Sentinel · research detector

Stealth blackout detector

Some shutdowns don't turn off the lights — they throttle DNS, HTTP, and HTTPS while leaving BGP routes UP. The country looks normal on the BGP control plane; inside, users can't load anything. We detect these with a 3-rule heuristic. Aryapour 2025 (arXiv:2507.14183) named this the “stealth blackout.”

Updated every 30 min · last refresh May 21 · Raw JSON · RESEARCH — not in production forecast yet

Candidate days

458

last 30 days

Strong candidates

149

strength ≥ 0.7

Unique countries

191

flagged at least once

Novel events

not in incidents table

What this catches

The detector's most useful job isn't finding NEW events — it's characterizing existing ones. All 458 candidates already exist in our incidents table, but with empty mechanism field. The detector lets us back-classify those opaque “Internet connectivity disruption” incidents as stealth blackout / data-plane only rather than ordinary BGP-withdraw outages.

That's the research-grade win: an existing forecast model that keys off IODA-BGP alerts systematically misses this pattern. The detector documents the gap.

Detection rules

Rule 1: IODA ping-slash24 critical alerts >= 5 in a country-day
Rule 2: IODA bgp critical alerts < ping-slash24 * 0.5 (BGP relatively stable)
Rule 3: Strength boosted by OONI blocking/interference >= 0.4 mean value

Labels: strong_candidate (strength ≥ 0.7), candidate (0.4 ≤ strength < 0.7), weak (strength < 0.4)

Top countries flagged

Strong candidates by country

Venezuela VE — 17 days

Apr 23ping-slash24: 166 · BGP: 36 · strength 1.00
- ping-slash24 critical alerts=166
- bgp critical alerts=36 (BGP stable relative to active probing)
- OONI blocking mean=0.471 on N=4 measurements
↗ Back-classifies incident e8021399bcc6
Apr 29ping-slash24: 147 · BGP: 72 · strength 1.00
- ping-slash24 critical alerts=147
- bgp critical alerts=72 (BGP stable relative to active probing)
- merit-nt critical alerts=1731 (darknet supports unreachability)
↗ Back-classifies incident de00d04b30eb
Apr 30ping-slash24: 193 · BGP: 26 · strength 1.00
- ping-slash24 critical alerts=193
- bgp critical alerts=26 (BGP stable relative to active probing)
- merit-nt critical alerts=511 (darknet supports unreachability)
↗ Back-classifies incident 5a7ae330e59b
May 1ping-slash24: 133 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=133
- bgp critical alerts=0 (BGP stable relative to active probing)
- merit-nt critical alerts=1039 (darknet supports unreachability)
- OONI blocking mean=0.447 on N=6 measurements
↗ Back-classifies incident 2872837122ad
May 3ping-slash24: 247 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=247
- bgp critical alerts=0 (BGP stable relative to active probing)
- merit-nt critical alerts=192 (darknet supports unreachability)
↗ Back-classifies incident d192ec770187
May 4ping-slash24: 145 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=145
- bgp critical alerts=0 (BGP stable relative to active probing)
- merit-nt critical alerts=65 (darknet supports unreachability)
- OONI blocking mean=0.405 on N=6 measurements
↗ Back-classifies incident e0917b09fc71
May 5ping-slash24: 239 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=239
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 34ab6fc3ea28
May 6ping-slash24: 222 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=222
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident fb3ba0d707d3
May 7ping-slash24: 280 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=280
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident d4ba6b3186b7
May 8ping-slash24: 292 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=292
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident ef3f3736caae
May 9ping-slash24: 104 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=104
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 2ff371a5d2de
May 11ping-slash24: 100 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=100
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident f0968983b005
May 12ping-slash24: 107 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=107
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 3eecafad49d6
May 13ping-slash24: 93 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=93
- bgp critical alerts=0 (BGP stable relative to active probing)
- merit-nt critical alerts=363 (darknet supports unreachability)
- OONI blocking mean=0.502 on N=5 measurements
↗ Back-classifies incident 994ddb31ad7e
May 14ping-slash24: 154 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=154
- bgp critical alerts=0 (BGP stable relative to active probing)
- merit-nt critical alerts=552 (darknet supports unreachability)
- OONI blocking mean=0.481 on N=6 measurements
↗ Back-classifies incident 643eb149d34a
May 15ping-slash24: 166 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=166
- bgp critical alerts=0 (BGP stable relative to active probing)
- merit-nt critical alerts=540 (darknet supports unreachability)
↗ Back-classifies incident 9511777b7b43
May 16ping-slash24: 110 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=110
- bgp critical alerts=0 (BGP stable relative to active probing)
- merit-nt critical alerts=264 (darknet supports unreachability)
- OONI blocking mean=0.412 on N=7 measurements
↗ Back-classifies incident ef2630c66111

Iran IR — 15 days

Apr 21ping-slash24: 94 · BGP: 24 · strength 1.00
- ping-slash24 critical alerts=94
- bgp critical alerts=24 (BGP stable relative to active probing)
- OONI blocking mean=0.907 on N=9 measurements
- OONI interference mean=0.497 on N=4 measurements
↗ Back-classifies incident 6d90a4187e47
Apr 24ping-slash24: 204 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=204
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.778 on N=9 measurements
- OONI header-manipulation mean=1.0
↗ Back-classifies incident 54ae0ae09a57
Apr 25ping-slash24: 192 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=192
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.778 on N=6 measurements
- OONI interference mean=0.422 on N=3 measurements
↗ Back-classifies incident 2ab1fa35551f
Apr 26ping-slash24: 191 · BGP: 24 · strength 1.00
- ping-slash24 critical alerts=191
- bgp critical alerts=24 (BGP stable relative to active probing)
- OONI blocking mean=0.63 on N=8 measurements
- OONI header-manipulation mean=0.857
↗ Back-classifies incident d7186c906600
Apr 27ping-slash24: 263 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=263
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.637 on N=9 measurements
- OONI middlebox-detection mean=0.583
↗ Back-classifies incident b9f8cfff7a70
Apr 28ping-slash24: 214 · BGP: 60 · strength 1.00
- ping-slash24 critical alerts=214
- bgp critical alerts=60 (BGP stable relative to active probing)
- OONI blocking mean=0.792 on N=12 measurements
- OONI interference mean=0.458 on N=4 measurements
↗ Back-classifies incident f5591604c204
Apr 29ping-slash24: 180 · BGP: 23 · strength 1.00
- ping-slash24 critical alerts=180
- bgp critical alerts=23 (BGP stable relative to active probing)
- OONI blocking mean=0.767 on N=5 measurements
- OONI interference mean=0.495 on N=4 measurements
↗ Back-classifies incident 4ab8701b3c8f
May 3ping-slash24: 65 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=65
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.929 on N=7 measurements
- OONI interference mean=0.416 on N=3 measurements
↗ Back-classifies incident 8916bd0c6fbb
May 13ping-slash24: 84 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=84
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.433 on N=4 measurements
- OONI middlebox-detection mean=0.5
↗ Back-classifies incident 71077eb0fb53
May 14ping-slash24: 193 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=193
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.43 on N=11 measurements
↗ Back-classifies incident 8303d76dea85
May 15ping-slash24: 129 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=129
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.679 on N=4 measurements
- OONI header-manipulation mean=0.75
↗ Back-classifies incident 25d2590086f8
May 16ping-slash24: 221 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=221
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.498 on N=11 measurements
↗ Back-classifies incident 13492ce5ce27
May 17ping-slash24: 193 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=193
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.647 on N=6 measurements
- OONI interference mean=0.464 on N=3 measurements
↗ Back-classifies incident 61c02d6957a3
May 18ping-slash24: 170 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=170
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.85 on N=5 measurements
- OONI interference mean=0.446 on N=3 measurements
↗ Back-classifies incident 26cfd0bc12c2
May 1ping-slash24: 67 · BGP: 14 · strength 0.92
- ping-slash24 critical alerts=67
- bgp critical alerts=14 (BGP stable relative to active probing)
- OONI blocking mean=0.833 on N=3 measurements
- OONI header-manipulation mean=1.0
↗ Back-classifies incident 9dc24d2c8b1a

Trinidad & Tobago TT — 12 days

Apr 21ping-slash24: 166 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=166
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident ffbf2eebfdde
Apr 22ping-slash24: 179 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=179
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 732e5304aeb0
Apr 23ping-slash24: 156 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=156
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 81bd10f7c20f
Apr 24ping-slash24: 201 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=201
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 9f27f9802ed0
Apr 25ping-slash24: 200 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=200
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident ea17153e9fdc
Apr 26ping-slash24: 189 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=189
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 737cecb0b511
Apr 27ping-slash24: 131 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=131
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 5b7ad4928d12
Apr 29ping-slash24: 144 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=144
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 9bbe84706ba6
Apr 30ping-slash24: 129 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=129
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 75793e869124
May 1ping-slash24: 133 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=133
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident bacf50661cb9
May 3ping-slash24: 117 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=117
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 5f72b73351f5
Apr 28ping-slash24: 95 · BGP: 0 · strength 0.95
- ping-slash24 critical alerts=95
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 5996630b7773

Egypt EG — 5 days

May 3ping-slash24: 208 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=208
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI blocking mean=0.429 on N=8 measurements
↗ Back-classifies incident 60fd838ddedf
May 11ping-slash24: 134 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=134
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 8c13334073c1
May 16ping-slash24: 125 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=125
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 89c8ba0784a4
May 17ping-slash24: 84 · BGP: 0 · strength 0.89
- ping-slash24 critical alerts=84
- bgp critical alerts=0 (BGP stable relative to active probing)
- OONI header-manipulation mean=0.351
↗ Back-classifies incident adf242d46236
May 13ping-slash24: 72 · BGP: 0 · strength 0.72
- ping-slash24 critical alerts=72
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident a87e75885ff9

France FR — 4 days

Apr 22ping-slash24: 178 · BGP: 60 · strength 1.00
- ping-slash24 critical alerts=178
- bgp critical alerts=60 (BGP stable relative to active probing)
↗ Back-classifies incident 4522e43c6967
Apr 23ping-slash24: 166 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=166
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 0ccf33e43d5a
Apr 24ping-slash24: 792 · BGP: 12 · strength 1.00
- ping-slash24 critical alerts=792
- bgp critical alerts=12 (BGP stable relative to active probing)
↗ Back-classifies incident a4c6010e38d1
May 3ping-slash24: 1105 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=1105
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 1ade5751ef6b

India IN — 4 days

May 3ping-slash24: 364 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=364
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 52ea48cc08ad
May 14ping-slash24: 182 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=182
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident d586d6ba8c31
May 9ping-slash24: 83 · BGP: 0 · strength 0.83
- ping-slash24 critical alerts=83
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident d98b076dc70c
May 13ping-slash24: 72 · BGP: 0 · strength 0.72
- ping-slash24 critical alerts=72
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident bc3b4168a9ac

Zimbabwe ZW — 4 days

Apr 24ping-slash24: 180 · BGP: 24 · strength 1.00
- ping-slash24 critical alerts=180
- bgp critical alerts=24 (BGP stable relative to active probing)
↗ Back-classifies incident e05ac10e4bd1
Apr 30ping-slash24: 100 · BGP: 39 · strength 1.00
- ping-slash24 critical alerts=100
- bgp critical alerts=39 (BGP stable relative to active probing)
↗ Back-classifies incident 8f3b076daea3
May 7ping-slash24: 126 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=126
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident c83b36044d52
May 13ping-slash24: 72 · BGP: 0 · strength 0.72
- ping-slash24 critical alerts=72
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident e9026320ee76

DO DO — 3 days

May 3ping-slash24: 117 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=117
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 38522922d01c
May 11ping-slash24: 93 · BGP: 0 · strength 0.93
- ping-slash24 critical alerts=93
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident dd3251e8eece
May 10ping-slash24: 70 · BGP: 0 · strength 0.70
- ping-slash24 critical alerts=70
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 374efa055d6d

LT LT — 3 days

Apr 22ping-slash24: 106 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=106
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 28b314cf2835
Apr 23ping-slash24: 131 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=131
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 8be989b7b642
May 3ping-slash24: 78 · BGP: 0 · strength 0.78
- ping-slash24 critical alerts=78
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident a472b8824248

MD MD — 3 days

Apr 24ping-slash24: 636 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=636
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 86e7083e2bbe
May 3ping-slash24: 221 · BGP: 0 · strength 1.00
- ping-slash24 critical alerts=221
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident 9c78b1858d74
Apr 22ping-slash24: 70 · BGP: 0 · strength 0.70
- ping-slash24 critical alerts=70
- bgp critical alerts=0 (BGP stable relative to active probing)
↗ Back-classifies incident f0fb1a152ff7

Honest data gaps

No country-day probe latency baseline — voidly probe_metrics only has 1 day of history
Probes are concentrated in non-censoring countries (US, GB, DE, etc.) — almost no internal vantage in IR/CN/RU
No throughput measurements at probe layer — throttling-without-blocking is invisible to current sensors
OONI Iran coverage is sparse (~5-30 measurements per day) — high false-negative risk on low-traffic days

Sensors that would tighten this detector

Internal vantage probes inside IR/CN/RU (high-risk, possibly via partner co-op)
Per-domain throughput sampling (TCP segment-rate, TLS handshake duration)
Anycast latency telemetry from CDN partners (Cloudflare RAT, Fastly)
RIPE Atlas ping-anchor diff between control plane (BGP) and data plane (ICMP)

Aryapour 2025 — Iran's Stealth Internet Blackout (arXiv:2507.14183) — the paper that named this pattern
Finding: detector writeup with method + caveats
/atlas/probe-coverage — why we lack internal vantage for stealth-blackout detection
/sentinel/backtest — main forecast model honesty

What this catches

Detection rules

Top countries flagged

Strong candidates by country

Honest data gaps

Sensors that would tighten this detector

Related