ASN lookup API

How it works

Reads one AS number from our snapshot of public tables: the RIRs' delegated statistics (registry, country, date), CAIDA AS Organizations (holder) and AS Relationships (providers, peers, customers, the Tier 1 clique), RIPE RIS (prefixes seen by at least 10 of its peers), IPtoASN (routed space) and APNIC Labs (users per country). data gives each table's date.

An IP address, a prefix or a domain is first resolved to the AS announcing it through Team Cymru's IP-to-ASN service (for a domain, its first IPv4 and IPv6 address); resolvedFrom shows how, with every origin when several networks announce it. A number newer than the snapshot gets its name, registry and date from Team Cymru (source: "cymru").

Special-purpose numbers (AS0, AS23456, documentation and private-use ranges) are a 200 with special. Registration contact records (RDAP) are never fetched or served from our server: query your registry's RDAP for them.

Answers kept: 1 hour (`public, max-age=3600`): the tables change with each data refresh, Team Cymru's routing every 4 hours. Answers with `incomplete` aren't cached.

Query parameters

• qstringrequired
  An AS number (AS13335, 13335, asdot 1.10), an IPv4 or IPv6 address, a prefix (8.8.8.0/24) or a domain.

Response fields

200 with this JSON object, plus tookMs, and incomplete with warnings when a source failed. Fields marked optional appear only when they apply.

• queryobjectalways
  What was looked up, normalised (lower case, no trailing dot, IDNs as Punycode).
  • qstringalways
    What was looked up: AS<number>, the address, the prefix with its network address, or the domain in lower case.
• asninteger or nullalways
  The AS number described, or null when the IP, prefix or domain led to none (see resolvedFrom.finding).
• resolvedFromobject or nullalways
  How an IP, prefix or domain led to the AS (Team Cymru); null for an AS number.
  Show 6 fields

  • kindstringalways
    What q was.

    one of "ip", "prefix", "domain"

  • targetstringalways
    The address, prefix or domain resolved.
  • addressesarray of stringsalways
    The addresses asked about (a domain's first IPv4 and IPv6).
  • originsarray of objectsalways
    Every origin Team Cymru lists, most specific prefix first.
    Show 6 fields

    • asnintegeralways
      The announcing AS.
    • prefixstringalways
      The announced prefix.
    • countrystring or nullalways
      The block's registered country.
    • registrystring or nullalways
      The block's registry.
    • allocatedstring or nullalways
      When the registry handed out the block (YYYY-MM-DD), never the AS's age.
    • ipstringalways
      The address it answers for.
  • moasbooleanalways
    Whether one prefix is announced by several networks (multi-origin AS).
  • findingstring or nullalways
    Why there is no AS: nxdomain (no such domain), no_address (the domain has no A or AAAA record), unrouted (no network announces it); null when one does.

    one of "nxdomain", "no_address", "unrouted", null

• specialobject or nullalways
  The IANA special-purpose range the number is in, or null.
  • kindstringalways
    reserved (AS0, RFC 7607), as_trans (AS23456, RFC 6793), documentation (RFC 5398), private_use (RFC 6996), last (RFC 7300) or iana_reserved.

    one of "reserved", "as_trans", "documentation", "private_use", "last", "iana_reserved"

  • rangeobjectalways
    The range.
    Show 2 fields

    • fromintegeralways
      First number.
    • tointegeralways
      Last number.
  • rfcstringalways
    The RFC that defines it, or IANA.
• statusstring or nullalways
  assigned, available or reserved (the registry's pool), unassigned (announced, but in no registry's statistics), special, unknown (not in our tables); null with no AS.

  one of "assigned", "available", "reserved", "unassigned", "special", "unknown", null

• namestring or nullalways
  The AS name ("CLOUDFLARENET").
• holderstring or nullalways
  The organization holding it (CAIDA AS Organizations: "Cloudflare, Inc.").
• brandobject or nullalways
  The brand people know, where our tables have one.
  • namestringalways
    The brand.
• kindstring or nullalways
  What kind of network: cdn, content, cloud, hosting, relay, transit, isp, satellite, edu, gov or other.

  one of "cdn", "content", "cloud", "hosting", "relay", "transit", "isp", "satellite", "edu", "gov", "other", null

• servicestring or nullalways
  An ISP's service: fixed, mobile or both.

  one of "fixed", "mobile", "both", null

• countrystring or nullalways
  The country it is registered in.
• registrystring or nullalways
  The regional registry: arin, ripencc, apnic, lacnic or afrinic.
• allocatedstring or nullalways
  When the registry assigned the number (YYYY-MM-DD).
• tier1boolean or nullalways
  Whether it is in CAIDA's Tier 1 clique.
• prefixesobject or nullalways
  Prefixes RIPE RIS sees it announce (at least 10 of RIS's peers), or null when it announces none.
  Show 5 fields

  • ipv4Countintegeralways
    IPv4 prefixes.
  • ipv6Countintegeralways
    IPv6 prefixes.
  • ipv4array of stringsalways
    The IPv4 prefixes, sorted by address, the first 100.
  • ipv6array of stringsalways
    The IPv6 prefixes, sorted by address, the first 100.
  • truncatedbooleanalways
    Whether a list stops at 100.
• addressesobject or nullalways
  Address space it originates, overlaps counted once.
  • ipv4integer or nullalways
    Unique IPv4 addresses.
  • ipv6Slash48integer or nullalways
    Unique IPv6 /48 blocks.
  • routedIpv4integer or nullalways
    IPv4 addresses whose most specific route ends at it (IPtoASN).
• relationshipsobject or nullalways
  CAIDA's inferred relationships, or null when it has none.
  • providersintegeralways
    Networks it buys transit from.
  • peersintegeralways
    Networks it peers with.
  • customersintegeralways
    Networks it sells transit to.
• usersobject or nullalways
  APNIC Labs' user estimates (at least 1,000 users in a country), or null.
  • estimateintegeralways
    Users in every country counted, added up.
  • countriesintegeralways
    Countries where it has users.
  • toparray of objectsalways
    The largest countries, at most 6.
    Show 4 fields

    • countrystringalways
      ISO 3166-1 alpha-2 code.
    • usersintegeralways
      Estimated users there.
    • sharenumberalways
      Percent of the country's users.
    • rankintegeralways
      Rank among the country's networks.
• ipv4Geographyobject or nullalways
  Where its IPv4 space is (its unique addresses placed by DB-IP), or null.
  • countriesintegeralways
    Countries in all.
  • toparray of objectsalways
    The largest, at most 5.
    Show 2 fields

    • countrystringalways
      ISO 3166-1 alpha-2 code.
    • addressesintegeralways
      IPv4 addresses there.
• siblingsobject or nullalways
  Other numbers in the same registry record (one holder at one RIR), or null (none, or a national registry's record shared by many holders).
  • countintegeralways
    How many in all.
  • asnsarray of integersalways
    The first 12, announcing ones first.
• sourcestring or nullalways
  Where the record came from: tables (our snapshot) or cymru (a number newer than it).

  one of "tables", "cymru", null

• dataobjectalways
  The date of each table.
  Show 5 fields

  • routesstringalways
    RIPE RIS routes.
  • registrationsstringalways
    RIR delegated statistics.
  • organisationsstringalways
    CAIDA AS Organizations.
  • relationshipsstringalways
    CAIDA AS Relationships.
  • usersstringalways
    APNIC Labs' user estimates.

Errors

• 422 target_not_allowed q is (or a domain resolves to) a private or special-purpose address: no network announces it.
• 503 unavailable Team Cymru or DNS didn't answer for an IP, prefix or domain, or the tables couldn't be read.

Plus the errors every endpoint can return: 400 for a missing or unreadable parameter, 429 past the limit, 503 when every source failed.