Access remains affected from some networks that are blocking Railway IP addresses. We have submitted review requests to security vendors and continue working with network operators to restore legitimate access.

The scanning traffic uses forged Railway source IP addresses and does not originate from our network. We do not yet have an estimated time for all affected networks to remove their blocks.

Network administrators can use this incident notice to review affected rules and permit legitimate access while retaining protections against unsolicited scanning traffic.

Some users are unable to access Railway-hosted applications or railway.com because network providers and security services have blocked Railway IP addresses.

We’ve confirmed that a third party is sending scanning traffic using forged Railway source IP addresses. This traffic does not originate from Railway’s network. The spoofing does not require access to Railway infrastructure, and these reports are not evidence that Railway services or customer workloads have been compromised.

We have found no evidence that this is in any way tied to the October 21 security incident.

We are working with network providers and security vendors to remove the resulting blocks and correct reputation listings. Access may remain affected on individual networks until those blocks are lifted.

If you are affected, ask your network administrator or provider to review any blocks on Railway IP addresses and share this incident notice with them. They can allow legitimate access to your application while retaining protections against unsolicited scanning traffic. Using another network may provide temporary access.

We will provide updates as this work progresses.