Skip to main content

Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

24h
MOAS conflict (multiple-origin AS)
8,810
events / 24h · hourly histogram below
24h
New prefix (first announcement)
1,566
events / 24h · hourly histogram below
24h
Sudden withdrawal event
5,195
events / 24h · hourly histogram below
24h
Bogon announcement
72
events / 24h · hourly histogram below
24h
AS-path anomaly
5,723
events / 24h · hourly histogram below
24h
RPKI-invalid route
2,190
events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline last 6 hours, all types

Classic feed →
Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When Type Severity Prefix AS
Aug 1, 04:55 UTC withdrawal 70 * AS40564
Aug 1, 04:55 UTC withdrawal 70 * AS43142
Aug 1, 04:55 UTC withdrawal 70 * AS40631
Aug 1, 04:55 UTC withdrawal 70 * AS327700
Aug 1, 04:55 UTC withdrawal 80 * AS269557
Aug 1, 04:55 UTC withdrawal 80 * AS49403
Aug 1, 04:55 UTC withdrawal 80 * AS55547
Aug 1, 04:55 UTC withdrawal 70 * AS13000
Aug 1, 04:55 UTC withdrawal 70 * AS201603
Aug 1, 04:55 UTC withdrawal 80 * AS328739
Aug 1, 04:54 UTC moas 70 114.118.96.0/21 AS23724
Aug 1, 04:54 UTC moas 60 118.196.200.0/21 AS4811
Aug 1, 04:54 UTC moas 60 38.87.57.0/24 AS174
Aug 1, 04:54 UTC moas 60 124.250.102.0/23 AS9308
Aug 1, 04:54 UTC moas 70 114.118.80.0/21 AS23724
Aug 1, 04:54 UTC moas 60 207.244.144.0/20 AS23033
Aug 1, 04:54 UTC moas 60 120.92.236.0/23 AS4811
Aug 1, 04:54 UTC moas 60 170.33.22.0/24 AS45102
Aug 1, 04:54 UTC moas 60 202.47.108.0/24 AS4812
Aug 1, 04:54 UTC moas 60 43.229.51.0/24 AS131274
Aug 1, 04:15 UTC aspath 56 179.48.154.0/24 AS271168
Aug 1, 04:15 UTC aspath 56 45.6.94.0/24 AS266129
Aug 1, 04:15 UTC aspath 56 124.248.189.0/24 AS23673
Aug 1, 04:15 UTC aspath 56 191.241.58.0/23 AS263668
Aug 1, 04:15 UTC aspath 56 124.248.187.0/24 AS23673
Aug 1, 04:15 UTC aspath 56 190.89.112.0/22 AS270387
Aug 1, 04:15 UTC aspath 56 170.231.218.0/23 AS263913
Aug 1, 04:15 UTC aspath 56 191.241.56.0/22 AS263668
Aug 1, 04:15 UTC aspath 56 124.248.175.0/24 AS23673
Aug 1, 04:15 UTC aspath 56 170.231.216.0/23 AS263913
Aug 1, 04:15 UTC bogon 85 172.16.108.96/30 AS28624
Aug 1, 04:15 UTC bogon 85 172.16.109.144/30 AS28624
Aug 1, 04:15 UTC bogon 85 172.16.112.180/30 AS28624
Aug 1, 04:15 UTC bogon 85 172.16.115.112/30 AS28624
Aug 1, 04:15 UTC bogon 85 10.100.3.1/32 AS4200000207
Aug 1, 04:15 UTC bogon 85 172.16.113.148/30 AS28624
Aug 1, 04:15 UTC bogon 85 172.16.106.34/32 AS28624
Aug 1, 04:15 UTC bogon 85 172.16.114.188/30 AS28624
Aug 1, 04:15 UTC bogon 85 10.50.49.5/32 AS4200000111
Aug 1, 04:15 UTC bogon 85 10.100.3.7/32 AS4200000213
Aug 1, 04:14 UTC rpki 80 45.156.12.0/22 AS64639
Aug 1, 04:14 UTC rpki 80 196.41.77.0/24 AS328907
Aug 1, 04:14 UTC rpki 80 46.221.32.0/24 AS64639
Aug 1, 04:14 UTC rpki 80 31.145.128.0/17 AS64639
Aug 1, 04:14 UTC rpki 80 154.80.224.0/24 AS134548
Aug 1, 04:14 UTC rpki 80 185.10.75.0/24 AS42440
Aug 1, 04:14 UTC rpki 80 45.221.66.0/24 AS34927
Aug 1, 04:14 UTC rpki 80 31.177.191.0/24 AS64639
Aug 1, 04:14 UTC rpki 80 78.135.88.0/24 AS64639
Aug 1, 04:14 UTC rpki 80 112.196.220.0/24 AS38705

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.

Share