Prefix lookups
Look up an IPv4 prefix from /16 to /32 for its announcement, address types, anonymizer count, residential proxy exits and attribution.
A prefix lookup summarizes an IPv4 block from /16 to /32: the announcement covering it, its addresses counted by type, how many are anonymizers or residential proxy exits, and who runs and leases the space.
| Request | Tier | Cost |
|---|---|---|
GET /open/{cidr} | Open | Free |
GET /v1/{cidr} | Paid | 1 credit when paid-only names come back, otherwise free |
curl https://api.layer3intel.com/open/1.1.1.0/24{
"prefix": "1.1.1.0/24",
"company": "APNIC Research and Development",
"announced": true,
"announcement": {
"prefix": "1.1.1.0/24",
"asn": 13335,
"name": "Cloudflare, Inc.",
"type": "cdn",
"rpki": "valid"
},
"classes": [{ "type": "hosting", "addresses": 256 }],
"not_announced_addresses": 0,
"anonymizer_addresses": 0,
"routing": {
"shape": "stable",
"first_seen": "2008-11-15",
"origins": 9,
"current_since": "2018-03-14"
}
}The open answer names a prefix's privacy relays and corporate gateways in operators. For GET /open/146.112.163.0/24:
"operators": [
{ "name": "Cisco Umbrella", "kind": "swg", "group": "corporate_proxy", "addresses": 256 }
]The paid answer
The paid answer adds every other operator and leased_from:
curl -H "Authorization: Bearer $KEY" https://api.layer3intel.com/v1/104.164.205.0/24{
"prefix": "104.164.205.0/24",
"company": "Iwihost Net",
"announced": true,
"announcement": {
"prefix": "104.164.205.0/24",
"asn": 44559,
"name": "IT Hostline Ltd",
"type": "proxy_network",
"rpki": "valid"
},
"classes": [{ "type": "datacenter_proxy", "addresses": 256 }],
"not_announced_addresses": 0,
"anonymizer_addresses": 256,
"operators": [
{ "name": "ProxyLine", "kind": "proxy-seller", "group": "proxy", "addresses": 256 }
],
"leased_from": [{ "name": "EGIHosting", "kind": "lessor", "addresses": 256 }],
"routing": {
"shape": "rotating",
"first_seen": "2023-10-02",
"origins": 3,
"current_since": "2026-05-31"
}
}Fields
| Field | Type | Description |
|---|---|---|
prefix | string | The prefix, masked to its network. |
announced | boolean | true when the prefix is announced exactly as asked. false when it is covered by a wider announcement, or by none. |
company | string | The organization using the prefix, the same as network.company for its addresses. If several share it, the one using most of it. |
announcement | object | The announcement covering the prefix: prefix, asn, name, type (network types) and rpki (RPKI). |
classes[] | {type, addresses} | The announced addresses counted by address type. |
not_announced_addresses | integer | Addresses in the prefix that no network announces. |
anonymizer_addresses | integer | Addresses that are ISP or datacenter proxies, VPN servers or Tor exits. |
proxy_exits | object | When there are any: blocks24 (/24s with residential proxy exits), exits (exit addresses) and always_on (exits observed nearly every day). |
routing | object | The announcement's routing history: shape, first_seen, origins, current_since. See routing shape. |
operators[] | {name, kind, group, addresses} | Companies running or selling proxies, VPNs, privacy relays or corporate gateways in the prefix, with how many addresses each has. Open: only group relay and corporate_proxy. Paid: all. See Operators and lessors. |
leased_from[] | {name, kind, addresses} | Paid only. Who leases the space out. |
No list of the ranges inside a prefix is served.
Prefixes shorter than /16
A prefix shorter than /16 gets 422 prefix_too_large. When an ASN announcing space in the prefix can be suggested, the error carries its route on the same tier in asn:
curl https://api.layer3intel.com/open/1.0.0.0/8{
"error": {
"code": "prefix_too_large",
"message": "prefixes shorter than a /16 are not served; look up the origin ASN",
"asn": "/open/AS13335"
}
}On /v1, the suggestion reads "asn": "/v1/AS13335". See ASN lookups.
Address lookups
Look up one IPv4 address for its type, risk score, proxy, VPN, Tor and relay flags, residential proxy record, network, routing and location.
ASN lookups
Look up an autonomous system for its announced space by address type, anonymizer count, residential proxy exits, attribution and prefixes.