Loading…

Routing hygiene board

A security-team view of how cleanly the global routing table is announced. Every prefix in the BGP table is cross-checked against two independent registries: RPKI (cryptographically signed origin authorisations) and the IRR (operator-maintained route objects). Disagreements between what is announced and what is authorised are where hijacks and leaks hide.

RPKI invalid — a ROA exists but the announcing AS or prefix length is wrong. Dropped by networks doing origin validation; often a hijack or fat-finger.
IRR mismatch — the IRR route object names a different origin AS than the live BGP announcement. A softer signal, but stale or wrong route objects break filtering.
Unregistered — no ROA and no IRR object cover the prefix, so neither system can verify it. Invisible to automated route filters.

The hygiene score(0–100) blends these signals across a network's announcements: 100 means fully signed and registry-consistent; low scores carry invalids or unverifiable space.

IPv4 invalid prefixes

1,267

2.3M addresses in the top offenders

Biggest invalid origin

AS12334

R Cable y Telecable Telecomunicaciones, S.A.U. · 20 invalid prefixes

Most-exposed country

TN 0%

lowest RPKI valid share among ≥ 10M-addr holders

Lowest-hygiene network

AS27995

AS27995 - CLARO CHILE S.A. · score 7 / 100

Largest invalid networks

Origin ASes announcing the most RPKI-invalid address space — each prefix disagrees with a published ROA, so ROV-enforcing peers will drop it. These are the biggest potential hijacks or misconfigurations.

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS12334 R Cable y Telecable Telecomunicaciones, S.A.U.	20	327.7K	443.4K	25.9%
2	AS7470 TRUEINTERNET-AS-AP - TRUE INTERNET Co.,Ltd.	15	198.9K	3.7M	50.2%
3	AS31898 ORACLE-BMC-31898 - Oracle Corporation	139	197.1K	5.3M	82.7%

Most-exposed countries

Large IPv4 holders (≥ 10M routed addresses) with the lowest RPKI valid share — the most space that could be hijacked without a signature to catch it.

Country	Coverage	Routed IPv4	Invalid
TN Tunisia	0.0%	18.6M	0
MA Morocco	0.1%	30.6M	0
KR South Korea	0.4%	160.8M	2

Recently improved / worsened

Change in RPKI coverage between the two most recent daily snapshots, for large holders. Positive means more space got signed; negative means coverage slipped.

Improving

Building history…

Recent improvements and regressions are computed by diffing daily RPKI snapshots. The pipeline records one point per run, so this table fills in over the coming days. Until then there is only a single point to compare against.

Slipping

Building history…

BGP vs RPKI vs IRR mismatch

For each origin country: how many of its announced prefixes are RPKI-invalid, IRR-mismatched, or wholly unregistered, alongside the blended hygiene score. Bars show each category's share of that country's prefixes.

Country	Prefixes	RPKI invalid	IRR mismatch	Unregistered	Score
US United States	344,588	1,673	6,954	176,570	60
CN China	105,117	38

Lowest-hygiene networks

The 25 origin ASes (≥ 10 prefixes) with the weakest blended RPKI + IRR hygiene score. A low score means a network announces invalid or unverifiable space — the routing-security laggards.

#	Network	Prefixes	Score
1	AS27995 AS27995 - CLARO CHILE S.A.	11	7
2	AS34369 AS-SHATELMOBILE Aria Shatel PJSC	40	10
3	AS209968 Creative Kew Solutions Unipessoal Lda	20	18
4	AS7087 AS7087 - Administracion de Redes Colomsat S.A.

Coverage and per-country signing trends live on the RPKI overview →

IPv6 — largest invalid networks

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS209968 Creative Kew Solutions Unipessoal Lda	14	917.5K/48	1.3M/48	5.0%
2	AS6461 ZAYO-6461 - Zayo Bandwidth	2	524.3K/48	790.5K/48	24.9%
3	AS25159 SONICDUO-AS PJSC MegaFon	1	524.3K/48	2M/48	73.4%
4	AS41369 DATACENTER-AS Advania Finland Oy	1	524.3K/48	1.1M/48	52.9%
5	AS213832 LAYERSENTRY-AS LayerSentry LLC	1	524.3K/48	524.3K/48	0.0%
6	AS3257 GTT-BACKBONE GTT Communications Inc.	3	196.6K/48	6M/48	51.0%
7	AS53356 FREE RANGE CLOUD - Free Range Cloud Hosting Inc.	5	131.1K/48	3M/48	2.4%
8	AS57433 INTERCOLO-AS intercolo GmbH	2	131.1K/48	262.1K/48	50.0%
9	AS8903 AS8903 LYNTIA NETWORKS S.A.	2	131.1K/48	720.9K/48	81.8%
10	AS16625 AKAMAI-AS - Akamai Technologies, Inc.	2	98.3K/48	98.3K/48	0.0%