Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

10,791

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

2,721

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

2,350

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

1,422

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

8,609

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Aug 28, 09:08 UTC	withdrawal	70	*	AS27482
Aug 28, 09:08 UTC	withdrawal	80	*	AS31097
Aug 28, 09:08 UTC	withdrawal	70	*	AS13058
Aug 28, 09:08 UTC	withdrawal	80	*	AS7821
Aug 28, 09:08 UTC	withdrawal	80	*	AS18801
Aug 28, 09:08 UTC	withdrawal	70	*	AS8257
Aug 28, 09:08 UTC	withdrawal	80	*	AS14920
Aug 28, 09:08 UTC	withdrawal	70	*	AS8518
Aug 28, 09:08 UTC	withdrawal	80	*	AS134729
Aug 28, 09:08 UTC	withdrawal	80	*	AS202161
Aug 28, 09:08 UTC	moas	60	85.96.201.0/24	AS47331
Aug 28, 09:08 UTC	moas	60	102.220.23.0/24	AS328847
Aug 28, 09:08 UTC	moas	70	114.118.80.0/21	AS23724
Aug 28, 09:08 UTC	moas	60	124.250.102.0/23	AS9308
Aug 28, 09:08 UTC	moas	60	38.87.57.0/24	AS174
Aug 28, 09:08 UTC	moas	60	185.58.12.0/24	AS197893
Aug 28, 09:08 UTC	moas	60	210.90.46.0/24	AS17574
Aug 28, 09:08 UTC	moas	60	212.154.236.0/22	AS50482
Aug 28, 09:08 UTC	moas	60	159.220.43.0/24	AS3145
Aug 28, 09:08 UTC	moas	60	88.243.11.0/24	AS47331
Aug 28, 08:57 UTC	aspath	58	103.105.114.0/24	AS141887
Aug 28, 08:57 UTC	aspath	56	118.174.234.0/24	AS23969
Aug 28, 08:57 UTC	aspath	58	185.52.224.0/22	AS8283
Aug 28, 08:57 UTC	aspath	56	117.220.208.0/20	AS9829
Aug 28, 08:57 UTC	aspath	56	117.244.112.0/20	AS9829
Aug 28, 08:57 UTC	aspath	56	46.219.17.0/24	AS31148
Aug 28, 08:57 UTC	aspath	56	112.109.32.0/19	AS45361
Aug 28, 08:57 UTC	aspath	56	103.248.206.0/23	AS132608
Aug 28, 08:57 UTC	aspath	56	117.204.96.0/20	AS9829
Aug 28, 08:57 UTC	aspath	56	118.175.219.0/24	AS23969
Aug 28, 08:56 UTC	bogon	85	10.121.0.0/20	AS64545
Aug 28, 08:56 UTC	bogon	85	10.87.100.0/22	AS36692
Aug 28, 08:56 UTC	bogon	85	100.127.205.2/32	AS26118
Aug 28, 08:56 UTC	bogon	85	172.16.112.180/30	AS28624
Aug 28, 08:56 UTC	bogon	85	172.16.115.112/30	AS28624
Aug 28, 08:56 UTC	bogon	85	172.16.113.148/30	AS28624
Aug 28, 08:56 UTC	bogon	85	172.16.114.188/30	AS28624
Aug 28, 08:56 UTC	bogon	85	172.16.105.168/30	AS28624
Aug 28, 08:56 UTC	bogon	85	172.16.105.152/30	AS28624
Aug 28, 08:56 UTC	bogon	85	172.16.113.120/30	AS28624
Aug 28, 08:56 UTC	rpki	86	5.255.86.187/32	AS50673
Aug 28, 08:56 UTC	rpki	76	174.127.105.0/24	AS13213
Aug 28, 08:56 UTC	rpki	80	103.250.29.0/24	AS23456
Aug 28, 08:56 UTC	rpki	82	202.79.219.224/27	AS15830
Aug 28, 08:56 UTC	rpki	72	168.205.142.0/24	AS262642
Aug 28, 08:56 UTC	rpki	72	77.28.164.0/22	AS6821
Aug 28, 08:56 UTC	rpki	80	94.232.171.201/32	AS48434
Aug 28, 08:56 UTC	rpki	86	66.96.91.238/32	AS29802
Aug 28, 08:56 UTC	rpki	86	202.133.224.89/32	AS17408
Aug 28, 08:56 UTC	rpki	72	186.194.1.0/24	AS270878

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.