Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

10,496

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

1,768

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

277

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

176

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

4,180

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

9,864

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Oct 16, 18:29 UTC	withdrawal	80	*	AS137951
Oct 16, 18:29 UTC	withdrawal	80	*	AS37506
Oct 16, 18:29 UTC	withdrawal	80	*	AS267560
Oct 16, 18:29 UTC	withdrawal	80	*	AS7821
Oct 16, 18:29 UTC	withdrawal	80	*	AS262898
Oct 16, 18:29 UTC	withdrawal	80	*	AS23842
Oct 16, 18:29 UTC	withdrawal	70	*	AS44692
Oct 16, 18:29 UTC	withdrawal	80	*	AS215721
Oct 16, 18:29 UTC	withdrawal	80	*	AS16039
Oct 16, 18:29 UTC	withdrawal	70	*	AS33490
Oct 16, 18:29 UTC	moas	60	147.75.207.0/24	AS15830
Oct 16, 18:29 UTC	moas	60	156.154.94.0/23	AS399169
Oct 16, 18:29 UTC	moas	60	38.87.57.0/24	AS174
Oct 16, 18:29 UTC	moas	60	124.250.102.0/23	AS9308
Oct 16, 18:29 UTC	moas	60	120.92.236.0/23	AS4811
Oct 16, 18:29 UTC	moas	60	38.188.65.0/24	AS138754
Oct 16, 18:29 UTC	moas	60	170.33.22.0/24	AS45102
Oct 16, 18:29 UTC	moas	60	202.47.108.0/24	AS4812
Oct 16, 18:29 UTC	moas	60	185.231.56.0/24	AS35598
Oct 16, 18:29 UTC	moas	60	216.168.228.0/24	AS19836
Oct 16, 18:16 UTC	aspath	56	196.2.28.0/23	AS20011
Oct 16, 18:16 UTC	aspath	56	42.96.51.0/24	AS45903
Oct 16, 18:16 UTC	aspath	56	164.151.0.0/17	AS37130
Oct 16, 18:16 UTC	aspath	56	192.96.236.0/24	AS37130
Oct 16, 18:16 UTC	aspath	56	197.101.162.0/23	AS20011
Oct 16, 18:16 UTC	aspath	56	42.96.39.0/24	AS45903
Oct 16, 18:16 UTC	aspath	56	196.2.24.0/22	AS20011
Oct 16, 18:16 UTC	aspath	56	196.28.32.0/21	AS20011
Oct 16, 18:16 UTC	aspath	56	192.96.234.0/24	AS37130
Oct 16, 18:16 UTC	aspath	56	103.9.196.0/24	AS45903
Oct 16, 18:15 UTC	bogon	85	10.152.1.20/31	AS65200
Oct 16, 18:15 UTC	bogon	85	100.74.0.0/20	AS8764
Oct 16, 18:15 UTC	bogon	85	172.16.106.34/32	AS28624
Oct 16, 18:15 UTC	bogon	85	10.5.5.0/31	AS9002
Oct 16, 18:15 UTC	bogon	85	10.87.1.0/24	AS65500
Oct 16, 18:15 UTC	bogon	85	100.80.0.0/18	AS28573
Oct 16, 18:15 UTC	bogon	85	100.74.48.0/20	AS8764
Oct 16, 18:15 UTC	bogon	85	10.88.0.0/16	AS65500
Oct 16, 18:15 UTC	bogon	85	10.0.0.0/24	AS29680
Oct 16, 18:15 UTC	bogon	85	100.74.16.0/20	AS8764
Oct 16, 18:15 UTC	rpki	80	70.39.242.0/24	AS3257
Oct 16, 18:15 UTC	rpki	86	115.146.123.0/32	AS38732
Oct 16, 18:15 UTC	rpki	86	23.227.182.35/32	AS29802
Oct 16, 18:15 UTC	rpki	80	64.32.146.0/24	AS3257
Oct 16, 18:15 UTC	rpki	86	103.91.189.87/32	AS136523
Oct 16, 18:15 UTC	rpki	82	140.131.160.0/19	AS1659
Oct 16, 18:15 UTC	rpki	86	94.177.129.251/32	AS202744
Oct 16, 18:15 UTC	rpki	88	81.13.239.192/26	AS15547
Oct 16, 18:15 UTC	rpki	80	64.32.164.0/24	AS3257
Oct 16, 18:15 UTC	rpki	86	124.197.24.167/32	AS140766

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.