Skip to main content
WorldIP.io

Pulse of the Internet

Real-time view of global BGP routing activity. Each feed below tracks a different class of anomaly detected from RIPE RIS multi-collector data ingested into our ClickHouse cluster. RIR ownership changes →

24h
MOAS conflict (multiple-origin AS)
9,107
events / 24h · hourly histogram below
24h
New prefix (first announcement)
3,220
events / 24h · hourly histogram below
24h
Sudden withdrawal event
5,546
events / 24h · hourly histogram below
24h
Bogon announcement
24
events / 24h · hourly histogram below
24h
AS-path anomaly
2,329
events / 24h · hourly histogram below
24h
RPKI-invalid route
9,961
events / 24h · hourly histogram below

Live anomaly map last 6 hours, all types

click a bubble to drill into a country

Global anomaly timeline last 6 hours, all types

Classic feed →
Global anomaly timeline — most recent BGP routing anomalies across all types in the last 6 hours
When Type Severity Prefix AS
Aug 17, 15:18 UTC withdrawal 70 * AS48326
Aug 17, 15:18 UTC withdrawal 80 * AS27947
Aug 17, 15:18 UTC withdrawal 80 * AS393568
Aug 17, 15:18 UTC withdrawal 70 * AS35575
Aug 17, 15:18 UTC withdrawal 80 * AS263163
Aug 17, 15:18 UTC withdrawal 80 * AS22085
Aug 17, 15:18 UTC withdrawal 70 * AS61797
Aug 17, 15:18 UTC withdrawal 80 * AS7821
Aug 17, 15:18 UTC withdrawal 70 * AS41887
Aug 17, 15:18 UTC withdrawal 80 * AS22122
Aug 17, 15:18 UTC moas 60 102.220.23.0/24 AS328847
Aug 17, 15:18 UTC moas 70 114.118.80.0/21 AS23724
Aug 17, 15:18 UTC moas 60 124.250.102.0/23 AS9308
Aug 17, 15:18 UTC moas 60 201.159.255.0/24 AS262568
Aug 17, 15:18 UTC moas 60 38.87.57.0/24 AS174
Aug 17, 15:18 UTC moas 70 192.82.134.0/24 AS397197
Aug 17, 15:18 UTC moas 60 212.154.236.0/22 AS50482
Aug 17, 15:18 UTC moas 60 210.90.46.0/24 AS17574
Aug 17, 15:18 UTC moas 60 141.195.79.0/24 AS205019
Aug 17, 15:18 UTC moas 60 110.43.152.0/21 AS4811
Aug 17, 14:52 UTC aspath 56 154.63.12.0/22 AS209087
Aug 17, 14:52 UTC aspath 56 94.76.17.0/24 AS51375
Aug 17, 14:52 UTC aspath 56 94.76.29.0/24 AS51375
Aug 17, 14:52 UTC aspath 56 200.106.216.0/23 AS271250
Aug 17, 14:52 UTC aspath 56 38.58.109.0/24 AS132139
Aug 17, 14:52 UTC aspath 56 46.184.219.0/24 AS51375
Aug 17, 14:52 UTC aspath 56 208.115.239.0/24 AS46475
Aug 17, 14:52 UTC aspath 56 94.76.14.0/24 AS51375
Aug 17, 14:52 UTC aspath 56 46.184.199.0/24 AS51375
Aug 17, 14:52 UTC aspath 56 46.184.218.0/24 AS51375
Aug 17, 14:51 UTC bogon 85 172.16.112.180/30 AS28624
Aug 17, 14:51 UTC bogon 85 172.16.113.148/30 AS28624
Aug 17, 14:51 UTC bogon 85 192.168.82.0/24 AS65500
Aug 17, 14:51 UTC bogon 85 172.16.108.68/30 AS28624
Aug 17, 14:51 UTC bogon 85 172.16.109.136/30 AS28624
Aug 17, 14:51 UTC bogon 85 172.16.106.32/32 AS28624
Aug 17, 14:51 UTC bogon 85 192.168.80.0/24 AS65500
Aug 17, 14:51 UTC bogon 85 172.16.106.18/32 AS28624
Aug 17, 14:51 UTC bogon 85 172.16.115.160/30 AS28624
Aug 17, 14:51 UTC bogon 85 172.16.113.176/30 AS28624
Aug 17, 14:51 UTC rpki 72 200.17.62.0/28 AS1916
Aug 17, 14:51 UTC rpki 86 185.145.196.69/32 AS24961
Aug 17, 14:51 UTC rpki 78 212.109.21.0/24 AS42387
Aug 17, 14:51 UTC rpki 80 199.255.190.0/24 AS33445
Aug 17, 14:51 UTC rpki 80 219.72.152.0/21 AS4847
Aug 17, 14:51 UTC rpki 74 163.129.35.0/24 AS13445
Aug 17, 14:51 UTC rpki 78 95.80.172.0/22 AS48431
Aug 17, 14:51 UTC rpki 72 204.154.124.0/23 AS18859
Aug 17, 14:51 UTC rpki 80 150.251.32.0/24 AS200950
Aug 17, 14:51 UTC rpki 90 37.131.174.20/32 AS35745

How this works

Every 5 minutes we pull MRT update dumps from all 23 RIPE RIS collectors and ingest them into ClickHouse. Detectors run on that stream — MOAS every 15 min, sudden withdrawals every 30 min, first-seen prefixes every hour, plus RPKI-invalid origins, bogon announcements and AS-path anomalies. Each anomaly type has its own page above with severity scoring, detail, and an Atom feed for incident-response automation.

Share