RIPEstat IP & ASN Network Intelligence 🛡️

Enrich any IP address, prefix or ASN into a full network profile — holder, abuse contact, geolocation and routing — straight from RIPE NCC's RIPEstat API. No API key, no proxy.

Give it a list of IPs, CIDR prefixes or AS numbers and get back, for each one:

• 🏢 Network — the ASN and holder (owning organization).
• 🛡️ Abuse contact — the email to report abuse/security incidents to (the headline for threat-intel & abuse handling).
• 🌍 Geolocation — country, city, coordinates (for IPs/prefixes).
• 🔀 Routing — origin ASNs, first/last seen in BGP, RIS visibility, announced-prefix counts.

Perfect for security & abuse teams, threat intelligence, SOC/incident response, IP/data enrichment, and network research.

Uses RIPEstat (RIPE NCC) — public internet-number data, no key. Pairs with a PeeringDB actor for a full network-infrastructure picture.

---

Modes

• 🎯 Enrich — IP / prefix / ASN → full profile (network + abuse + geo + routing).
• 📋 ASN announced prefixes — an ASN → every prefix it announces (one row each).

Features

• ✅ No API key, no proxy — official RIPE NCC data.
• ✅ Mixed inputs — IPs, CIDR prefixes and ASNs in one run (auto-detected).
• ✅ Abuse contacts — resolve the right abuse email for any resource.
• ✅ Routing & RPKI origins — see who originates a prefix and BGP visibility.
• ✅ Graceful — anycast/aggregate resources that lack a field are returned faithfully, not errored.

---

Input

Field	Description
Mode	enrich / asn-prefixes.
Resources	IPs, prefixes or ASNs, e.g. ["8.8.8.8", "1.1.1.0/24", "AS15169"].
Include geolocation	Add country/city/lat/lon.
Include routing	Add routing status + origins.
Max results	Cap on records.

Example — enrich a mixed list

{
  "mode": "enrich",
  "resources": ["8.8.8.8", "1.1.1.0/24", "AS15169", "104.16.0.1"]
}

Example — all prefixes announced by an ASN

{
  "mode": "asn-prefixes",
  "resources": ["AS13335"]
}

Output (enrich)

{
  "resource": "8.8.8.8",
  "type": "ip",
  "asn": "15169",
  "holder": "GOOGLE - Google LLC",
  "prefix": "8.8.8.0/24",
  "announced": true,
  "abuse_contacts": ["network-abuse@google.com"],
  "country": "US",
  "city": "",
  "latitude": 37.751,
  "longitude": -97.822,
  "origin_asns": [15169],
  "routing_first_seen": "2002-11-06T16:00:00",
  "routing_last_seen": "2026-07-18T00:00:00",
  "ris_peers_seeing_v4": 325,
  "total_ris_peers_v4": 325,
  "url": "https://stat.ripe.net/8.8.8.8"
}

For ASNs, the profile adds as_type and announced_v4_prefixes / announced_v6_prefixes.

Run it on a schedule

Enrich a watchlist of IPs/ASNs periodically to keep abuse contacts and routing data current — pipe to a SIEM, threat-intel platform or a webhook.

Notes & limitations

• Official RIPEstat (RIPE NCC) data — global coverage across all RIRs.
• Anycast addresses may have no single geolocation; aggregate prefixes may not be announced in BGP — such fields come back empty, faithfully.
• Some routing sub-fields are best-effort and may be blank if RIPEstat is momentarily slow for a resource.
• Data source: RIPE NCC / RIPEstat.

---

Keywords

RIPEstat, RIPE NCC, IP enrichment, ASN, abuse contact, threat intelligence, network intelligence, IP geolocation, BGP, routing, RPKI, whois, prefix, CIDR, security, SOC, incident response, abuse handling, internet numbers, network research, IP lookup.