Pulse of the Internet
Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →
⚠
24h
MOAS conflict (multiple-origin AS)
9,481
events / 24h · hourly histogram below
✦
24h
New prefix (first announcement)
2,493
events / 24h · hourly histogram below
↓
24h
Sudden withdrawal event
352
events / 24h · hourly histogram below
⛔
24h
Bogon announcement
149
events / 24h · hourly histogram below
↻
24h
AS-path anomaly
5,189
events / 24h · hourly histogram below
✗
24h
RPKI-invalid route
7,339
events / 24h · hourly histogram below
Global anomaly timeline ● last 6 hours, all types
Classic feed →| When | Type | Severity | Prefix | AS |
|---|---|---|---|---|
| Oct 14, 14:59 UTC | withdrawal | 80 | * | AS17806 |
| Oct 14, 14:59 UTC | withdrawal | 70 | * | AS132608 |
| Oct 14, 14:59 UTC | withdrawal | 80 | * | AS27759 |
| Oct 14, 14:59 UTC | withdrawal | 80 | * | AS9294 |
| Oct 14, 14:59 UTC | withdrawal | 70 | * | AS28227 |
| Oct 14, 14:59 UTC | withdrawal | 80 | * | AS215721 |
| Oct 14, 14:59 UTC | withdrawal | 70 | * | AS12654 |
| Oct 14, 14:59 UTC | withdrawal | 70 | * | AS28624 |
| Oct 14, 14:59 UTC | withdrawal | 80 | * | AS15182 |
| Oct 14, 14:59 UTC | moas | 60 | 197.93.196.0/24 | AS20011 |
| Oct 14, 14:59 UTC | moas | 60 | 45.142.2.0/24 | AS200313 |
| Oct 14, 14:59 UTC | moas | 60 | 38.87.57.0/24 | AS174 |
| Oct 14, 14:59 UTC | moas | 60 | 124.250.102.0/23 | AS9308 |
| Oct 14, 14:59 UTC | moas | 60 | 120.92.236.0/23 | AS4811 |
| Oct 14, 14:59 UTC | moas | 60 | 38.188.65.0/24 | AS138754 |
| Oct 14, 14:59 UTC | moas | 80 | 31.76.71.209/32 | AS35598 |
| Oct 14, 14:59 UTC | moas | 60 | 170.33.22.0/24 | AS45102 |
| Oct 14, 14:59 UTC | moas | 60 | 202.47.108.0/24 | AS4812 |
| Oct 14, 14:59 UTC | moas | 60 | 185.231.56.0/24 | AS35598 |
| Oct 14, 14:29 UTC | withdrawal | 80 | * | AS7821 |
| Oct 14, 14:16 UTC | aspath | 56 | 202.191.153.0/24 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 210.210.114.0/24 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 210.18.27.0/24 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 210.214.141.0/24 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 86.111.44.0/22 | AS48362 |
| Oct 14, 14:16 UTC | aspath | 56 | 210.18.84.0/24 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 124.7.116.0/22 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 221.134.117.0/24 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 119.226.130.0/24 | AS9583 |
| Oct 14, 14:16 UTC | aspath | 56 | 202.191.190.0/23 | AS9583 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.49.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.253.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.15.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.179.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.11.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.71.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.45.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.55.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.51.0/24 | AS30722 |
| Oct 14, 14:15 UTC | bogon | 85 | 192.168.41.0/24 | AS30722 |
| Oct 14, 14:15 UTC | rpki | 80 | 195.180.150.0/23 | AS136796 |
| Oct 14, 14:15 UTC | rpki | 76 | 31.47.82.224/27 | AS57154 |
| Oct 14, 14:15 UTC | rpki | 80 | 204.14.74.0/24 | AS22773 |
| Oct 14, 14:15 UTC | rpki | 74 | 116.48.136.0/21 | AS4760 |
| Oct 14, 14:15 UTC | rpki | 88 | 92.55.205.139/32 | AS203760 |
| Oct 14, 14:15 UTC | rpki | 90 | 185.203.254.14/32 | AS205856 |
| Oct 14, 14:15 UTC | rpki | 88 | 81.13.239.192/26 | AS15547 |
| Oct 14, 14:15 UTC | rpki | 80 | 64.32.164.0/24 | AS3257 |
| Oct 14, 14:15 UTC | rpki | 86 | 124.197.24.167/32 | AS140766 |
| Oct 14, 14:15 UTC | rpki | 72 | 115.109.137.0/24 | AS17908 |
How this works
Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.
