Skip to main content
WorldIP.io

Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h
MOAS conflict (multiple-origin AS)
8,623
events / 24h · hourly histogram below
✦ 24h
New prefix (first announcement)
1,865
events / 24h · hourly histogram below
↓ 24h
Sudden withdrawal event
339
events / 24h · hourly histogram below
⛔ 24h
Bogon announcement
99
events / 24h · hourly histogram below
↻ 24h
AS-path anomaly
2,116
events / 24h · hourly histogram below
✗ 24h
RPKI-invalid route
7,950
events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →
Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When Type Severity Prefix AS
Oct 13, 20:16 UTC aspath 58 105.178.121.0/24 AS37228
Oct 13, 20:16 UTC aspath 58 105.179.7.0/24 AS37228
Oct 13, 20:16 UTC aspath 58 103.107.227.0/24 AS136133
Oct 13, 20:16 UTC aspath 58 41.215.250.0/24 AS37006
Oct 13, 20:16 UTC aspath 58 105.178.48.0/22 AS37228
Oct 13, 20:16 UTC aspath 56 91.230.118.0/24 AS197294
Oct 13, 20:16 UTC aspath 56 177.75.60.0/24 AS262588
Oct 13, 20:16 UTC aspath 58 41.223.226.0/24 AS37006
Oct 13, 20:16 UTC aspath 56 138.36.249.0/24 AS61934
Oct 13, 20:16 UTC aspath 58 105.179.10.0/24 AS37228
Oct 13, 20:15 UTC bogon 85 192.168.31.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.220.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.15.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.11.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.69.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.71.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.61.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.51.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 192.168.65.0/24 AS30722
Oct 13, 20:15 UTC bogon 85 172.31.91.0/24 AS30722
Oct 13, 20:15 UTC rpki 80 89.127.248.0/22 AS6079
Oct 13, 20:15 UTC rpki 80 162.222.244.0/24 AS18859
Oct 13, 20:15 UTC rpki 80 138.0.41.160/29 AS52320
Oct 13, 20:15 UTC rpki 80 64.32.146.0/24 AS3257
Oct 13, 20:15 UTC rpki 74 116.48.136.0/21 AS4760
Oct 13, 20:15 UTC rpki 90 185.203.254.14/32 AS205856
Oct 13, 20:15 UTC rpki 86 147.123.200.132/30 AS15830
Oct 13, 20:15 UTC rpki 90 176.53.227.235/32 AS50340
Oct 13, 20:15 UTC rpki 88 81.13.239.192/26 AS15547
Oct 13, 20:15 UTC rpki 86 104.160.44.29/32 AS25820
Oct 13, 20:14 UTC withdrawal 70 * AS13099
Oct 13, 20:14 UTC withdrawal 70 * AS32160
Oct 13, 20:14 UTC withdrawal 80 * AS26410
Oct 13, 20:14 UTC withdrawal 70 * AS147285
Oct 13, 20:14 UTC withdrawal 80 * AS9294
Oct 13, 20:14 UTC withdrawal 70 * AS52749
Oct 13, 20:14 UTC withdrawal 70 * AS135839
Oct 13, 20:14 UTC withdrawal 70 * AS34376
Oct 13, 20:14 UTC withdrawal 80 * AS7821
Oct 13, 20:13 UTC moas 60 65.174.252.0/24 AS174
Oct 13, 20:13 UTC moas 60 195.46.128.0/19 AS15924
Oct 13, 20:13 UTC moas 60 64.93.25.0/24 AS40605
Oct 13, 20:13 UTC moas 60 27.123.5.0/24 AS45706
Oct 13, 20:13 UTC moas 60 38.87.57.0/24 AS174
Oct 13, 20:13 UTC moas 60 124.250.102.0/23 AS9308
Oct 13, 20:13 UTC moas 60 102.220.23.0/24 AS328847
Oct 13, 20:13 UTC moas 60 154.84.246.0/24 AS45194
Oct 13, 20:13 UTC moas 60 120.92.236.0/23 AS4811
Oct 13, 20:13 UTC moas 60 210.90.46.0/24 AS17574
Oct 13, 20:04 UTC first_seen 60 145.63.190.0/23 AS28458

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.

Share