Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

9,399

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

2,647

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

1,823

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

1,469

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

8,166

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Aug 28, 15:38 UTC	withdrawal	80	*	AS59931
Aug 28, 15:38 UTC	withdrawal	70	*	AS202651
Aug 28, 15:38 UTC	withdrawal	70	*	AS40564
Aug 28, 15:38 UTC	withdrawal	70	*	AS206406
Aug 28, 15:38 UTC	withdrawal	70	*	AS264565
Aug 28, 15:38 UTC	withdrawal	90	*	AS39010
Aug 28, 15:38 UTC	withdrawal	70	*	AS30016
Aug 28, 15:38 UTC	withdrawal	80	*	AS40631
Aug 28, 15:38 UTC	withdrawal	70	*	AS30021
Aug 28, 15:38 UTC	withdrawal	80	*	AS36504
Aug 28, 15:38 UTC	moas	60	85.93.2.0/24	AS12586
Aug 28, 15:38 UTC	moas	70	88.230.136.0/21	AS47331
Aug 28, 15:38 UTC	moas	60	95.12.10.0/23	AS47331
Aug 28, 15:38 UTC	moas	60	38.87.57.0/24	AS174
Aug 28, 15:38 UTC	moas	60	124.250.102.0/23	AS9308
Aug 28, 15:38 UTC	moas	70	114.118.80.0/21	AS23724
Aug 28, 15:38 UTC	moas	60	102.220.23.0/24	AS328847
Aug 28, 15:38 UTC	moas	60	85.96.201.0/24	AS47331
Aug 28, 15:38 UTC	moas	60	207.244.144.0/20	AS23033
Aug 28, 15:38 UTC	moas	60	210.90.46.0/24	AS17574
Aug 28, 14:56 UTC	aspath	58	63.222.160.0/24	AS3491
Aug 28, 14:56 UTC	aspath	62	74.52.19.0/24	AS154335
Aug 28, 14:56 UTC	aspath	60	165.99.184.0/24	AS149287
Aug 28, 14:56 UTC	aspath	56	37.10.0.0/24	AS43996
Aug 28, 14:56 UTC	aspath	56	154.198.40.0/24	AS134365
Aug 28, 14:56 UTC	aspath	60	103.88.115.0/24	AS24088
Aug 28, 14:56 UTC	aspath	56	45.226.104.0/22	AS267013
Aug 28, 14:56 UTC	aspath	56	91.108.24.0/21	AS42065
Aug 28, 14:56 UTC	aspath	56	198.44.176.0/24	AS154321
Aug 28, 14:56 UTC	aspath	56	192.141.54.0/23	AS267443
Aug 28, 14:56 UTC	bogon	85	10.121.0.0/20	AS64545
Aug 28, 14:56 UTC	bogon	85	10.87.100.0/22	AS36692
Aug 28, 14:56 UTC	bogon	85	100.127.205.2/32	AS26118
Aug 28, 14:56 UTC	bogon	85	172.16.112.180/30	AS28624
Aug 28, 14:56 UTC	bogon	85	172.16.115.112/30	AS28624
Aug 28, 14:56 UTC	bogon	85	172.16.113.148/30	AS28624
Aug 28, 14:56 UTC	bogon	85	172.16.114.188/30	AS28624
Aug 28, 14:56 UTC	bogon	85	172.16.105.168/30	AS28624
Aug 28, 14:56 UTC	bogon	85	172.16.105.152/30	AS28624
Aug 28, 14:56 UTC	bogon	85	172.16.113.120/30	AS28624
Aug 28, 14:56 UTC	rpki	74	47.43.92.0/23	AS40294
Aug 28, 14:56 UTC	rpki	78	80.251.117.0/24	AS39125
Aug 28, 14:56 UTC	rpki	80	156.246.23.0/24	AS136255
Aug 28, 14:56 UTC	rpki	88	81.13.239.192/26	AS15547
Aug 28, 14:56 UTC	rpki	72	115.109.137.0/24	AS17908
Aug 28, 14:56 UTC	rpki	86	66.71.205.153/32	AS17294
Aug 28, 14:56 UTC	rpki	72	203.143.65.0/24	AS10105
Aug 28, 14:56 UTC	rpki	74	5.38.22.0/24	AS5384
Aug 28, 14:56 UTC	rpki	80	74.49.229.0/24	AS33490
Aug 28, 14:56 UTC	rpki	86	188.137.232.254/32	AS211381

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.