IP to ASN Mapping Service
Map any IP address to its BGP prefix, origin ASN, and registry record. Run single WHOIS lookups or push thousands of IPs through one bulk query, over WHOIS, DNS, or HTTPS.
Free, forever. Underwritten by Team Cymru as a community service.
Pick the Interface That Fits Your Workflow
Every interface reads from the same BGP feeds, sourced from 50+ peers and refreshed every 4 hours. The only difference is how you call it.
Command Line and Bulk
The daemon behaves like a standard whois server with extra flags. Best for one-off lookups and for large IP lists piped through GNU netcat.
Fast, Cacheable Lookups
Reverse lookups in the style of an RBL query. Lower overhead than WHOIS and cacheable, which makes it the right call for recurring or high-frequency queries.
Browser and Tooling
A hosted lookup form for quick checks, plus the interface that dozens of public security projects already build against.
Every Query Type, Ready to Paste
Six working examples covering single IP lookups, ASN lookups, bulk submissions, and DNS. Copy one, swap in your own indicator, and you have a result.
Verbose lookup for a single IP. The leading space inside the quotes keeps your local whois client from reading the flags.
$ whois -h whois.cymru.com " -v 216.90.108.31"
AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name
23028 | 216.90.108.31 | 216.90.108.0/24 | US | arin | 1998-09-25 | TEAM-CYMRU - Team Cymru Inc., USQuery an ASN directly to return its registry, allocation date, and description.
$ whois -h whois.cymru.com " -v AS23028"
AS | CC | Registry | Allocated | AS Name
23028 | US | arin | 2002-01-04 | TEAM-CYMRU - Team Cymru Inc., USThousands of IPs in one TCP session. Use GNU netcat, not nc. Output is sorted by origin AS.
$ netcat whois.cymru.com 43 < list01 | sort -n > list02
# Bulk mode; whois.cymru.com [2018-08-29 21:04:00 +0000]
701 | 198.6.1.65 | 198.6.0.0/16 | US | arin | 1992-11-10 | UUNET - MCI Communications Services, Inc., US
6079 | 207.229.165.18 | 207.229.128.0/18 | US | arin | 1996-11-01 | RCN-AS - RCN, US
23028 | 68.22.187.5 | 68.22.187.0/24 | US | arin | 2002-03-15 | TEAM-CYMRU - Team Cymru Inc., USReverse the octets and append the zone. Cacheable, low overhead, and the best fit for recurring lookups.
$ dig +short 31.108.90.216.origin.asn.cymru.com TXT
"23028 | 216.90.108.0/24 | US | arin | 1998-09-25"Returns the BGP peer ASNs one hop away from the origin, which is a quick read on likely upstreams.
$ dig +short 31.108.90.216.peer.asn.cymru.com TXT
"701 1239 3549 3561 7132 | 216.90.108.0/24 | US | arin | 1998-09-25"Reverse the nibbles against origin6.asn.cymru.com. Long zero runs in the host portion can usually be dropped.
# full form for 2001:4860:b002::68
$ dig +short 8.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.b.0.6.8.4.1.0.0.2.origin6.asn.cymru.com. TXT
# shortened form, same answer
$ dig +short 2.0.0.b.0.6.8.4.1.0.0.2.origin6.asn.cymru.com. TXT
"15169 | 2001:4860::/32 | US | arin | 2005-03-14"What an IP to ASN Lookup Returns
A verbose response is one pipe delimited line. Here is that line, decoded field by field.
This Is Not a GeoIP Service
Country Codes Are Registry Data, Not Locations
Country code, registry, and allocation date come straight from the regional registries. Those values often differ significantly from where an IP is actually used, so this service should not be used for IP geolocation. Results are only as accurate as the RIR databases they are drawn from. AS descriptions come from cidr-report.
Registry Source Files
The delegated files this service reads from, published by each RIR.
Looking for IP Geolocation Instead?
These providers do geolocation properly. Listing them is not an endorsement.
WHOIS Lookup Service
The whois daemon accepts single queries on the command line and bulk IP submissions when paired with GNU netcat. Roughly 10,000 IPs return in under a minute on a moderate link.
Maps an IP address to its BGP origin ASN and prefix. Also reachable at v4.whois.cymru.com. This is the server most workflows want.
Maps an IP to the possible BGP peer ASNs one hop from the origin, a fast read on likely upstreams. Also at v4-peer.whois.cymru.com. Peer discovery is not exact, and upstream loses meaning when the origin is a Tier 1.
Use Bulk Mode or DNS for Volume
IPs that hammer the whois server with large numbers of individual queries are null routed. Send groups of IPs as one netcat submission, or use the DNS interface for individual lookups, which is far more efficient.
Query Flags
Command line flags on the left, netcat keywords on the right. Wrap single IP queries in quotes with a leading space so your local client does not interpret the flags.
| WHOIS | Netcat | What it does |
|---|---|---|
| n/a | begin | Enable bulk input mode netcat only |
| n/a | end | Exit the client netcat only |
| -p | prefix | Include the matching prefix |
| -q | noprefix | Disable the matching prefix default |
| -c | countrycode | Include the matching country code |
| -d | nocountrycode | Disable country codes default |
| -n | asname | Include AS names default |
| -o | noasname | Disable AS names |
| -r | registry | Display the matching registry |
| -s | noregistry | Disable registry display default |
| -a | allocdate | Enable the allocation date |
| -b | noallocdate | Disable the allocation date default |
| -t | truncate | Truncate AS names default |
| -u | notruncate | Do not truncate AS names |
| -v | verbose | Enable all flags |
| -e | header | Enable column headings default |
| -f | noheader | Disable column headings |
| -w | asnumber | Include the AS number column default |
| -x | noasnumber | Disable the AS number column, which will not work for IP mappings |
| -h | help | Print the help message |
Run Thousands of WHOIS Lookups in One Query
Use GNU netcat, not nc. The venerable nc buffers against our server and will not always return full output on larger lists. GNU netcat is available from sourceforge, and is the same as gnetcat in FreeBSD ports.
Build Your List
One IP or ASN per line, with begin at the top and end at the bottom. Flags and comments from the table above can be added inside the file.
list01
begin
verbose
68.22.187.5 2005-06-30 05:05:05 GMT
207.229.165.18 2005-06-30 05:05:05 GMT
198.6.1.65 2005-06-30 05:05:05 GMT
endPipe It Through GNU Netcat
Output comes back sorted by origin AS.
Bulk submission over TCP 43
$ netcat whois.cymru.com 43 < list01 | sort -n > list02
# Bulk mode; whois.cymru.com [2018-08-29 21:04:00 +0000]
701 | 198.6.1.65 | 198.6.0.0/16 | US | arin | 1992-11-10 | UUNET, US
6079 | 207.229.165.18 | 207.229.128.0/18 | US | arin | 1996-11-01 | RCN-AS - RCN, US
23028 | 68.22.187.5 | 68.22.187.0/24 | US | arin | 2002-03-15 | TEAM-CYMRU, USSubmit ASNs the Same Way
A list can hold IPs and ASNs together, though mixed output is harder to parse. Keep runs to a few thousand addresses, and move recurring jobs to the DNS interface.
ASN list, and a mixed list
# list02: begin / verbose / as23028 / end
$ nc whois.cymru.com 43 < file
23028 | US | arin | 2002-01-04 | TEAM-CYMRU, US
# list03: begin / verbose / 8.8.0.0 / as23028 / end
3356 | 8.8.0.0 | 8.0.0.0/12 | US | arin | 1992-12-01 | LEVEL3, US
23028 | US | arin | 2002-01-04 | TEAM-CYMRU, USNeed the full flag list from the server, or hit a problem?
DNS Zones for Rapid Lookups
Built for rapid reverse lookups in the same style as RBL queries. Because it runs over UDP and caches, overhead is far lower than WHOIS. Prepend the reversed octets of your address to the zone. A prefix we do not hold returns NXDOMAIN.
Maps an IPv4 address or prefix to its BGP origin ASN.
Maps an IPv6 address or prefix to its BGP origin ASN. Reverse the nibbles, padding omitted zeroes.
Returns the peer ASNs one AS hop from the origin prefix.
Returns the AS description and registry detail for a given BGP ASN. Query it directly, for example dig +short AS23028.asn.cymru.com TXT, which returns "23028 | US | arin | 2002-01-04 | TEAM-CYMRU - Team Cymru Inc., US". Format mirrors the verbose WHOIS response, minus the AS description column on the origin and peer zones.
HTTPS and the Tools Built on It
Run a lookup in the browser, or use the interface the way these public security projects already do.
You Have the ASN. Now Find the Activity.
IP to ASN mapping tells you who announces a prefix. It does not tell you what that infrastructure is doing, who it talks to, or how it moved last week. This service runs on the same Pure Signal™ visibility behind Team Cymru's commercial products, and that visibility is open to you.
FAQ
Questions From Operators
Report an issue or ask a question. Community services are supported by the same team that runs them.