Skip to main content
WorldIP.io

Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h
MOAS conflict (multiple-origin AS)
10,762
events / 24h · hourly histogram below
✦ 24h
New prefix (first announcement)
2,298
events / 24h · hourly histogram below
↓ 24h
Sudden withdrawal event
2,659
events / 24h · hourly histogram below
⛔ 24h
Bogon announcement
57
events / 24h · hourly histogram below
↻ 24h
AS-path anomaly
1,220
events / 24h · hourly histogram below
✗ 24h
RPKI-invalid route
8,600
events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →
Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When Type Severity Prefix AS
Aug 28, 08:08 UTC withdrawal 80 * AS48437
Aug 28, 08:08 UTC withdrawal 80 * AS147019
Aug 28, 08:08 UTC withdrawal 70 * AS48326
Aug 28, 08:08 UTC withdrawal 80 * AS134729
Aug 28, 08:08 UTC withdrawal 70 * AS23961
Aug 28, 08:08 UTC withdrawal 80 * AS38315
Aug 28, 08:08 UTC withdrawal 70 * AS8257
Aug 28, 08:08 UTC withdrawal 80 * AS7821
Aug 28, 08:08 UTC withdrawal 70 * AS13058
Aug 28, 08:08 UTC withdrawal 70 * AS39199
Aug 28, 08:08 UTC moas 60 170.33.22.0/24 AS45102
Aug 28, 08:08 UTC moas 60 120.92.236.0/23 AS4811
Aug 28, 08:08 UTC moas 60 207.244.144.0/20 AS23033
Aug 28, 08:08 UTC moas 60 85.96.201.0/24 AS47331
Aug 28, 08:08 UTC moas 60 102.220.23.0/24 AS328847
Aug 28, 08:08 UTC moas 70 114.118.80.0/21 AS23724
Aug 28, 08:08 UTC moas 60 124.250.102.0/23 AS9308
Aug 28, 08:08 UTC moas 60 38.87.57.0/24 AS174
Aug 28, 08:08 UTC moas 60 88.234.170.0/24 AS47331
Aug 28, 08:08 UTC moas 60 113.209.195.0/24 AS4847
Aug 28, 07:57 UTC aspath 58 167.250.25.0/24 AS265279
Aug 28, 07:57 UTC aspath 60 143.202.56.0/23 AS265432
Aug 28, 07:57 UTC aspath 58 157.66.177.0/24 AS152756
Aug 28, 07:57 UTC aspath 56 38.87.80.0/24 AS174
Aug 28, 07:57 UTC aspath 58 157.66.176.0/24 AS152756
Aug 28, 07:57 UTC aspath 56 38.131.220.0/24 AS174
Aug 28, 07:57 UTC aspath 56 38.133.139.0/24 AS174
Aug 28, 07:57 UTC aspath 56 38.58.105.0/24 AS174
Aug 28, 07:57 UTC aspath 56 38.255.18.0/23 AS174
Aug 28, 07:57 UTC aspath 56 200.47.85.0/24 AS7908
Aug 28, 07:56 UTC bogon 85 100.71.120.0/24 AS9583
Aug 28, 07:56 UTC bogon 85 172.16.112.200/30 AS28624
Aug 28, 07:56 UTC bogon 85 172.16.109.136/30 AS28624
Aug 28, 07:56 UTC bogon 85 172.16.108.68/30 AS28624
Aug 28, 07:56 UTC bogon 85 10.229.161.0/24 AS138501
Aug 28, 07:56 UTC bogon 85 172.16.113.12/30 AS28624
Aug 28, 07:56 UTC bogon 85 172.16.113.120/30 AS28624
Aug 28, 07:56 UTC bogon 85 172.16.105.152/30 AS28624
Aug 28, 07:56 UTC bogon 85 172.16.105.168/30 AS28624
Aug 28, 07:56 UTC bogon 85 172.16.113.124/30 AS28624
Aug 28, 07:56 UTC rpki 80 172.252.59.0/24 AS149430
Aug 28, 07:56 UTC rpki 78 176.204.115.0/24 AS5384
Aug 28, 07:56 UTC rpki 86 138.185.214.86/32 AS262482
Aug 28, 07:56 UTC rpki 90 134.17.16.240/32 AS25106
Aug 28, 07:56 UTC rpki 82 217.79.213.116/30 AS15830
Aug 28, 07:56 UTC rpki 78 5.245.151.0/24 AS35819
Aug 28, 07:56 UTC rpki 80 120.53.52.0/23 AS132203
Aug 28, 07:56 UTC rpki 86 66.71.205.15/32 AS17294
Aug 28, 07:56 UTC rpki 80 110.40.13.0/24 AS59011
Aug 28, 07:56 UTC rpki 80 88.135.33.0/24 AS210392

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.

Share