Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

8,335

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

1,740

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

219

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

2,082

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

7,838

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Oct 13, 18:59 UTC	withdrawal	70	*	AS356
Oct 13, 18:59 UTC	withdrawal	80	*	AS53119
Oct 13, 18:59 UTC	withdrawal	80	*	AS7821
Oct 13, 18:59 UTC	withdrawal	70	*	AS61592
Oct 13, 18:59 UTC	withdrawal	80	*	AS136100
Oct 13, 18:59 UTC	withdrawal	80	*	AS266959
Oct 13, 18:59 UTC	withdrawal	80	*	AS215721
Oct 13, 18:59 UTC	withdrawal	70	*	AS53134
Oct 13, 18:59 UTC	withdrawal	70	*	AS12654
Oct 13, 18:59 UTC	withdrawal	70	*	AS263276
Oct 13, 18:58 UTC	moas	60	34.1.224.0/19	AS15169
Oct 13, 18:58 UTC	moas	60	156.154.150.0/23	AS399161
Oct 13, 18:58 UTC	moas	60	187.86.9.0/24	AS265290
Oct 13, 18:58 UTC	moas	60	210.90.46.0/24	AS17574
Oct 13, 18:58 UTC	moas	60	27.123.5.0/24	AS45706
Oct 13, 18:58 UTC	moas	60	38.87.57.0/24	AS174
Oct 13, 18:58 UTC	moas	60	124.250.102.0/23	AS9308
Oct 13, 18:58 UTC	moas	60	102.220.23.0/24	AS328847
Oct 13, 18:58 UTC	moas	60	120.92.236.0/23	AS4811
Oct 13, 18:58 UTC	moas	80	107.149.135.102/32	AS64050
Oct 13, 18:17 UTC	aspath	56	192.124.245.0/24	AS680
Oct 13, 18:17 UTC	aspath	56	192.109.31.0/24	AS1754
Oct 13, 18:17 UTC	aspath	56	130.73.0.0/16	AS680
Oct 13, 18:17 UTC	aspath	56	192.108.52.0/23	AS680
Oct 13, 18:17 UTC	aspath	56	192.35.151.0/24	AS680
Oct 13, 18:17 UTC	aspath	56	141.57.0.0/16	AS680
Oct 13, 18:17 UTC	aspath	56	188.75.32.0/21	AS48209
Oct 13, 18:17 UTC	aspath	56	134.169.0.0/16	AS680
Oct 13, 18:17 UTC	aspath	56	192.35.150.0/24	AS680
Oct 13, 18:17 UTC	aspath	56	141.76.0.0/16	AS680
Oct 13, 18:16 UTC	bogon	85	192.168.31.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.220.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.15.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.11.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.69.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.71.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.61.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.51.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	192.168.65.0/24	AS30722
Oct 13, 18:16 UTC	bogon	85	172.31.91.0/24	AS30722
Oct 13, 18:16 UTC	rpki	72	98.20.179.0/24	AS7029
Oct 13, 18:16 UTC	rpki	86	69.46.11.219/32	AS29802
Oct 13, 18:16 UTC	rpki	80	185.78.34.0/23	AS200065
Oct 13, 18:16 UTC	rpki	88	193.254.246.169/32	AS50095
Oct 13, 18:16 UTC	rpki	80	64.32.146.0/24	AS3257
Oct 13, 18:16 UTC	rpki	74	116.48.136.0/21	AS4760
Oct 13, 18:16 UTC	rpki	90	185.203.254.14/32	AS205856
Oct 13, 18:16 UTC	rpki	86	147.123.200.132/30	AS15830
Oct 13, 18:16 UTC	rpki	90	176.53.227.235/32	AS50340
Oct 13, 18:16 UTC	rpki	88	81.13.239.192/26	AS15547

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.