Loading…

Routing hygiene board

A security-team view of how cleanly the global routing table is announced. Every prefix in the BGP table is cross-checked against two independent registries: RPKI (cryptographically signed origin authorisations) and the IRR (operator-maintained route objects). Disagreements between what is announced and what is authorised are where hijacks and leaks hide.

RPKI invalid — a ROA exists but the announcing AS or prefix length is wrong. Dropped by networks doing origin validation; often a hijack or fat-finger.
IRR mismatch — the IRR route object names a different origin AS than the live BGP announcement. A softer signal, but stale or wrong route objects break filtering.
Unregistered — no ROA and no IRR object cover the prefix, so neither system can verify it. Invisible to automated route filters.

The hygiene score(0–100) blends these signals across a network's announcements: 100 means fully signed and registry-consistent; low scores carry invalids or unverifiable space.

IPv4 invalid prefixes

1,317

2.2M addresses in the top offenders

Biggest invalid origin

AS12334

R Cable y Telecable Telecomunicaciones, S.A.U. · 20 invalid prefixes

Most-exposed country

TN 0%

lowest RPKI valid share among ≥ 10M-addr holders

Lowest-hygiene network

AS27995

AS27995 - CLARO CHILE S.A. · score 7 / 100

Largest invalid networks

Origin ASes announcing the most RPKI-invalid address space — each prefix disagrees with a published ROA, so ROV-enforcing peers will drop it. These are the biggest potential hijacks or misconfigurations.

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS12334 R Cable y Telecable Telecomunicaciones, S.A.U.	20	327.7K	443.4K	25.9%
2	AS31898 ORACLE-BMC-31898 - Oracle Corporation	187	253.2K	5.8M	79.5%
3	AS7470 TRUEINTERNET-AS-AP - TRUE INTERNET Co.,Ltd.	14	198.7K	3.7M	50.2%

Most-exposed countries

Large IPv4 holders (≥ 10M routed addresses) with the lowest RPKI valid share — the most space that could be hijacked without a signature to catch it.

Country	Coverage	Routed IPv4	Invalid
TN Tunisia	0.0%	18.6M	0
KR South Korea	0.4%	160.6M	1
MA Morocco	8.0%	30.5M	1

Recently improved / worsened

Change in RPKI coverage between the two most recent daily snapshots, for large holders. Positive means more space got signed; negative means coverage slipped.

Improving

Country	Was	Now	Change	Routed space
ZA South Africaipv4	33.9%	34.6%	+0.7 pts	38.7M
CA Canadaipv6	49.2%	49.5%	+0.4 pts	65.6M
CH Switzerlandipv6	81.5%	81.8%	+0.3 pts	133.6M
BR Brazilipv6	33.5%	33.8%

BGP vs RPKI vs IRR mismatch

For each origin country: how many of its announced prefixes are RPKI-invalid, IRR-mismatched, or wholly unregistered, alongside the blended hygiene score. Bars show each category's share of that country's prefixes.

Country	Prefixes	RPKI invalid	IRR mismatch	Unregistered	Score
US United States	352,818	1,736	7,258	165,533	62
CN China	107,994	34

Lowest-hygiene networks

The 25 origin ASes (≥ 10 prefixes) with the weakest blended RPKI + IRR hygiene score. A low score means a network announces invalid or unverifiable space — the routing-security laggards.

#	Network	Prefixes	Score
1	AS27995 AS27995 - CLARO CHILE S.A.	11	7
2	AS34369 AS-SHATELMOBILE Aria Shatel PJSC	44	14
3	AS209968 Creative Kew Solutions Unipessoal Lda	20	20
4	AS150706 HKZTCL-AS-AP - Hong Kong Zhengxing Technology Co., Ltd.

Coverage and per-country signing trends live on the RPKI overview →

IPv6 — largest invalid networks

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS6079 RCN-AS - RCN	3	1.6M/48	30M/48	94.1%
2	AS63023 AS-GLOBALTELEHOST - GTHost	2	1M/48	2.7M/48	60.8%
3	AS209968 Creative Kew Solutions Unipessoal Lda	14	917.5K/48	1.3M/48	5.0%
4	AS5511 Opentransit Orange S.A.	1	524.3K/48	786.6K/48	33.3%
5	AS41369 DATACENTER-AS Advania Finland Oy	1	524.3K/48	1.1M/48	52.9%
6	AS25159 SONICDUO-AS PJSC MegaFon	1	524.3K/48	2M/48	73.4%
7	AS3257 GTT-BACKBONE GTT Communications Inc.	3	196.6K/48	6.2M/48	52.1%
8	AS57433 INTERCOLO-AS intercolo GmbH	2	131.1K/48	262.2K/48	50.0%
9	AS18678 AS18678 - INTERNEXA S.A. E.S.P	2	65.5K/48	205.2K/48	63.9%
10	AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.	2	65.5K/48	17.9M/48	98.9%

Country	Was	Now	Change	Routed space
IT Italyipv6	36.9%	36.8%	−0.1 pts	456.8M
HK Hong Kong SAR Chinaipv4	61.7%	61.6%	−0.1 pts	33.7M
ID Indonesiaipv6	80.6%	80.5%	−0.1 pts	19.6M