See how a prefix or network is routed now, and follow reported hijacks and leaks.
Example
Visibility
Origin networks
Findings
Reported hijacks and leaks
Reported potential incidents, newest first. An empty list does not prove a network is safe.
Capabilities and processing
Enter an IPv4 or IPv6 prefix, a public address or an AS number. Our server asks the RIPE NCC routing database (RIPEstat, from RIPE RIS route collectors) for the prefix overview and its routing status. The page shows whether it is announced, the origin networks, how many collector peers see the route, when it was first and last seen, more and less specific prefixes, and whether each origin has a route object in an IRR database. A prefix with host bits set is read as its network address.
The incident feed lists potential BGP hijacks and route leaks reported by Cloudflare Radar's anomaly detection, newest first, 25 a page, for the last day, week or month. It can be filtered to the network you looked up.
Example workflow
The sample prefix 198.51.100.0/24 is announced by one network and seen by most collector peers, with a more specific /25 also announced. Break it shows two origins for one prefix, a prefix that is no longer announced, an AS number and an IPv6 prefix.
Limits and interpretation
Route collectors are a sample of the internet and can lag; full visibility does not prove every network can reach a prefix. Reported incidents are detections, not confirmed attacks, and an empty feed does not prove a network is safe. The feed is always live and never sampled. Nothing is stored.
Related tools
ASN lookup · TCP ping · All tools · Privacy