Its usually not BGP, its some operator misconfiguring BGP, and there's loads of ways of doing that and its hard to know what that would look like from a remote view like your own network. Most efficient way is to just compare current bad state to previous good state and look at the diff, ie what changed for some prefix in your table compared to previous version of your table.