# Bulk ASN IP Lookup: Org, Country & BGP Prefix (`sysadmin-toolbox/asn-ip-lookup`) Actor

Bulk IP to ASN lookup for sysadmins: organization name, country, BGP prefix and RIR from Team Cymru DNS. Paste log lines, dedupe thousands of IPs, or aggregate by ASN. Optional ASN to announced-prefixes reverse via RIPEstat. No API key.

- **URL**: https://apify.com/sysadmin-toolbox/asn-ip-lookup.md
- **Developed by:** [SysAdmin Toolbox](https://apify.com/sysadmin-toolbox) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 ip looked ups

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Bulk ASN IP Lookup: Org, Country & BGP Prefix

Look up **which ASN owns an IP** — organization name, country, BGP prefix and RIR — for one address or **thousands**, in a single run. Paste raw firewall, VPN or web-server log lines; every IPv4 and IPv6 is extracted and deduplicated. Flip to **aggregate** mode to group hits by ASN and prefix for allowlists and abuse reports. Optionally reverse an ASN into its announced prefixes.

Data comes from **Team Cymru's free IP-to-ASN DNS** (no API key, works from datacenters via DNS or DoH) with an optional **RIPEstat** announced-prefixes call for reverse lookups. No paid BGP feeds, no scraping, no Spamhaus.

### Who it's for

- **Sysadmins and network engineers** enriching firewall / IDS / VPN / proxy logs with ASN and org
- **SOC and abuse teams** attributing scanners and scrapers to hosting providers before filing reports
- **Cloud and security engineers** turning a list of source IPs into CIDR/ASN allowlists or blocklists
- **Anyone** who needs bulk IP→ASN without signing up for a commercial IP-intel API

### Differentiator

Most Store actors hit one IP at a time through a scraper's web UI or a geo API. This one is built for **bulk ops**: up to 50,000 unique IPs, log-line paste, ASN org names, CIDR aggregation, and optional ASN→prefixes reverse — priced per IP so large jobs stay cheap.

### Input

- `mode`: `lookup` (default, one row per IP) or `aggregate` (group by ASN + BGP prefix)
- `ips`: IPv4/IPv6 addresses or raw log lines. You can also include `AS15169`-style ASNs (or a bare ASN number on its own line) for reverse prefix listing when `resolveAsnPrefixes` is on or an ASN is present.
- `unique` (default true): dedupe IPs before lookup
- `concurrency` (default 20, max 50): parallel DNS queries
- `includePeers` (default false): also query Team Cymru peer records
- `resolveAsnPrefixes` (default false): fetch announced prefixes from RIPEstat for ASNs in the input

```json
{
  "mode": "lookup",
  "ips": [
    "8.8.8.8",
    "1.1.1.1",
    "52.94.236.248",
    "Oct 15 sshd: Failed password from 34.102.136.180 port 22"
  ]
}
```

Aggregate example:

```json
{ "mode": "aggregate", "ips": ["8.8.8.8", "8.8.4.4", "1.1.1.1", "1.0.0.1"] }
```

### Output

Lookup mode, one row per IP:

```json
{
  "ip": "8.8.8.8",
  "ipVersion": 4,
  "asn": "AS15169",
  "asnNumber": 15169,
  "asnOrg": "GOOGLE - Google LLC, US",
  "country": "US",
  "prefix": "8.8.8.0/24",
  "registry": "arin",
  "allocated": "2023-12-28",
  "peers": null,
  "source": "team-cymru-dns",
  "summary": "AS15169 (GOOGLE - Google LLC, US) 8.8.8.0/24 US"
}
```

Aggregate mode adds `ipCount` and `sampleIps` per ASN/prefix group. ASN reverse rows use `type: "asn-prefixes"` with a `prefixes` array (capped) and `prefixCount`.

#### DNS query format (Team Cymru)

Documented on each run in the key-value store record `DNS_QUERIES`:

| Query | Example | TXT fields |
| --- | --- | --- |
| IPv4 origin | `8.8.8.8.origin.asn.cymru.com` (octets reversed) | `ASN \| BGP Prefix \| CC \| Registry \| Allocated` |
| IPv6 origin | reversed nibbles under `origin6.asn.cymru.com` | same |
| ASN info | `AS15169.asn.cymru.com` | `ASN \| CC \| Registry \| Allocated \| AS Name` |
| Peers (optional) | `….peer.asn.cymru.com` | peer ASNs | prefix | … |

Resolution order: Node `dns.resolveTxt`, then Cloudflare DNS-over-HTTPS (`cloudflare-dns.com`) if the platform recursive resolver returns no TXT.

### Pricing

Pay per event:

- **$1 per 1,000 IPs looked up** ($0.001 each) — primary
- **$2 per ASN whose announced prefixes are listed** ($0.002 each)

### Related

- [Cloud IP Range Lookup](https://apify.com/sysadmin-toolbox/cloud-ip-range-lookup): match IPs to AWS, Azure, GCP, Cloudflare, GitHub and verified crawlers.
- [Microsoft 365 Tenant Finder](https://apify.com/sysadmin-toolbox/m365-tenant-finder): tenant ID and IdP for company domains.
- Free browser tools: [SysAdmin Toolbox](https://sysadmin-toolbox.pages.dev).

### Attribution

IP-to-ASN mapping data © Team Cymru. Announced-prefixes data via RIPEstat. This actor is not affiliated with Team Cymru or the RIPE NCC.

# Actor input Schema

## `mode` (type: `string`):

Lookup returns one row per IP. Aggregate groups unique IPs by ASN and BGP prefix (counts + sample IPs) for firewall allowlists and abuse reports.

## `ips` (type: `array`):

IPv4 or IPv6 addresses. You can paste raw log lines; every IP found in a line is extracted. You may also include ASNs like AS15169 or 15169 to list announced prefixes (reverse). Max 50,000 unique IPs per run.

## `unique` (type: `boolean`):

When true (default), each unique IP is looked up once. Turn off to keep duplicate rows in the order they appear.

## `concurrency` (type: `integer`):

Parallel DNS lookups. Keep at or below 20 to be polite to public resolvers.

## `includePeers` (type: `boolean`):

Also query Team Cymru peer.asn.cymru.com for upstream/peer ASNs (adds one DNS query per IP).

## `resolveAsnPrefixes` (type: `boolean`):

When input contains ASNs (AS15169) or you want reverse lookup, fetch announced prefixes from RIPEstat (free, rate-limited). Also used in aggregate mode when you pass ASNs.

## Actor input object example

```json
{
  "mode": "lookup",
  "ips": [
    "8.8.8.8",
    "1.1.1.1",
    "52.94.236.248",
    "20.190.128.1",
    "140.82.112.3",
    "Oct 15 sshd: Failed password from 34.102.136.180 port 22"
  ],
  "unique": true,
  "concurrency": 20,
  "includePeers": false,
  "resolveAsnPrefixes": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "ips": [
        "8.8.8.8",
        "1.1.1.1",
        "52.94.236.248",
        "20.190.128.1",
        "140.82.112.3",
        "Oct 15 sshd: Failed password from 34.102.136.180 port 22"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("sysadmin-toolbox/asn-ip-lookup").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "ips": [
        "8.8.8.8",
        "1.1.1.1",
        "52.94.236.248",
        "20.190.128.1",
        "140.82.112.3",
        "Oct 15 sshd: Failed password from 34.102.136.180 port 22",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("sysadmin-toolbox/asn-ip-lookup").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "ips": [
    "8.8.8.8",
    "1.1.1.1",
    "52.94.236.248",
    "20.190.128.1",
    "140.82.112.3",
    "Oct 15 sshd: Failed password from 34.102.136.180 port 22"
  ]
}' |
apify call sysadmin-toolbox/asn-ip-lookup --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,sysadmin-toolbox/asn-ip-lookup"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/v1sLza4zuvoqrS6BV/builds/ka92CdZf5xSdGM2oT/openapi.json