AWS regions me-south-1 (Bahrain) and me-central-1 (UAE) suffered catastrophic physical infrastructure damage. Three primary BGP prefixes were withdrawn. This report covers the complete scan of all 281,574 hostnames across those prefixes — 30,910 real domains and 250,664 EC2 infrastructure entries — with DNS resolution and HTTP probing for every one.
Customer-facing websites, APIs, SaaS applications, government portals. These are the domains organizations and users interact with.
54.1% operational
Entries like ec2-3-29-32-137.me-central-1.compute.amazonaws.com. Bare EC2 instance hostnames — infrastructure plumbing, not user-facing services.
95.1% down
Reporting "281K domains affected" without separating EC2 infrastructure from real domains overstates the user-facing impact. The 30,910 real domains are the ones that matter to organizations and end users. EC2 reverse DNS entries represent AWS's own infrastructure — important for understanding the compute layer damage, but not the same as customer services going dark.
| Prefix | IPs | ASN | Region |
|---|---|---|---|
157.175.0.0/16 | 65,536 | AS16509 | me-south-1 (Bahrain) |
15.185.0.0/16 | 65,536 | AS16509 | me-south-1 (Bahrain) |
3.28.0.0/15 | 131,072 | AS16509 | me-central-1 (UAE) |
| Metric | Pre-Event | Current | Change |
|---|---|---|---|
| Peer degree | 117 | 214 | +83% |
| Upstream providers | 16 | 113 | +606% |
| Lost upstreams | 0 | 11 | 11 providers dropped |
| Reputation | — | 75/100 | MULTIPLE_UPSTREAMS_LOST |
Serving HTTP responses: 8,136 restored in-place + 6,453 migrated live + 1,577 app errors + 551 server errors.
11,273 unreachable on original IPs + 1,848 migrated but unreachable + 1,072 NXDOMAIN (domain gone entirely).
95.1% of EC2 instances remain down. Only 12,341 (4.9%) respond to HTTP. 11,666 are NXDOMAIN — AWS has deregistered those instance hostnames entirely.
The ~5% that respond are likely instances on partially restored sub-ranges that happened to survive or were re-provisioned.
| Prefix | Real Domains | HTTP Live | Live Rate | Status |
|---|---|---|---|---|
3.28.x.x | 6,415 | 3,338 | 52.0% | Majority Restored |
3.29.x.x | 7,467 | 3,510 | 47.0% | Partially Restored |
15.185.x.x | 4,099 | 1,856 | 45.3% | Partially Restored |
157.175.x.x | 3,556 | 1,560 | 43.9% | Partially Restored |
| Prefix | Type | Domains Migrated Here | Location |
|---|---|---|---|
158.252.x.x | New | 1,355 | Dubai Al Barsha |
16.24.x.x | New | 729 | Zallaq, Bahrain |
157.241.x.x | New | 472 | Zallaq, Bahrain |
16.25.x.x | New | 300 | Manama, Bahrain |
2,856 real domains have already migrated to these new prefixes. All are 100% operational. This is AWS's primary recovery strategy — new IP ranges in the same geographic locations (Zallaq, Manama, Dubai Al Barsha).
91% of migrated domains stayed within AWS. Only 747 moved to a non-AWS provider.
| Provider | Domains | % |
|---|---|---|
| AWS (all variants) | 7,554 | 91.0% |
| Cloudflare | 256 | 3.1% |
| Hetzner | 57 | 0.7% |
| Akamai | 37 | 0.4% |
| GNX | 27 | 0.3% |
| DigitalOcean | 26 | 0.3% |
| Oracle Cloud | 22 | 0.3% |
| Google Cloud | 19 | 0.2% |
| Hostinger | 19 | 0.2% |
| Microsoft Azure | 16 | 0.2% |
| Alibaba Cloud | 15 | 0.2% |
| Others (50+) | 252 | 3.0% |
Migration overwhelmingly stayed in the Middle East — not the US/Canada pattern seen in smaller samples.
+ IE (41), GB (39), SG (36), FI (36), FR (32), ZA (25), HK (22), and 20+ more countries
This is a major correction from the 230-domain sample, which suggested Canada was the #1 destination. At full scale, the migration is overwhelmingly in-region — organizations moved to new AWS infrastructure in the same countries, not to distant regions.
| Strategy | Domains | % | Mechanism |
|---|---|---|---|
| Restored in-place | 8,136 | 26.3% | Same IP as before, AWS partially re-announced routes and restored infrastructure |
| New ME infrastructure | 5,688 | 18.4% | Moved to new AWS prefixes: 158.252.x (Dubai), 16.24.x / 157.241.x (Zallaq), 16.25.x (Manama) |
| AWS other regions | 1,866 | 6.0% | DNS changed to ELBs in other AWS regions (eu-central, us-east, ca-central, ap-south) |
| App error (4xx) | 1,577 | 5.1% | Server responds but returns client errors — partially recovered or misconfigured |
| CDN (Cloudflare/Akamai) | 293 | 0.9% | Full migration to CDN anycast. Cloudflare (256), Akamai (37) |
| Server error (5xx) | 551 | 1.8% | Server responds but returns 500-series errors — infrastructure up, application down |
| Other providers | 454 | 1.5% | Hetzner, DigitalOcean, Oracle, Google Cloud, Azure, Hostinger, Alibaba, etc. |
| Unreachable | 11,273 | 36.5% | Still points to original AWS ME IP, HTTP timeout — no recovery action taken |
| Migrated but down | 1,848 | 6.0% | Changed IP but new destination also unreachable — failed migration |
| NXDOMAIN | 1,072 | 3.5% | Domain registration expired or DNS removed entirely |
89% of hostnames on the withdrawn prefixes are EC2 reverse DNS — infrastructure, not services. The 30,910 real domains are the customer-facing impact.
16,717 of 30,910 real domains are serving live HTTP traffic — restored in-place (8,136) or migrated to new infrastructure (6,453) or responding with errors (2,128).
14,193 real domains non-operational. 11,273 unreachable on original IPs. 1,848 migrated but still down. 1,072 NXDOMAIN (domain gone).
Of 8,301 migrated domains, 7,554 stayed within AWS. Only 747 (9%) moved to another provider. Cloudflare was #1 alternative at just 256 domains.
Migration was overwhelmingly in-region: UAE (3,740) and Bahrain (3,172). AWS deployed 4 new prefixes in Dubai and Bahrain. Only 17% went outside ME.
For real domains still on original IPs, 44-52% are serving HTTP. 3.28.x leads at 52%. AWS has partially restored all 4 sub-ranges but none is fully back.
The raw number — 281K hostnames affected — dramatically overstates the user-facing damage. When you separate EC2 infrastructure (95% down) from real domains (46% down), the picture is severe but not catastrophic. Over half of customer-facing services have recovered, mostly by moving to new AWS infrastructure in the same region. The real risk is the 11,273 domains that haven't taken any recovery action at all — still pointing to unreachable IPs with no DNS change.