ASN lookups
Look up an autonomous system for its announced space by address type, anonymizer count, residential proxy exits, attribution and prefixes.
An ASN lookup summarizes a whole network: what kind of network it is, the addresses it announces counted by type, how many are anonymizers or residential proxy exits, and who runs and leases space on it. It can also list every prefix it announces.
| Request | Tier | Cost |
|---|---|---|
GET /open/AS{n} | Open | Free |
GET /open/AS{n}/prefixes | Open, with every prefix | Free |
GET /v1/AS{n} | Paid | 1 credit when paid-only names come back, otherwise free |
GET /v1/AS{n}?include=prefixes | Paid, with every prefix | As /v1/AS{n}; the prefixes add nothing |
curl https://api.layer3intel.com/open/AS7922{
"asn": 7922,
"name": "Comcast Cable Communications, LLC",
"country": "US",
"registered": "1997-02-14",
"type": "access",
"announced": { "prefixes": 428, "addresses": 68238848 },
"classes": [
{ "type": "residential", "addresses": 57000718 },
{ "type": "business", "addresses": 7801012 },
{ "type": "isp", "addresses": 2882304 },
{ "type": "isp_proxy", "addresses": 222208 },
{ "type": "mobile", "addresses": 6456 },
{ "type": "hosting", "addresses": 1024 },
{ "type": "vpn", "addresses": 6 }
],
"anonymizer_addresses": 222214,
"proxy_exits": {
"blocks24": 152198,
"blocks24_share": 0.571,
"exits": 792872,
"always_on": 151566
}
}The open answer names the ASN's privacy relays and corporate gateways in operators. For GET /open/AS13335:
"operators": [
{ "name": "Cloudflare WARP", "kind": "relay", "group": "relay", "addresses": 383466 },
{ "name": "iCloud Private Relay", "kind": "relay", "group": "relay", "addresses": 23081 }
]Every prefix
/open/AS{n}/prefixes and /v1/AS{n}?include=prefixes return the same answer plus prefixes: every announcement as one array, not paged. The largest ASNs return over 17,000 rows (about 1.5 MB).
curl https://api.layer3intel.com/open/AS13335/prefixes"prefixes": [
{ "prefix": "1.0.0.0/24", "type": "hosting", "anonymizer_addresses": 0, "rpki": "valid" },
{ "prefix": "1.1.1.0/24", "type": "hosting", "anonymizer_addresses": 0, "rpki": "valid" },
{ "prefix": "5.10.214.0/24", "type": "hosting", "anonymizer_addresses": 0, "rpki": "valid" }
]prefixes is the only include value. An unknown value gets 400 invalid_query. The paid API has no /v1/AS{n}/prefixes route.
The paid answer
/v1/AS{n} adds every other operator and leased_from, for example:
"operators": [
{ "name": "Oxylabs", "kind": "proxy-seller", "group": "proxy", "addresses": 74240 }
],
"leased_from": [
{ "name": "IPXO", "kind": "broker", "addresses": 15360 }
]Fields
| Field | Type | Description |
|---|---|---|
asn | integer | The ASN. |
name | string | Its registered name. |
country | string | Its registration country, when known. |
registered | date | When it was registered, when known. |
type | string | What kind of network it is. Absent when unknown. See network types. |
announced | object | prefixes (announcements) and addresses (addresses announced). |
classes[] | {type, addresses} | Its announced addresses counted by address type. |
anonymizer_addresses | integer | Addresses that are ISP or datacenter proxies, VPN servers or Tor exits. |
proxy_exits | object | When there are any: blocks24 (/24s with residential proxy exits), blocks24_share (the share of its announced /24s with exits, 0–1), exits (exit addresses) and always_on (exits observed nearly every day). |
drop_listed | true | On Spamhaus's ASN-DROP list. |
prefixes[] | {prefix, type, anonymizer_addresses, rpki} | With /open/AS{n}/prefixes or /v1/AS{n}?include=prefixes. type is the announcement's main address type. |
operators[] | {name, kind, group, addresses} | Open: only group relay and corporate_proxy. Paid: all. See Operators and lessors. |
leased_from[] | {name, kind, addresses} | Paid only. Who leases space out on the network. |
An ASN that announces nothing answers its name, announced: {"prefixes": 0, "addresses": 0}, and whatever else is known.
Prefix lookups
Look up an IPv4 prefix from /16 to /32 for its announcement, address types, anonymizer count, residential proxy exits and attribution.
Operators and lessors
Who runs, sells and leases an address, prefix or ASN. Privacy relays and corporate gateways are named free; every other name is on the paid API.