: In my earlier message, I mistakenly linked to the wrong BGP event. I meant to draw attention to a different incident, which was part of a broader pattern of route leaks and propagation anomalies observed globally throughout October 29. With that clarified, I wanted to raise awareness of a substantial BGP route leak that occurred on October 29, 2025, with indications of broad propagation and potential global impact. The event appears to have originated from AS23470 (ReliableSite) and propagated through several Tier 1 providers, including AS174 (Cogent), AS6453 (Tata), AS2914 (NTT), AS3257 (GTT), and AS3356 (Lumen). Based on timeline analysis and route anomaly logs, the incident persisted for over 10 hours, affecting routing paths across North America, Latin America, Europe, and Asia. I've compiled a timeline of 100+ BGP events, including: * Timestamps (UTC) * Originating and propagating ASNs * Regional context * BGP message volume * Notes on Tier 1 and critical infrastructure involvement Some notable paths observed: * AS23470 → AS30058 → AS2914 / AS3257 (ReliableSite → NTT / GTT) * AS174 → AS38040 → AS4637 (Cogent → Asia → HK) * AS6939 → AS9318 (KR) → AS6461 (HE.net → Korea → Zayo) * Various Brazilian and Indonesian ASNs leaking routes back into Tier 1s like Cogent, Lumen, and Tata These anomalies were observed from multiple vantage points, suggesting wide propagation. However, the extent to which these reached end-user routing tables or caused visible service impact remains unclear. If anyone observed reachability issues, path changes, or control plane anomalies related to this event, I'd appreciate any insights or correlation. The full event timeline was compiled using Cloudflare Radar's BGP route leak data can be viewed here [https://res.public.onecdn.static.microsoft/assets/mail/file-icon/v2/xlsx_16x16.png]BGP_10_29_25.xlsx<https://isdsi-my.sharepoint.com/:x:/g/personal/tkeeling_infranetworks_com/EW8OYwt0PR1IgiC2kOW7MlYBmMKdJdOsQ-tZU-AOuwzt7Q?e=F6U0kE> Respectfully, ________________________________ From: Tim Burke via NANOG <nanog@lists.nanog.org> Sent: Wednesday, October 29, 2025 10:16 PM To: North American Network Operators Group <nanog@lists.nanog.org> Cc: Terry Keeling <tkeeling@infranetworks.com>; Tim Burke <tim@mid.net> Subject: Re: US Impact - October 29 2025 Looks like a small time WISP that may be trying to implement BGP. 3 /24’s and a /22 — not really much of an “event”… nor would it have any impact leading to the Azure situation today. On Oct 29, 2025, at 3:05 PM, Terry Keeling via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> wrote: Has anyone noticed this BGP event? BGP Origin Hijack event: 121786 | Cloudflare Radar<https://radar.cloudflare.com/routing/anomalies/hijack-121786> BGP Origin Hijack: 121786Copy link Details of the BGP hijack eventShare this... Hijacker ASN AS400320 - Valley Center Wireless (US) Victim ASNs AS2386 - AT&T Data Communications Services (US) Prefixes 12.13.233[.]0/24, 12.144.222[.]0/24, 12.221.212[.]0/22, 12.229.22[.]0/24 Messages 192 Earliest message time 10/29/2025, 15:46 Latest message time 10/29/2025, 19:08 Peers observed 17% Confidence Low Tags * IRR Invalid * RPKI Unknown * RPKI Old Origin Unknown * IRR Old Origin Invalid ________________________________ From: John Stuppi (jstuppi) via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Sent: Wednesday, October 29, 2025 1:39 PM To: North American Network Operators Group <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> Cc: John Stuppi (jstuppi) <jstuppi@cisco.com<mailto:jstuppi@cisco.com>> Subject: Re: US Impact - October 29 2025 I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts... Microsoft is investigating an ongoing DNS out [cid:inky-injection-inliner-03755809cc10337ec572b1f12a6beedf] Caution: External (nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>>) Graymail Details<removed-link> [cid:inky-injection-inliner-023b0474c934d83d8d52155624827a68] Report This Email<removed-link> I believe it’s related to the Azure outage: https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts-azure-and-microsoft-365-services/<https://www.bleepingcomputer.com/news/microsoft/microsoft-dns-outage-impacts-azure-and-microsoft-365-services/> Microsoft is investigating an ongoing DNS outage affecting customers worldwide, preventing them from accessing Microsoft Azure and Microsoft 365 services. According to reports on DownDetector and social networks, this incident began impacting Microsoft's services almost 1 hour ago and is currently causing server and website connection issues for tens of thousands of users. Some of those affected are having issues accessing the Intune and Azure portals, as well as the Exchange admin center, while others report that Microsoft's Azure Front Door Content Delivery Network (CDN) service is also down. Thanks, John "Life is good when you are happy; but much better when others are happy because of you." ~ Pope Francis [signature_1786569038] John Stuppi Engineering Program Manager – Incident Response CISSP #25525 CCIE, Security #11154 [signature_773777294] Security & Trust Organization Cisco Systems, Inc. jstuppi@cisco.com<mailto:jstuppi@cisco.com<mailto:jstuppi@cisco.com<mailto:jstuppi@cisco.com>>> Mobile: +1 732 319 3886<tel:+17323193886> Cisco.com<http://www.cisco.com/<http://www.cisco.com/>> [cidimage003.gif@01D977FE.D040DA90] Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please click here<http://www.cisco.com/c/en/us/about/legal/terms-sale-software-license-agreement/company-registration-information.html<http://www.cisco.com/c/en/us/about/legal/terms-sale-software-license-agreement/company-registration-information.html>> for Company Registration Information. From: Victor Kuarsingh via NANOG <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>>> Date: Wednesday, October 29, 2025 at 13:38 To: nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>> <nanog@lists.nanog.org<mailto:nanog@lists.nanog.org<mailto:nanog@lists.nanog.org>>> Cc: Victor Kuarsingh <victor@jvknet.com<mailto:victor@jvknet.com<mailto:victor@jvknet.com>>> Subject: US Impact - October 29 2025 All, Anyone know what caused the large impact in the US at around noon ET today? regards, Vector K _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU4D43YYJOX5CUDIQNCA7HKW6B/<https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/SS3LCXZU4D43YYJOX5CUDIQNCA7HKW6B/> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/2V2N65DY5VJUM3MGDL77MWSC2DP3GXAJ/<https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/2V2N65DY5VJUM3MGDL77MWSC2DP3GXAJ/> _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/NJ34QFKZ... _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/HGR7CUM2... [Logo image] Terry Keeling CISSP, CySA+, OSCP IT Security & Infrastructure InfraNet Solutions Inc. <https://www.infranetworks.com/> | Email Support<mailto:%20support@infranetworks.com> W: 781-356-5858 x236<tel:781-356-5858%20x236> | D: 617-729-3070<tel:617-729-3070> tkeeling@infranetworks.com<mailto:tkeeling@infranetworks.com> | Book time to meet with me!<https://outlook.office.com/bookwithme/user/8ec238638d8943799bb9f23989cf7f02%40infranetworks.com/meetingtype/ae33aefe-04f0-4560-a188-a86e8182f1b7?anonymous> [Facebook: infranetworks]<https://www.facebook.com/infranetworks> [X: infranetworks] <https://twitter.com/infranetworks> [Instagram: infranetfriends] <https://www.instagram.com/infranetfriends> [LinkedIn: infranet-solutions] <https://www.linkedin.com/company/infranet-solutions>
participants (6)
-
Jeff Shultz -
John Stuppi (jstuppi) -
Robert Webb -
Terry Keeling -
Tim Burke -
Victor Kuarsingh