Skip to main content

Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

24h
MOAS conflict (multiple-origin AS)
12,156
events / 24h · hourly histogram below
24h
New prefix (first announcement)
2,182
events / 24h · hourly histogram below
24h
Sudden withdrawal event
4,236
events / 24h · hourly histogram below
24h
Bogon announcement
39
events / 24h · hourly histogram below
24h
AS-path anomaly
890
events / 24h · hourly histogram below
24h
RPKI-invalid route
8,757
events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline last 6 hours, all types

Classic feed →
Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When Type Severity Prefix AS
Aug 29, 11:08 UTC withdrawal 70 * AS49117
Aug 29, 11:08 UTC withdrawal 70 * AS28686
Aug 29, 11:08 UTC withdrawal 80 * AS62915
Aug 29, 11:08 UTC withdrawal 80 * AS42831
Aug 29, 11:08 UTC withdrawal 80 * AS48123
Aug 29, 11:08 UTC withdrawal 70 * AS134026
Aug 29, 11:08 UTC withdrawal 70 * AS8784
Aug 29, 11:08 UTC withdrawal 70 * AS55254
Aug 29, 11:08 UTC withdrawal 80 * AS205233
Aug 29, 11:08 UTC withdrawal 80 * AS393686
Aug 29, 11:08 UTC moas 60 192.12.94.0/24 AS396549
Aug 29, 11:08 UTC moas 60 197.93.148.0/24 AS20011
Aug 29, 11:08 UTC moas 70 192.82.134.0/24 AS397197
Aug 29, 11:08 UTC moas 60 38.87.57.0/24 AS174
Aug 29, 11:08 UTC moas 60 124.250.102.0/23 AS9308
Aug 29, 11:08 UTC moas 70 114.118.80.0/21 AS23724
Aug 29, 11:08 UTC moas 60 102.220.23.0/24 AS328847
Aug 29, 11:08 UTC moas 60 207.244.144.0/20 AS23033
Aug 29, 11:08 UTC moas 60 120.92.236.0/23 AS4811
Aug 29, 11:08 UTC moas 60 170.33.22.0/24 AS45102
Aug 29, 10:57 UTC aspath 56 195.19.199.0/24 AS197695
Aug 29, 10:57 UTC aspath 56 154.59.201.0/24 AS273158
Aug 29, 10:57 UTC aspath 58 103.122.180.0/24 AS138218
Aug 29, 10:57 UTC aspath 56 5.172.190.0/23 AS207012
Aug 29, 10:57 UTC aspath 56 195.19.12.0/24 AS197695
Aug 29, 10:57 UTC aspath 56 195.19.144.0/24 AS197695
Aug 29, 10:57 UTC aspath 56 128.201.29.0/24 AS266611
Aug 29, 10:57 UTC aspath 58 136.210.0.0/16 AS1555
Aug 29, 10:57 UTC aspath 56 195.19.209.0/24 AS197695
Aug 29, 10:56 UTC bogon 85 172.16.108.96/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.109.144/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.112.180/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.115.112/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.113.148/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.114.188/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.105.168/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.105.152/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.113.120/30 AS28624
Aug 29, 10:56 UTC bogon 85 172.16.106.19/32 AS28624
Aug 29, 10:56 UTC rpki 80 103.110.109.0/24 AS7642
Aug 29, 10:56 UTC rpki 90 35.137.235.0/24 AS33363
Aug 29, 10:56 UTC rpki 80 185.78.20.38/32 AS48434
Aug 29, 10:56 UTC rpki 86 83.168.107.26/32 AS202520
Aug 29, 10:56 UTC rpki 86 83.168.107.113/32 AS202520
Aug 29, 10:56 UTC rpki 86 124.197.24.167/32 AS140766
Aug 29, 10:56 UTC rpki 86 103.253.75.126/32 AS56309
Aug 29, 10:56 UTC rpki 72 115.109.137.0/24 AS17908
Aug 29, 10:56 UTC rpki 86 66.71.205.153/32 AS17294
Aug 29, 10:56 UTC rpki 72 203.143.65.0/24 AS10105
Aug 29, 10:44 UTC first_seen 60 64.81.170.0/24 AS402265

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.

Share