Skip to main content
WorldIP.io

Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h
MOAS conflict (multiple-origin AS)
10,793
events / 24h · hourly histogram below
✦ 24h
New prefix (first announcement)
2,737
events / 24h · hourly histogram below
↓ 24h
Sudden withdrawal event
2,353
events / 24h · hourly histogram below
⛔ 24h
Bogon announcement
57
events / 24h · hourly histogram below
↻ 24h
AS-path anomaly
1,422
events / 24h · hourly histogram below
✗ 24h
RPKI-invalid route
8,609
events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →
Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When Type Severity Prefix AS
Aug 28, 08:57 UTC aspath 58 103.105.114.0/24 AS141887
Aug 28, 08:57 UTC aspath 56 117.228.192.0/20 AS9829
Aug 28, 08:57 UTC aspath 56 149.249.32.0/20 AS20810
Aug 28, 08:57 UTC aspath 56 117.198.160.0/20 AS9829
Aug 28, 08:57 UTC aspath 56 62.205.144.0/20 AS8772
Aug 28, 08:57 UTC aspath 56 36.50.106.0/24 AS58495
Aug 28, 08:57 UTC aspath 58 136.228.132.0/24 AS131207
Aug 28, 08:57 UTC aspath 56 118.173.245.0/24 AS23969
Aug 28, 08:57 UTC aspath 56 103.241.204.0/24 AS132678
Aug 28, 08:57 UTC aspath 56 101.108.93.0/24 AS23969
Aug 28, 08:56 UTC bogon 85 10.121.0.0/20 AS64545
Aug 28, 08:56 UTC bogon 85 10.87.100.0/22 AS36692
Aug 28, 08:56 UTC bogon 85 100.127.205.2/32 AS26118
Aug 28, 08:56 UTC bogon 85 172.16.112.180/30 AS28624
Aug 28, 08:56 UTC bogon 85 172.16.115.112/30 AS28624
Aug 28, 08:56 UTC bogon 85 172.16.113.148/30 AS28624
Aug 28, 08:56 UTC bogon 85 172.16.114.188/30 AS28624
Aug 28, 08:56 UTC bogon 85 172.16.105.168/30 AS28624
Aug 28, 08:56 UTC bogon 85 172.16.105.152/30 AS28624
Aug 28, 08:56 UTC bogon 85 172.16.113.120/30 AS28624
Aug 28, 08:56 UTC rpki 80 41.138.100.0/24 AS25543
Aug 28, 08:56 UTC rpki 86 147.123.200.132/30 AS15830
Aug 28, 08:56 UTC rpki 80 156.246.23.0/24 AS136255
Aug 28, 08:56 UTC rpki 88 81.13.239.192/26 AS15547
Aug 28, 08:56 UTC rpki 72 115.109.137.0/24 AS17908
Aug 28, 08:56 UTC rpki 86 66.71.205.153/32 AS17294
Aug 28, 08:56 UTC rpki 72 203.143.65.0/24 AS10105
Aug 28, 08:56 UTC rpki 74 5.38.22.0/24 AS5384
Aug 28, 08:56 UTC rpki 80 74.49.229.0/24 AS33490
Aug 28, 08:56 UTC rpki 80 185.37.53.163/32 AS48434
Aug 28, 08:53 UTC withdrawal 70 * AS200088
Aug 28, 08:53 UTC withdrawal 70 * AS11228
Aug 28, 08:53 UTC withdrawal 80 * AS201787
Aug 28, 08:53 UTC withdrawal 70 * AS40564
Aug 28, 08:53 UTC withdrawal 70 * AS30016
Aug 28, 08:53 UTC withdrawal 70 * AS402857
Aug 28, 08:53 UTC withdrawal 70 * AS30021
Aug 28, 08:53 UTC withdrawal 80 * AS36504
Aug 28, 08:53 UTC withdrawal 70 * AS11676
Aug 28, 08:53 UTC withdrawal 70 * AS32528
Aug 28, 08:53 UTC moas 60 202.112.25.0/24 AS24361
Aug 28, 08:53 UTC moas 60 88.242.245.0/24 AS47331
Aug 28, 08:53 UTC moas 60 212.154.236.0/22 AS50482
Aug 28, 08:53 UTC moas 60 185.58.12.0/24 AS197893
Aug 28, 08:53 UTC moas 60 38.87.57.0/24 AS174
Aug 28, 08:53 UTC moas 60 124.250.102.0/23 AS9308
Aug 28, 08:53 UTC moas 70 114.118.80.0/21 AS23724
Aug 28, 08:53 UTC moas 60 102.220.23.0/24 AS328847
Aug 28, 08:53 UTC moas 60 85.96.201.0/24 AS47331
Aug 28, 08:53 UTC moas 60 207.244.144.0/20 AS23033

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.

Share