Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

8,810

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

1,566

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

5,195

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

5,723

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

2,190

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Aug 1, 04:55 UTC	withdrawal	70	*	AS40564
Aug 1, 04:55 UTC	withdrawal	70	*	AS43142
Aug 1, 04:55 UTC	withdrawal	70	*	AS40631
Aug 1, 04:55 UTC	withdrawal	70	*	AS327700
Aug 1, 04:55 UTC	withdrawal	80	*	AS269557
Aug 1, 04:55 UTC	withdrawal	80	*	AS49403
Aug 1, 04:55 UTC	withdrawal	80	*	AS55547
Aug 1, 04:55 UTC	withdrawal	70	*	AS13000
Aug 1, 04:55 UTC	withdrawal	70	*	AS201603
Aug 1, 04:55 UTC	withdrawal	80	*	AS328739
Aug 1, 04:54 UTC	moas	70	114.118.96.0/21	AS23724
Aug 1, 04:54 UTC	moas	60	118.196.200.0/21	AS4811
Aug 1, 04:54 UTC	moas	60	38.87.57.0/24	AS174
Aug 1, 04:54 UTC	moas	60	124.250.102.0/23	AS9308
Aug 1, 04:54 UTC	moas	70	114.118.80.0/21	AS23724
Aug 1, 04:54 UTC	moas	60	207.244.144.0/20	AS23033
Aug 1, 04:54 UTC	moas	60	120.92.236.0/23	AS4811
Aug 1, 04:54 UTC	moas	60	170.33.22.0/24	AS45102
Aug 1, 04:54 UTC	moas	60	202.47.108.0/24	AS4812
Aug 1, 04:54 UTC	moas	60	43.229.51.0/24	AS131274
Aug 1, 04:15 UTC	aspath	56	179.48.154.0/24	AS271168
Aug 1, 04:15 UTC	aspath	56	45.6.94.0/24	AS266129
Aug 1, 04:15 UTC	aspath	56	124.248.189.0/24	AS23673
Aug 1, 04:15 UTC	aspath	56	191.241.58.0/23	AS263668
Aug 1, 04:15 UTC	aspath	56	124.248.187.0/24	AS23673
Aug 1, 04:15 UTC	aspath	56	190.89.112.0/22	AS270387
Aug 1, 04:15 UTC	aspath	56	170.231.218.0/23	AS263913
Aug 1, 04:15 UTC	aspath	56	191.241.56.0/22	AS263668
Aug 1, 04:15 UTC	aspath	56	124.248.175.0/24	AS23673
Aug 1, 04:15 UTC	aspath	56	170.231.216.0/23	AS263913
Aug 1, 04:15 UTC	bogon	85	172.16.108.96/30	AS28624
Aug 1, 04:15 UTC	bogon	85	172.16.109.144/30	AS28624
Aug 1, 04:15 UTC	bogon	85	172.16.112.180/30	AS28624
Aug 1, 04:15 UTC	bogon	85	172.16.115.112/30	AS28624
Aug 1, 04:15 UTC	bogon	85	10.100.3.1/32	AS4200000207
Aug 1, 04:15 UTC	bogon	85	172.16.113.148/30	AS28624
Aug 1, 04:15 UTC	bogon	85	172.16.106.34/32	AS28624
Aug 1, 04:15 UTC	bogon	85	172.16.114.188/30	AS28624
Aug 1, 04:15 UTC	bogon	85	10.50.49.5/32	AS4200000111
Aug 1, 04:15 UTC	bogon	85	10.100.3.7/32	AS4200000213
Aug 1, 04:14 UTC	rpki	80	45.156.12.0/22	AS64639
Aug 1, 04:14 UTC	rpki	80	196.41.77.0/24	AS328907
Aug 1, 04:14 UTC	rpki	80	46.221.32.0/24	AS64639
Aug 1, 04:14 UTC	rpki	80	31.145.128.0/17	AS64639
Aug 1, 04:14 UTC	rpki	80	154.80.224.0/24	AS134548
Aug 1, 04:14 UTC	rpki	80	185.10.75.0/24	AS42440
Aug 1, 04:14 UTC	rpki	80	45.221.66.0/24	AS34927
Aug 1, 04:14 UTC	rpki	80	31.177.191.0/24	AS64639
Aug 1, 04:14 UTC	rpki	80	78.135.88.0/24	AS64639
Aug 1, 04:14 UTC	rpki	80	112.196.220.0/24	AS38705

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.