Skip to main content

Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

24h
MOAS conflict (multiple-origin AS)
10,823
events / 24h · hourly histogram below
24h
New prefix (first announcement)
1,398
events / 24h · hourly histogram below
24h
Sudden withdrawal event
207
events / 24h · hourly histogram below
24h
Bogon announcement
51
events / 24h · hourly histogram below
24h
AS-path anomaly
54
events / 24h · hourly histogram below
24h
RPKI-invalid route
8,087
events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline last 6 hours, all types

Classic feed →
Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When Type Severity Prefix AS
Aug 15, 04:33 UTC withdrawal 70 * AS24232
Aug 15, 04:33 UTC withdrawal 90 * AS48434
Aug 15, 04:33 UTC withdrawal 70 * AS204832
Aug 15, 04:33 UTC withdrawal 70 * AS147060
Aug 15, 04:33 UTC withdrawal 70 * AS39199
Aug 15, 04:33 UTC withdrawal 70 * AS24544
Aug 15, 04:33 UTC withdrawal 80 * AS7821
Aug 15, 04:33 UTC withdrawal 70 * AS43648
Aug 15, 04:33 UTC withdrawal 80 * AS50577
Aug 15, 04:33 UTC withdrawal 70 * AS138156
Aug 15, 04:33 UTC moas 60 207.244.144.0/20 AS23033
Aug 15, 04:33 UTC moas 70 114.118.80.0/21 AS23724
Aug 15, 04:33 UTC moas 60 124.250.102.0/23 AS9308
Aug 15, 04:33 UTC moas 60 201.159.255.0/24 AS262568
Aug 15, 04:33 UTC moas 60 38.87.57.0/24 AS174
Aug 15, 04:33 UTC moas 70 192.82.134.0/24 AS397197
Aug 15, 04:33 UTC moas 60 63.221.244.0/24 AS3491
Aug 15, 04:33 UTC moas 70 34.0.225.0/24 AS43515
Aug 15, 04:33 UTC moas 60 110.43.168.0/21 AS23724
Aug 15, 04:33 UTC moas 60 42.240.128.0/20 AS58466
Aug 15, 03:52 UTC aspath 56 164.146.0.0/15 AS37130
Aug 15, 03:52 UTC aspath 56 152.174.0.0/17 AS7418
Aug 15, 03:52 UTC aspath 56 5.59.34.0/24 AS39906
Aug 15, 03:52 UTC aspath 56 104.23.216.0/24 AS13335
Aug 15, 03:52 UTC aspath 56 95.46.33.0/24 AS39906
Aug 15, 03:52 UTC aspath 56 104.22.132.0/24 AS13335
Aug 15, 03:52 UTC aspath 56 164.151.128.0/17 AS37130
Aug 15, 03:52 UTC aspath 56 198.54.8.0/24 AS37130
Aug 15, 03:52 UTC aspath 56 196.208.80.0/22 AS20011
Aug 15, 03:52 UTC aspath 56 152.174.128.0/17 AS7418
Aug 15, 03:51 UTC bogon 85 172.16.108.96/30 AS28624
Aug 15, 03:51 UTC bogon 85 169.254.1.0/24 AS9730
Aug 15, 03:51 UTC bogon 85 172.16.112.180/30 AS28624
Aug 15, 03:51 UTC bogon 85 172.16.115.112/30 AS28624
Aug 15, 03:51 UTC bogon 85 172.16.113.148/30 AS28624
Aug 15, 03:51 UTC bogon 85 172.16.106.34/32 AS28624
Aug 15, 03:51 UTC bogon 85 172.16.114.188/30 AS28624
Aug 15, 03:51 UTC bogon 85 10.93.0.0/24 AS29680
Aug 15, 03:51 UTC bogon 85 172.16.105.168/30 AS28624
Aug 15, 03:51 UTC bogon 85 172.16.105.152/30 AS28624
Aug 15, 03:51 UTC rpki 86 93.157.117.43/32 AS35007
Aug 15, 03:51 UTC rpki 82 218.242.178.0/24 AS9812
Aug 15, 03:51 UTC rpki 80 27.112.77.0/24 AS23456
Aug 15, 03:51 UTC rpki 80 207.145.156.0/24 AS3257
Aug 15, 03:51 UTC rpki 82 216.186.249.0/24 AS11776
Aug 15, 03:51 UTC rpki 74 185.228.38.0/24 AS36351
Aug 15, 03:51 UTC rpki 90 140.130.1.0/24 AS1659
Aug 15, 03:51 UTC rpki 78 59.161.128.0/20 AS4755
Aug 15, 03:51 UTC rpki 86 150.107.49.94/32 AS207590
Aug 15, 03:51 UTC rpki 80 178.236.254.0/24 AS42861

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.

Share