What's New?

Detections: real-time BGP routing security and anomaly analysis

• BGPHorizon now continuously analyzes the global BGP feed and flags routing anomalies and security events as they happen, validating every announcement against RPKI ROAs, IRR route objects, RIR allocations, and a rolling 30-day routing baseline.
• Detection types include RPKI invalid origin & invalid length, MOAS (multi-origin) conflicts, new or unexpected origins, IRR origin mismatches, reserved & unallocated ASNs in the AS path, AS-path loops, first-AS violations, unregistered routes, and brand-new prefixes.
• Browse everything in the new detections firehose. Search with the detection.* query language (e.g. detection.type: moas_conflict AND detection.severity: high), and see per-resource detections on every prefix and ASN overview page. Each incident drills down to the triggering events and the evidence behind it.
• See the Search Query Guide for the full detection.* field reference.

Monitoring: watch your prefixes and ASNs and get alerted

• Create a monitor on any prefix or ASN and subscribe to the detection types you care about. Monitors alert only on anomalous detections. Steady, expected conditions do not notify.
• Alerts always land in your in-app feed (the new notification bell in the nav), and you can attach delivery channels per monitor (email, HMAC-signed webhook, Slack, Discord) for pushed alerts.
• Prefix monitors can include more-specifics and tune out noisy ASNs; email alerts are rolled into a digest so a flapping prefix can’t flood your inbox.
• Get started from the Monitors page, or hit the “Monitor” button on any prefix or ASN overview.

Registration & visibility change monitors

• ROA Change & IRR Change: an alert when a prefix’s RPKI ROA or IRR route-object registration changes (a ROA added or removed, an origin reassigned, a max-length changed). The drill-down shows what changed (origins, IRR maintainer, source, ROA max-length) and flags an origin reassignment that switched maintainers (worth verifying) versus one under the same maintainer (routine operator change).
• Visibility Drop: an alert when a normally well-visible prefix goes dark across the global collector fleet (its distinct-peer count collapses). We ingest BGP updates rather than full routing tables, so this flags that the prefix stopped appearing, not why.
• Prefix Withdrawn: the higher-confidence counterpart. a went-dark prefix confirmed likely no longer routable, because per-peer analysis shows the last event from nearly every collector peer was a withdrawal, with almost none still announcing it.
• Filter the detections firehose by change shape: new registration, additional origin, reassignment, origin removed, and more.

Country code flags for ASNs

• ASN overview pages and search results now display country flag icons based on RIR delegation data, so the registered country for any AS is shown directly.

Smarter free-text search ordering

• Free-text search results are now ranked by match relevance. Matches on name fields (AS name, maintainer name, set name, NIC handle) appear first, followed by description matches, then other fields, with remarks last.
• Previously, results for a free-text query appeared in no particular order. Now, searching for something like “Cloudflare” will surface the AS-name match at the top instead of buried among description or remarks hits.

New API endpoint: BGP events export

• A new GET /api/v1/events/export endpoint lets you programmatically export up to 2 million BGP events (announcements and withdrawals) for any prefix or ASN.
• Responses are streamed as gzip-compressed NDJSON (newline-delimited JSON), so exports stay fast and memory-efficient even at high volumes.
• Requires API key authentication. See the API documentation for full details and examples.

Overview page full-export button

• Prefix and ASN overview pages now have an export button that downloads a consolidated snapshot of the resource, including PeeringDB data, IRR/RADB records, and high-level statistics (prefix counts, announcement and withdrawal totals, origin ASNs, and more).

BGPSentinel is now BGPHorizon!

• BGPSentinel is now BGPHorizon. Same platform, new name.

New logo

• Fresh branding with a new BGPHorizon logo across the entire platform, including a proper favicon.

Support/Feedback email address

• Have questions or feedback? Reach us at [email protected].

RDAP lookup data

• ASN and prefix overview pages now display RDAP (Registration Data Access Protocol) information including registration details, abuse contacts, and network metadata.

PeeringDB data & searchability

• PeeringDB facility, exchange, and network data is now integrated into overview pages and is searchable from the main search bar.

Additional IRR data sources

• Expanded IRR coverage to include RIPE, ARIN, APNIC, AFRINIC, Level3, NTTCOM, JPIRR, ALTDB, CANARIE, and Bell Canada alongside RADB.

IRR data moved to standalone tab

• IRR/RADB data now has its own dedicated tab on prefix and ASN overview pages for clearer navigation.

Open registration & guest access

• Anyone can now register for a BGP Horizon account with email verification.
• Guest access allows up to 10 queries per day with no account.

Email support & MFA

• Email verification for new accounts, password reset via email, and email-based multi-factor authentication are now supported.
• MFA can be enabled from the user panel under Profile → Security.

Faster event search.

• A new query planner picks the most selective field in your query as the search “driver,” then narrows the event scan to just the prefixes that match, instead of walking the full events table.
• Backed by precomputed lookup tables (community ↔ prefix, AS-path ↔ prefix, peer-ASN ↔ prefix, origin-ASN ↔ prefix), the following event-search fields are now dramatically faster:
  • peer_asn, e.g. peer_asn: 13335
  • origin_asn, e.g. origin_asn: 13335
  • as_in_path, e.g. as_in_path: 3356
  • community, community_asn, community_action, e.g. community: "2914:420", community_asn: 2914, community_action: 666
  • collector_id, e.g. collector_id: rrc00
  • prefix, e.g. prefix: 8.8.8.0/24
• Combining these fields with AND automatically picks the smaller candidate set as the driver; OR unions the candidates, with a short-circuit fallback when one branch alone would be huge.
• Pair this with the new Search Query Guide for the full syntax reference.

New changelog!

• This page. We’ll post here whenever there’s a notable release.