Pulse — AS-path anomaly
Unique-AS-path lengths (prepends collapsed) that deviate sharply from the recent 36-hour median for that prefix.
What is AS-path anomaly?
An AS-path anomaly is an unusual or implausible sequence of Autonomous Systems in a route advertisement whose unique-AS-path length (prepends collapsed) deviates sharply from the recent 36-hour median for that prefix — an unexpected transit AS, a loop, or a sudden detour. It can reveal a route leak or a path-prepending mistake.
Geographic distribution
Flagged events
Showing 200 most recent of 5,215 · last 24h| When | Severity | Prefix | AS |
|---|---|---|---|
| Oct 18, 06:16 UTC | 62 | 202.92.144.0/22 | AS45209 |
| Oct 18, 06:16 UTC | 56 | 103.56.204.0/24 | AS58477 |
| Oct 18, 05:16 UTC | 58 | 196.12.158.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 56 | 168.210.88.0/21 | AS20011 |
| Oct 18, 05:16 UTC | 58 | 197.243.48.0/22 | AS37228 |
| Oct 18, 05:16 UTC | 58 | 196.12.131.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.216.80.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 62 | 45.125.12.0/24 | AS55933 |
| Oct 18, 05:16 UTC | 56 | 109.232.88.0/21 | AS50201 |
| Oct 18, 05:16 UTC | 58 | 196.12.137.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.135.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.144.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.153.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.145.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.150.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.130.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 56 | 142.65.184.0/24 | AS243 |
| Oct 18, 05:16 UTC | 58 | 196.12.138.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 56 | 197.101.124.0/22 | AS20011 |
| Oct 18, 05:16 UTC | 56 | 194.26.96.0/24 | AS44529 |
| Oct 18, 05:16 UTC | 56 | 168.210.48.0/20 | AS20011 |
| Oct 18, 05:16 UTC | 58 | 196.12.148.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.140.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 82.147.91.0/24 | AS197392 |
| Oct 18, 05:16 UTC | 58 | 196.12.143.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.151.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 62 | 103.115.48.0/24 | AS55933 |
| Oct 18, 05:16 UTC | 58 | 196.12.159.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.156.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.152.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.216.81.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 60 | 103.119.0.0/24 | AS55933 |
| Oct 18, 05:16 UTC | 60 | 24.233.11.0/24 | AS55933 |
| Oct 18, 05:16 UTC | 56 | 194.14.100.0/23 | AS44529 |
| Oct 18, 05:16 UTC | 56 | 217.18.0.0/20 | AS15807 |
| Oct 18, 05:16 UTC | 56 | 194.35.236.0/23 | AS49007 |
| Oct 18, 05:16 UTC | 58 | 196.12.146.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 56 | 142.65.185.0/24 | AS243 |
| Oct 18, 05:16 UTC | 58 | 196.12.157.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 56 | 142.65.176.0/22 | AS243 |
| Oct 18, 05:16 UTC | 58 | 197.243.56.0/22 | AS37228 |
| Oct 18, 05:16 UTC | 56 | 109.232.91.0/24 | AS50201 |
| Oct 18, 05:16 UTC | 58 | 196.12.149.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 206.82.99.0/24 | AS46455 |
| Oct 18, 05:16 UTC | 58 | 196.12.129.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 56 | 158.147.214.0/24 | AS243 |
| Oct 18, 05:16 UTC | 58 | 196.12.128.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.154.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.132.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.155.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.147.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 58 | 196.12.134.0/24 | AS37006 |
| Oct 18, 05:16 UTC | 62 | 103.246.244.0/24 | AS55933 |
| Oct 18, 05:16 UTC | 58 | 196.12.139.0/24 | AS37006 |
| Oct 18, 04:16 UTC | 56 | 151.113.204.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 151.113.215.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 151.113.207.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 151.113.255.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 151.113.213.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 151.113.248.0/22 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 103.76.51.0/24 | AS139664 |
| Oct 18, 04:16 UTC | 56 | 151.113.206.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 188.215.93.0/24 | AS47388 |
| Oct 18, 04:16 UTC | 56 | 94.176.43.0/24 | AS47388 |
| Oct 18, 04:16 UTC | 56 | 91.206.36.0/23 | AS47388 |
| Oct 18, 04:16 UTC | 56 | 191.217.204.0/24 | AS198550 |
| Oct 18, 04:16 UTC | 56 | 151.113.205.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 94.176.42.0/24 | AS47388 |
| Oct 18, 04:16 UTC | 56 | 165.65.206.0/23 | AS60255 |
| Oct 18, 04:16 UTC | 56 | 151.113.214.0/24 | AS46528 |
| Oct 18, 04:16 UTC | 56 | 213.207.52.0/22 | AS39611 |
| Oct 18, 03:16 UTC | 56 | 37.202.205.0/24 | AS213791 |
| Oct 18, 03:16 UTC | 56 | 38.211.244.0/24 | AS213791 |
| Oct 18, 03:16 UTC | 56 | 144.79.158.0/24 | AS137127 |
| Oct 18, 02:17 UTC | 56 | 93.183.127.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.103.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.127.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.107.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.113.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.232.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.157.213.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.100.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.67.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.132.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.26.226.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.253.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.104.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 93.183.89.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 178.130.41.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.118.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.114.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.243.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.101.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.200.31.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.127.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.118.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 58 | 91.209.251.0/24 | AS197209 |
| Oct 18, 02:17 UTC | 56 | 212.34.152.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.200.19.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 109.107.167.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.246.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.26.227.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 141.163.127.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.85.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.111.88.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.136.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 5.35.45.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 141.163.125.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.71.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.200.28.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.77.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 80.85.244.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.109.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.227.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.252.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.123.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.238.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.105.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.245.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 178.217.102.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 93.183.90.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.121.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.83.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 141.163.113.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.155.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 93.183.88.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.108.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.120.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.237.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.99.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.115.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.121.234.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.128.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.245.104.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.226.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 194.242.127.0/24 | AS48729 |
| Oct 18, 02:17 UTC | 56 | 91.84.119.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.26.224.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.148.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.96.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.110.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.247.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.116.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 109.107.165.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.121.235.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 93.183.91.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.135.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.74.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.241.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.236.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.245.105.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 109.107.186.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.124.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 80.85.247.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.98.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.151.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.239.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.113.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.131.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.244.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.157.214.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.80.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 93.183.125.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.233.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 178.130.42.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.106.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.114.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.21.15.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.104.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 194.60.135.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.21.13.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.115.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 194.246.83.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.200.26.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.138.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.242.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.245.107.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.224.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.100.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 141.163.119.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 93.183.126.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.108.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.200.16.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.86.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 185.157.212.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.112.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 194.164.32.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.109.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.145.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 5.35.68.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 195.200.18.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.72.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 141.163.114.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 91.84.105.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.119.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 212.34.141.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.117.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.240.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 89.110.111.0/24 | AS216071 |
| Oct 18, 02:17 UTC | 56 | 77.238.225.0/24 | AS216071 |
Frequently Asked Questions
What is a BGP AS-path anomaly?
An AS-path anomaly is an unusual or implausible sequence of Autonomous Systems in a route advertisement whose unique-AS-path length (prepends collapsed) deviates sharply from the recent 36-hour median for that prefix — an unexpected transit AS, a loop, or a sudden detour. It can reveal a route leak or a path-prepending mistake.
Where does this data come from?
Every event is detected from live BGP updates collected across 23 RIPE RIS route collectors worldwide, ingested into a ClickHouse time-series store and re-evaluated every few minutes. No third-party feed is resold; the analysis is original to WorldIP.io.
How often is the AS-path anomaly feed updated?
The feed recomputes roughly every 5 minutes; it was last refreshed at 2026-10-18 06:25 UTC.
How do I subscribe to AS-path anomaly events?
Subscribe to the Atom feed at /pulse/bgp/aspath.atom or poll the JSON endpoint at /api/pulse/bgp/aspath.