Bulk ASN IP Lookup: Org, Country & BGP Prefix

Look up which ASN owns an IP — organization name, country, BGP prefix and RIR — for one address or thousands, in a single run. Paste raw firewall, VPN or web-server log lines; every IPv4 and IPv6 is extracted and deduplicated. Flip to aggregate mode to group hits by ASN and prefix for allowlists and abuse reports. Optionally reverse an ASN into its announced prefixes.

Data comes from Team Cymru's free IP-to-ASN DNS (no API key, works from datacenters via DNS or DoH) with an optional RIPEstat announced-prefixes call for reverse lookups. No paid BGP feeds, no scraping, no Spamhaus.

Who it's for

• Sysadmins and network engineers enriching firewall / IDS / VPN / proxy logs with ASN and org
• SOC and abuse teams attributing scanners and scrapers to hosting providers before filing reports
• Cloud and security engineers turning a list of source IPs into CIDR/ASN allowlists or blocklists
• Anyone who needs bulk IP→ASN without signing up for a commercial IP-intel API

Differentiator

Most Store actors hit one IP at a time through a scraper's web UI or a geo API. This one is built for bulk ops: up to 50,000 unique IPs, log-line paste, ASN org names, CIDR aggregation, and optional ASN→prefixes reverse — priced per IP so large jobs stay cheap.

Input

• mode: lookup (default, one row per IP) or aggregate (group by ASN + BGP prefix)
• ips: IPv4/IPv6 addresses or raw log lines. You can also include AS15169-style ASNs (or a bare ASN number on its own line) for reverse prefix listing when resolveAsnPrefixes is on or an ASN is present.
• unique (default true): dedupe IPs before lookup
• concurrency (default 20, max 50): parallel DNS queries
• includePeers (default false): also query Team Cymru peer records
• resolveAsnPrefixes (default false): fetch announced prefixes from RIPEstat for ASNs in the input

{
  "mode": "lookup",
  "ips": [
    "8.8.8.8",
    "1.1.1.1",
    "52.94.236.248",
    "Oct 15 sshd: Failed password from 34.102.136.180 port 22"
  ]
}

Aggregate example:

{ "mode": "aggregate", "ips": ["8.8.8.8", "8.8.4.4", "1.1.1.1", "1.0.0.1"] }

Output

Lookup mode, one row per IP:

{
  "ip": "8.8.8.8",
  "ipVersion": 4,
  "asn": "AS15169",
  "asnNumber": 15169,
  "asnOrg": "GOOGLE - Google LLC, US",
  "country": "US",
  "prefix": "8.8.8.0/24",
  "registry": "arin",
  "allocated": "2023-12-28",
  "peers": null,
  "source": "team-cymru-dns",
  "summary": "AS15169 (GOOGLE - Google LLC, US) 8.8.8.0/24 US"
}

Aggregate mode adds ipCount and sampleIps per ASN/prefix group. ASN reverse rows use type: "asn-prefixes" with a prefixes array (capped) and prefixCount.

DNS query format (Team Cymru)

Documented on each run in the key-value store record DNS_QUERIES:

Query	Example	TXT fields
IPv4 origin	8.8.8.8.origin.asn.cymru.com (octets reversed)	ASN | BGP Prefix | CC | Registry | Allocated
IPv6 origin	reversed nibbles under origin6.asn.cymru.com	same
ASN info	AS15169.asn.cymru.com	ASN | CC | Registry | Allocated | AS Name
Peers (optional)	….peer.asn.cymru.com	peer ASNs | prefix | …

Resolution order: Node dns.resolveTxt, then Cloudflare DNS-over-HTTPS (cloudflare-dns.com) if the platform recursive resolver returns no TXT.

Pricing

Pay per event:

• $1 per 1,000 IPs looked up ($0.001 each) — primary
• $2 per ASN whose announced prefixes are listed ($0.002 each)

Related

• Cloud IP Range Lookup: match IPs to AWS, Azure, GCP, Cloudflare, GitHub and verified crawlers.
• Microsoft 365 Tenant Finder: tenant ID and IdP for company domains.
• Free browser tools: SysAdmin Toolbox.

Attribution

IP-to-ASN mapping data © Team Cymru. Announced-prefixes data via RIPEstat. This actor is not affiliated with Team Cymru or the RIPE NCC.