Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

9,270

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

2,469

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

350

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

145

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

2,911

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

8,433

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Oct 14, 05:29 UTC	withdrawal	80	*	AS215228
Oct 14, 05:29 UTC	withdrawal	70	*	AS16628
Oct 14, 05:29 UTC	withdrawal	80	*	AS215721
Oct 14, 05:29 UTC	withdrawal	70	*	AS262588
Oct 14, 05:29 UTC	withdrawal	80	*	AS13053
Oct 14, 05:29 UTC	withdrawal	80	*	AS58330
Oct 14, 05:29 UTC	withdrawal	80	*	AS7821
Oct 14, 05:29 UTC	withdrawal	80	*	AS40837
Oct 14, 05:29 UTC	withdrawal	70	*	AS52253
Oct 14, 05:29 UTC	withdrawal	80	*	AS9294
Oct 14, 05:28 UTC	moas	60	103.99.208.0/23	AS205960
Oct 14, 05:28 UTC	moas	60	63.222.42.0/24	AS31713
Oct 14, 05:28 UTC	moas	60	156.154.125.0/24	AS12008
Oct 14, 05:28 UTC	moas	60	38.87.57.0/24	AS174
Oct 14, 05:28 UTC	moas	60	124.250.102.0/23	AS9308
Oct 14, 05:28 UTC	moas	60	102.220.23.0/24	AS328847
Oct 14, 05:28 UTC	moas	60	120.92.236.0/23	AS4811
Oct 14, 05:28 UTC	moas	60	38.188.65.0/24	AS138754
Oct 14, 05:28 UTC	moas	60	170.33.22.0/24	AS45102
Oct 14, 05:28 UTC	moas	60	202.47.108.0/24	AS4812
Oct 14, 05:16 UTC	aspath	58	105.179.7.0/24	AS37228
Oct 14, 05:16 UTC	aspath	56	45.183.188.0/22	AS269298
Oct 14, 05:16 UTC	aspath	58	105.178.48.0/22	AS37228
Oct 14, 05:16 UTC	aspath	58	105.179.10.0/24	AS37228
Oct 14, 05:16 UTC	aspath	58	105.178.40.0/22	AS37228
Oct 14, 05:16 UTC	aspath	56	202.62.71.0/24	AS17483
Oct 14, 05:16 UTC	aspath	58	105.178.32.0/22	AS37228
Oct 14, 05:16 UTC	aspath	58	105.178.121.0/24	AS37228
Oct 14, 05:16 UTC	aspath	58	105.178.120.0/22	AS37228
Oct 14, 05:16 UTC	aspath	58	185.255.89.0/24	AS61173
Oct 14, 05:15 UTC	bogon	85	192.168.49.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.253.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.15.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.179.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.11.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.71.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.45.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.55.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.51.0/24	AS30722
Oct 14, 05:15 UTC	bogon	85	192.168.41.0/24	AS30722
Oct 14, 05:15 UTC	rpki	78	80.251.116.0/24	AS39125
Oct 14, 05:15 UTC	rpki	80	149.0.76.0/24	AS64639
Oct 14, 05:15 UTC	rpki	74	116.48.136.0/21	AS4760
Oct 14, 05:15 UTC	rpki	90	185.203.254.14/32	AS205856
Oct 14, 05:15 UTC	rpki	86	147.123.200.132/30	AS15830
Oct 14, 05:15 UTC	rpki	90	176.53.227.235/32	AS50340
Oct 14, 05:15 UTC	rpki	86	104.160.44.29/32	AS25820
Oct 14, 05:15 UTC	rpki	80	64.32.164.0/24	AS3257
Oct 14, 05:15 UTC	rpki	72	115.109.137.0/24	AS17908
Oct 14, 05:15 UTC	rpki	86	178.151.254.6/32	AS13188

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.