Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

8,511

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

1,860

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

362

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

101

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

2,056

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

7,982

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Oct 13, 22:29 UTC	withdrawal	80	*	AS42998
Oct 13, 22:29 UTC	withdrawal	80	*	AS62250
Oct 13, 22:29 UTC	withdrawal	80	*	AS267608
Oct 13, 22:29 UTC	withdrawal	80	*	AS147302
Oct 13, 22:29 UTC	withdrawal	80	*	AS30938
Oct 13, 22:29 UTC	withdrawal	70	*	AS58487
Oct 13, 22:29 UTC	withdrawal	70	*	AS211101
Oct 13, 22:29 UTC	withdrawal	80	*	AS190
Oct 13, 22:29 UTC	withdrawal	80	*	AS7821
Oct 13, 22:29 UTC	withdrawal	70	*	AS213323
Oct 13, 22:28 UTC	moas	60	123.103.80.0/20	AS23724
Oct 13, 22:28 UTC	moas	60	23.19.53.0/24	AS205544
Oct 13, 22:28 UTC	moas	60	37.135.166.0/23	AS12479
Oct 13, 22:28 UTC	moas	60	27.123.5.0/24	AS45706
Oct 13, 22:28 UTC	moas	60	38.87.57.0/24	AS174
Oct 13, 22:28 UTC	moas	60	124.250.102.0/23	AS9308
Oct 13, 22:28 UTC	moas	60	102.220.23.0/24	AS328847
Oct 13, 22:28 UTC	moas	60	154.84.246.0/24	AS45194
Oct 13, 22:28 UTC	moas	60	120.92.236.0/23	AS4811
Oct 13, 22:28 UTC	moas	60	38.188.65.0/24	AS138754
Oct 13, 22:16 UTC	aspath	58	185.255.89.0/24	AS61173
Oct 13, 22:16 UTC	aspath	64	184.164.245.0/24	AS47065
Oct 13, 22:16 UTC	aspath	56	45.175.72.0/24	AS268888
Oct 13, 22:15 UTC	bogon	85	192.168.3.0/24	AS30722
Oct 13, 22:15 UTC	bogon	85	100.80.128.0/18	AS28573
Oct 13, 22:15 UTC	bogon	85	192.168.15.0/24	AS30722
Oct 13, 22:15 UTC	bogon	85	192.168.11.0/24	AS30722
Oct 13, 22:15 UTC	bogon	85	172.16.5.0/24	AS30722
Oct 13, 22:15 UTC	bogon	85	192.168.20.0/24	AS30722
Oct 13, 22:15 UTC	bogon	85	192.168.30.0/24	AS30722
Oct 13, 22:15 UTC	bogon	85	100.123.81.0/24	AS45730
Oct 13, 22:15 UTC	bogon	85	192.168.24.0/24	AS30722
Oct 13, 22:15 UTC	bogon	85	172.31.91.0/24	AS30722
Oct 13, 22:15 UTC	rpki	80	103.110.109.0/24	AS7642
Oct 13, 22:15 UTC	rpki	74	12.43.90.0/24	AS2386
Oct 13, 22:15 UTC	rpki	86	160.119.231.222/32	AS328137
Oct 13, 22:15 UTC	rpki	88	193.254.246.169/32	AS50095
Oct 13, 22:15 UTC	rpki	74	116.48.136.0/21	AS4760
Oct 13, 22:15 UTC	rpki	90	185.203.254.14/32	AS205856
Oct 13, 22:15 UTC	rpki	86	147.123.200.132/30	AS15830
Oct 13, 22:15 UTC	rpki	90	176.53.227.235/32	AS50340
Oct 13, 22:15 UTC	rpki	88	81.13.239.192/26	AS15547
Oct 13, 22:15 UTC	rpki	86	104.160.44.29/32	AS25820
Oct 13, 22:03 UTC	first_seen	60	200.124.66.42/32	AS270271
Oct 13, 22:03 UTC	first_seen	60	185.133.74.0/24	AS20473
Oct 13, 22:03 UTC	first_seen	60	213.154.253.0/24	AS12859
Oct 13, 22:03 UTC	first_seen	60	213.154.239.0/24	AS12859
Oct 13, 22:03 UTC	first_seen	60	212.114.97.0/24	AS12859
Oct 13, 22:03 UTC	first_seen	60	213.154.244.0/24	AS12859
Oct 13, 22:02 UTC	first_seen	60	80.43.148.0/22	AS55256

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.