# Internet Outage Atlas

> Correlate public outage signals (IODA, RIPEstat BGP, live probe) for a country, ASN or domain. Builds a timeline of internet disruptions for a country, network (ASN) or domain by correlating IODA outage alerts and events (BGP, active probing, telescope, traffic signals from Georgia Tech), RIPEstat routing visibility and BGP update bursts, and a direct reachability probe of the domain. Overlapping signals from independent sources are marked as corroborated; single-signal events stay flagged as uncertain.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://internetoutageatlas.usefulweb.site/ (interactive tool at https://internetoutageatlas.usefulweb.site/tool)
- JSON API: POST https://internetoutageatlas.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://internetoutageatlas.usefulweb.site/api/v1/tool)
- OpenAPI: https://internetoutageatlas.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://internetoutageatlas.usefulweb.site/mcp - tool `internet_outage_atlas`

## Inputs
- mode (select): Mode
- target (text, required): Country code, ASN or domain
- targetType (select): Target type
- windowHours (integer): Look-back window
- pastedJson (textarea): IODA alerts/events JSON (paste mode) - Response of /v2/outages/alerts or /v2/outages/events (or {"alerts":…, "events":…}).

## Method
- IODA (Internet Outage Detection and Analysis, Georgia Tech) v2 API: /outages/alerts and /outages/events for entityType country or asn over the look-back window. IODA compares BGP-visible /24 blocks, active-probing responses, darknet telescope traffic and Google/Mozilla traffic against their recent history.
- Alerts are paired per data source (non-normal alert → next "normal" alert) into episodes; an episode without a recovery alert is treated as ongoing.
- For ASNs (and the ASN hosting a domain's first public IPv4/IPv6 address, via RIPEstat network-info) RIPEstat routing-status gives RIS peer visibility and announced prefixes; bgp-update-activity hours above max(3 × median, 100) updates are flagged as BGP bursts.
- Domains are also probed directly with one HTTPS GET from this server (reachable = any HTTP response below 500).
- Intervals from different sources that overlap (30-minute slack) are merged into incidents; ≥2 independent signals = corroborated, otherwise single-signal (could be measurement noise).