Loading…

Routing hygiene board

A security-team view of how cleanly the global routing table is announced. Every prefix in the BGP table is cross-checked against two independent registries: RPKI (cryptographically signed origin authorisations) and the IRR (operator-maintained route objects). Disagreements between what is announced and what is authorised are where hijacks and leaks hide.

RPKI invalid — a ROA exists but the announcing AS or prefix length is wrong. Dropped by networks doing origin validation; often a hijack or fat-finger.
IRR mismatch — the IRR route object names a different origin AS than the live BGP announcement. A softer signal, but stale or wrong route objects break filtering.
Unregistered — no ROA and no IRR object cover the prefix, so neither system can verify it. Invisible to automated route filters.

The hygiene score(0–100) blends these signals across a network's announcements: 100 means fully signed and registry-consistent; low scores carry invalids or unverifiable space.

IPv4 invalid prefixes

1,311

2.4M addresses in the top offenders

Biggest invalid origin

AS12334

R Cable y Telecable Telecomunicaciones, S.A.U. · 20 invalid prefixes

Most-exposed country

TN 0%

lowest RPKI valid share among ≥ 10M-addr holders

Lowest-hygiene network

AS147034

BAREBOXCOMBD-AS-AP - barebox.com.bd · score 0 / 100

Largest invalid networks

Origin ASes announcing the most RPKI-invalid address space — each prefix disagrees with a published ROA, so ROV-enforcing peers will drop it. These are the biggest potential hijacks or misconfigurations.

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS12334 R Cable y Telecable Telecomunicaciones, S.A.U.	20	327.7K	443.4K	25.9%
2	AS31898 ORACLE-BMC-31898 - Oracle Corporation	205	299.5K	6M	76.4%
3	AS7470 TRUEINTERNET-AS-AP - TRUE INTERNET Co.,Ltd.	15	198.9K	3.7M	50.2%

Most-exposed countries

Large IPv4 holders (≥ 10M routed addresses) with the lowest RPKI valid share — the most space that could be hijacked without a signature to catch it.

Country	Coverage	Routed IPv4	Invalid
TN Tunisia	0.0%	18.7M	0
KR South Korea	0.6%	160.8M	40
MA Morocco	7.9%	30.9M	0

Recently improved / worsened

Change in RPKI coverage between the two most recent daily snapshots, for large holders. Positive means more space got signed; negative means coverage slipped.

Improving

Country	Was	Now	Change	Routed space
TR Türkiyeipv6	89.5%	90.6%	+1.0 pts	86.1M
MX Mexicoipv6	57.2%	57.9%	+0.6 pts	14.7M
GB United Kingdomipv4	80.3%	80.6%	+0.3 pts	96.3M
HK Hong Kong SAR Chinaipv4	62.1%	62.5%

BGP vs RPKI vs IRR mismatch

For each origin country: how many of its announced prefixes are RPKI-invalid, IRR-mismatched, or wholly unregistered, alongside the blended hygiene score. Bars show each category's share of that country's prefixes.

Country	Prefixes	RPKI invalid	IRR mismatch	Unregistered	Score
US United States	366,444	2,723	7,531	167,182	63
CN China	110,436	97

Lowest-hygiene networks

The 25 origin ASes (≥ 10 prefixes) with the weakest blended RPKI + IRR hygiene score. A low score means a network announces invalid or unverifiable space — the routing-security laggards.

#	Network	Prefixes	Score
1	AS147034 BAREBOXCOMBD-AS-AP - barebox.com.bd	15	0
2	AS19940 ACECAPE-INC - Ace Innovative Networks, Inc.	10	2
3	AS219393 Deep-Blue-Edge-Limited Deep Blue Edge Limited	40	2
4	AS141738 NOORHOSTCOMBD-AS-AP - noorhost.com.bd

Coverage and per-country signing trends live on the RPKI overview →

IPv6 — largest invalid networks

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS209968 Creative Kew Solutions Unipessoal Lda	14	917.5K/48	1.3M/48	5.0%
2	AS24409 CNNIC-CRITICAL-AP - China Internet Network Infomation Center	1	524.3K/48	524.3K/48	0.0%
3	AS25159 SONICDUO-AS PJSC MegaFon	1	524.3K/48	2M/48	73.4%
4	AS5511 Opentransit Orange S.A.	1	524.3K/48	786.6K/48	33.3%
5	AS41369 DATACENTER-AS Advania Finland Oy	1	524.3K/48	1.1M/48	52.9%
6	AS3257 GTT-BACKBONE GTT Communications Inc.	3	196.6K/48	6.2M/48	51.5%
7	AS57433 INTERCOLO-AS intercolo GmbH	2	131.1K/48	262.2K/48	50.0%
8	AS204916 racktech LLC Vpsville	2	69.6K/48	12.5M/48	54.6%
9	AS18678 AS18678 - INTERNEXA S.A. E.S.P	2	65.5K/48	205.2K/48	63.9%
10	AS8903 AS8903 LYNTIA NETWORKS S.A.	1	65.5K/48	1.2M/48	94.7%