MOAS (Multiple Origin AS)
Also known as: multiple origin AS, multiple-origin autonomous system
A prefix that appears in BGP with more than one origin ASN - sometimes legitimate (anycast, multihoming) and sometimes a sign of hijacking.
Normally a prefix has a single origin ASN. A MOAS conflict is when the same prefix is announced with two or more different origins in the global table at once.
MOAS is not automatically malicious. It happens legitimately with anycast deployments, some multihoming setups, mergers, and traffic engineering. But it is also exactly what a BGP hijack looks like - an attacker originating someone else's prefix - so MOAS events are a primary signal in hijack detection.
Distinguishing benign from hostile MOAS relies on context: RPKI validity, whether the origins are related, IRR records, and historical stability of the prefix.