Loading…

Routing hygiene board

A security-team view of how cleanly the global routing table is announced. Every prefix in the BGP table is cross-checked against two independent registries: RPKI (cryptographically signed origin authorisations) and the IRR (operator-maintained route objects). Disagreements between what is announced and what is authorised are where hijacks and leaks hide.

RPKI invalid — a ROA exists but the announcing AS or prefix length is wrong. Dropped by networks doing origin validation; often a hijack or fat-finger.
IRR mismatch — the IRR route object names a different origin AS than the live BGP announcement. A softer signal, but stale or wrong route objects break filtering.
Unregistered — no ROA and no IRR object cover the prefix, so neither system can verify it. Invisible to automated route filters.

The hygiene score(0–100) blends these signals across a network's announcements: 100 means fully signed and registry-consistent; low scores carry invalids or unverifiable space.

IPv4 invalid prefixes

1,266

2.1M addresses in the top offenders

Biggest invalid origin

AS12334

R Cable y Telecable Telecomunicaciones, S.A.U. · 20 invalid prefixes

Most-exposed country

TN 0%

lowest RPKI valid share among ≥ 10M-addr holders

Lowest-hygiene network

AS27995

AS27995 - CLARO CHILE S.A. · score 7 / 100

Largest invalid networks

Origin ASes announcing the most RPKI-invalid address space — each prefix disagrees with a published ROA, so ROV-enforcing peers will drop it. These are the biggest potential hijacks or misconfigurations.

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS12334 R Cable y Telecable Telecomunicaciones, S.A.U.	20	327.7K	443.4K	25.9%
2	AS31898 ORACLE-BMC-31898 - Oracle Corporation	146	200.7K	5.5M	82.1%
3	AS7470 TRUEINTERNET-AS-AP - TRUE INTERNET Co.,Ltd.	16	199.2K	3.7M	50.2%

Most-exposed countries

Large IPv4 holders (≥ 10M routed addresses) with the lowest RPKI valid share — the most space that could be hijacked without a signature to catch it.

Country	Coverage	Routed IPv4	Invalid
TN Tunisia	0.0%	18.5M	0
KR South Korea	0.4%	160.6M	1
MA Morocco	0.9%	30.5M	0

Recently improved / worsened

Change in RPKI coverage between the two most recent daily snapshots, for large holders. Positive means more space got signed; negative means coverage slipped.

Improving

Country	Was	Now	Change	Routed space
CO Colombiaipv6	75.4%	75.7%	+0.3 pts	13.6M
GB United Kingdomipv4	79.7%	80.0%	+0.2 pts	95.4M
RU Russiaipv6	56.1%	56.3%	+0.1 pts	169.7M
DE Germanyipv4	89.0%	89.1%

BGP vs RPKI vs IRR mismatch

For each origin country: how many of its announced prefixes are RPKI-invalid, IRR-mismatched, or wholly unregistered, alongside the blended hygiene score. Bars show each category's share of that country's prefixes.

Country	Prefixes	RPKI invalid	IRR mismatch	Unregistered	Score
US United States	348,400	1,737	6,581	178,899	60
CN China	106,418	28

Lowest-hygiene networks

The 25 origin ASes (≥ 10 prefixes) with the weakest blended RPKI + IRR hygiene score. A low score means a network announces invalid or unverifiable space — the routing-security laggards.

#	Network	Prefixes	Score
1	AS27995 AS27995 - CLARO CHILE S.A.	11	7
2	AS34369 AS-SHATELMOBILE Aria Shatel PJSC	40	7
3	AS209968 Creative Kew Solutions Unipessoal Lda	20	18
4	AS11079 ZAYO-CAN-11079 - Zayo Bandwidth	28

Coverage and per-country signing trends live on the RPKI overview →

IPv6 — largest invalid networks

#	Network	Invalid prefixes	Invalid space	Routed space	Coverage
1	AS402604 AS402604	4	2.1M/48	4.7M/48	55.6%
2	AS402402 CELL - Infoecell	3	1.6M/48	2.6M/48	40.0%
3	AS402394 VUEDGE - Vuedge	2	1M/48	2.6M/48	60.0%
4	AS209968 Creative Kew Solutions Unipessoal Lda	14	917.5K/48	1.3M/48	5.0%
5	AS25198 ZetServers INTERKVM HOST SRL	4	720.9K/48	1.6M/48	55.1%
6	AS25159 SONICDUO-AS PJSC MegaFon	1	524.3K/48	2M/48	73.4%
7	AS41369 DATACENTER-AS Advania Finland Oy	1	524.3K/48	1.1M/48	52.9%
8	AS3257 GTT-BACKBONE GTT Communications Inc.	3	196.6K/48	6.2M/48	52.1%
9	AS57433 INTERCOLO-AS intercolo GmbH	2	131.1K/48	262.2K/48	50.0%
10	AS16625 AKAMAI-AS - Akamai Technologies, Inc.	2	98.3K/48	98.3K/48	0.0%

Slipping

Country	Was	Now	Change	Routed space
TH Thailandipv6	73.8%	51.9%	−21.9 pts	7.3M
MY Malaysiaipv6	80.3%	66.3%	−14.0 pts	7.5M
TR Türkiyeipv6	93.9%	93.5%	−0.4 pts	118.8M
CL Chileipv6	79.8%	79.5%	−0.2 pts	5.6M
MX Mexicoipv6	49.4%	49.2%	−0.2 pts	13.3M
SA Saudi Arabiaipv6	78.4%	78.2%	−0.1 pts	12.1M