Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

8,869

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

1,430

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

5,197

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

5,234

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

2,173

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Aug 1, 05:55 UTC	withdrawal	70	*	AS133772
Aug 1, 05:55 UTC	withdrawal	70	*	AS43142
Aug 1, 05:55 UTC	withdrawal	70	*	AS30021
Aug 1, 05:55 UTC	withdrawal	70	*	AS11676
Aug 1, 05:55 UTC	withdrawal	70	*	AS199284
Aug 1, 05:55 UTC	withdrawal	70	*	AS51500
Aug 1, 05:55 UTC	withdrawal	70	*	AS54706
Aug 1, 05:55 UTC	withdrawal	80	*	AS134983
Aug 1, 05:55 UTC	withdrawal	80	*	AS17040
Aug 1, 05:55 UTC	withdrawal	80	*	AS327700
Aug 1, 05:54 UTC	moas	60	34.1.75.0/24	AS43515
Aug 1, 05:54 UTC	moas	60	71.18.123.0/24	AS396986
Aug 1, 05:54 UTC	moas	60	38.47.159.0/24	AS147019
Aug 1, 05:54 UTC	moas	60	38.87.57.0/24	AS174
Aug 1, 05:54 UTC	moas	60	124.250.102.0/23	AS9308
Aug 1, 05:54 UTC	moas	70	114.118.80.0/21	AS23724
Aug 1, 05:54 UTC	moas	70	51.194.180.0/24	AS9304
Aug 1, 05:54 UTC	moas	60	207.244.144.0/20	AS23033
Aug 1, 05:54 UTC	moas	60	120.92.236.0/23	AS4811
Aug 1, 05:54 UTC	moas	60	170.33.22.0/24	AS45102
Aug 1, 05:17 UTC	aspath	56	158.66.6.0/24	AS21111
Aug 1, 05:17 UTC	aspath	56	91.200.37.0/24	AS43769
Aug 1, 05:17 UTC	aspath	56	158.66.1.0/24	AS21111
Aug 1, 05:17 UTC	aspath	56	82.177.201.0/24	AS42246
Aug 1, 05:17 UTC	aspath	56	158.66.2.0/24	AS21111
Aug 1, 05:17 UTC	aspath	56	185.202.127.0/24	AS198595
Aug 1, 05:17 UTC	aspath	56	88.199.162.0/24	AS42923
Aug 1, 05:17 UTC	aspath	56	157.25.57.0/24	AS206770
Aug 1, 05:17 UTC	aspath	56	145.237.221.0/24	AS34339
Aug 1, 05:17 UTC	aspath	56	213.199.213.0/24	AS25070
Aug 1, 05:15 UTC	bogon	85	172.16.108.96/30	AS28624
Aug 1, 05:15 UTC	bogon	85	172.16.109.144/30	AS28624
Aug 1, 05:15 UTC	bogon	85	172.16.112.180/30	AS28624
Aug 1, 05:15 UTC	bogon	85	172.16.115.112/30	AS28624
Aug 1, 05:15 UTC	bogon	85	10.100.3.1/32	AS4200000207
Aug 1, 05:15 UTC	bogon	85	172.16.113.148/30	AS28624
Aug 1, 05:15 UTC	bogon	85	172.16.106.34/32	AS28624
Aug 1, 05:15 UTC	bogon	85	172.16.114.188/30	AS28624
Aug 1, 05:15 UTC	bogon	85	10.50.49.5/32	AS4200000111
Aug 1, 05:15 UTC	bogon	85	10.100.3.7/32	AS4200000213
Aug 1, 05:03 UTC	first_seen	80	82.97.248.163/32	AS9123
Aug 1, 04:59 UTC	first_seen	80	121.100.24.254/32	AS38761
Aug 1, 04:58 UTC	first_seen	80	146.70.111.94/32	AS9009
Aug 1, 04:53 UTC	first_seen	80	69.72.80.234/32	AS45753
Aug 1, 04:45 UTC	first_seen	80	5.212.178.0/24	AS197207
Aug 1, 04:43 UTC	first_seen	80	87.84.168.0/24	AS140666
Aug 1, 04:42 UTC	first_seen	80	207.56.69.211/32	AS54801
Aug 1, 04:33 UTC	first_seen	80	130.94.66.40/32	AS138915
Aug 1, 04:30 UTC	first_seen	80	82.109.172.0/24	AS200169
Aug 1, 04:29 UTC	first_seen	80	212.189.57.0/24	AS200169

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.