Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

⚠ 24h

MOAS conflict (multiple-origin AS)

8,900

events / 24h · hourly histogram below

✦ 24h

New prefix (first announcement)

1,860

events / 24h · hourly histogram below

↓ 24h

Sudden withdrawal event

4,401

events / 24h · hourly histogram below

⛔ 24h

Bogon announcement

237

events / 24h · hourly histogram below

↻ 24h

AS-path anomaly

5,355

events / 24h · hourly histogram below

✗ 24h

RPKI-invalid route

8,763

events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline ● last 6 hours, all types

Classic feed →

Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When	Type	Severity	Prefix	AS
Aug 4, 17:55 UTC	withdrawal	70	*	AS28260
Aug 4, 17:55 UTC	withdrawal	70	*	AS43142
Aug 4, 17:55 UTC	withdrawal	70	*	AS30021
Aug 4, 17:55 UTC	withdrawal	80	*	AS2514
Aug 4, 17:55 UTC	withdrawal	70	*	AS17983
Aug 4, 17:55 UTC	withdrawal	80	*	AS266166
Aug 4, 17:55 UTC	withdrawal	80	*	AS32524
Aug 4, 17:55 UTC	withdrawal	80	*	AS147060
Aug 4, 17:55 UTC	withdrawal	70	*	AS201603
Aug 4, 17:55 UTC	withdrawal	70	*	AS140952
Aug 4, 17:55 UTC	moas	60	47.73.0.0/16	AS1273
Aug 4, 17:55 UTC	moas	60	122.9.96.0/19	AS58466
Aug 4, 17:55 UTC	moas	60	203.101.185.0/24	AS9541
Aug 4, 17:55 UTC	moas	70	192.82.134.0/24	AS397197
Aug 4, 17:55 UTC	moas	60	38.87.57.0/24	AS174
Aug 4, 17:55 UTC	moas	60	124.250.102.0/23	AS9308
Aug 4, 17:55 UTC	moas	70	114.118.80.0/21	AS23724
Aug 4, 17:55 UTC	moas	60	102.220.23.0/24	AS328847
Aug 4, 17:55 UTC	moas	60	207.244.144.0/20	AS23033
Aug 4, 17:55 UTC	moas	60	120.92.236.0/23	AS4811
Aug 4, 17:18 UTC	aspath	60	190.89.94.0/23	AS270364
Aug 4, 17:18 UTC	aspath	60	162.95.200.0/23	AS22703
Aug 4, 17:18 UTC	aspath	60	81.18.46.0/24	AS29046
Aug 4, 17:18 UTC	aspath	58	200.58.248.0/22	AS270473
Aug 4, 17:18 UTC	aspath	60	173.27.4.0/24	AS30036
Aug 4, 17:18 UTC	aspath	58	81.18.43.0/24	AS29046
Aug 4, 17:18 UTC	aspath	60	190.89.94.0/24	AS270364
Aug 4, 17:18 UTC	aspath	56	138.204.34.0/23	AS52573
Aug 4, 17:18 UTC	aspath	58	44.48.41.0/24	AS203729
Aug 4, 17:18 UTC	aspath	60	40.141.58.0/24	AS21609
Aug 4, 17:15 UTC	bogon	85	100.65.205.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.71.228.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.70.89.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.73.18.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.73.4.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.98.16.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.66.52.0/23	AS9583
Aug 4, 17:15 UTC	bogon	85	100.72.175.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.66.61.0/24	AS9583
Aug 4, 17:15 UTC	bogon	85	100.70.72.0/23	AS9583
Aug 4, 17:15 UTC	rpki	80	185.78.34.0/23	AS200065
Aug 4, 17:15 UTC	rpki	80	62.41.32.0/24	AS3257
Aug 4, 17:15 UTC	rpki	80	154.80.128.0/24	AS134548
Aug 4, 17:15 UTC	rpki	80	156.246.23.0/24	AS136255
Aug 4, 17:15 UTC	rpki	80	23.27.134.0/24	AS12083
Aug 4, 17:15 UTC	rpki	80	216.82.157.0/24	AS18859
Aug 4, 17:15 UTC	rpki	80	38.19.224.0/23	AS174
Aug 4, 17:15 UTC	rpki	80	185.234.10.0/24	AS23456
Aug 4, 17:15 UTC	rpki	80	103.177.28.0/23	AS146758
Aug 4, 17:15 UTC	rpki	80	154.80.224.0/24	AS134548

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.