No-cost access Community service WHOIS / DNS / HTTPS

IP to ASN Mapping Service

Map any IP address to its BGP prefix, origin ASN, and registry record. Run single WHOIS lookups or push thousands of IPs through one bulk query, over WHOIS, DNS, or HTTPS.

Run a WHOIS lookup Set up bulk queries

Free, forever. Underwritten by Team Cymru as a community service.

BGP peers50+
Refresh4 hours
Bulk speed10k IPs / min
Cost to use$0
Start here

Pick the Interface That Fits Your Workflow

Every interface reads from the same BGP feeds, sourced from 50+ peers and refreshed every 4 hours. The only difference is how you call it.

WHOISTCP 43

Command Line and Bulk

The daemon behaves like a standard whois server with extra flags. Best for one-off lookups and for large IP lists piped through GNU netcat.

Hostwhois.cymru.com
Best forInvestigations, scripted enrichment, bulk lists
See WHOIS syntax
DNSUDP 53

Fast, Cacheable Lookups

Reverse lookups in the style of an RBL query. Lower overhead than WHOIS and cacheable, which makes it the right call for recurring or high-frequency queries.

Zonesorigin, origin6, peer, asn
Best forAutomation, detection pipelines, IPv6
See DNS zones
HTTPSTCP 443

Browser and Tooling

A hosted lookup form for quick checks, plus the interface that dozens of public security projects already build against.

Hostv4.whois.cymru.com
Best forAd hoc checks, triage, sharing results
Open the lookup tool
Copy and run

Every Query Type, Ready to Paste

Six working examples covering single IP lookups, ASN lookups, bulk submissions, and DNS. Copy one, swap in your own indicator, and you have a result.

Verbose lookup for a single IP. The leading space inside the quotes keeps your local whois client from reading the flags.

$ whois -h whois.cymru.com " -v 216.90.108.31"
AS  | IP            | BGP Prefix       | CC | Registry | Allocated  | AS Name
23028 | 216.90.108.31 | 216.90.108.0/24 | US | arin     | 1998-09-25 | TEAM-CYMRU - Team Cymru Inc., US
Record anatomy

What an IP to ASN Lookup Returns

A verbose response is one pipe delimited line. Here is that line, decoded field by field.

23028|216.90.108.31|216.90.108.0/24|US|arin|1998-09-25|TEAM-CYMRU - Team Cymru Inc., US
01BGP Origin ASNThe AS announcing the route
02BGP Peer ASNPeers one hop from the origin
03BGP PrefixThe announced netblock
04Prefix Country CodeAs assigned in the RIR record
05Prefix RegistryARIN, RIPE, AFRINIC, APNIC, LACNIC
06Prefix Allocation DateWhen the block was assigned
07ASN Country CodeAs assigned in the RIR record
08ASN RegistryRegistry holding the AS record
09ASN Allocation DateWhen the AS number was assigned
10ASN DescriptionName of the operating network
Read this first

This Is Not a GeoIP Service

Country Codes Are Registry Data, Not Locations

Country code, registry, and allocation date come straight from the regional registries. Those values often differ significantly from where an IP is actually used, so this service should not be used for IP geolocation. Results are only as accurate as the RIR databases they are drawn from. AS descriptions come from cidr-report.

Registry Source Files

The delegated files this service reads from, published by each RIR.

ARINNorth America RIPE NCCEurope, Middle East AFRINICAfrica APNICAsia Pacific LACNICLatin America

Looking for IP Geolocation Instead?

These providers do geolocation properly. Listing them is not an endorsement.

MaxMindGeoIP2 databases and API IP2LocationDatabases and web service ipinfo.ioAPI and bulk lookups ipdata.coAPI with threat context ipgeolocation.ioAPI and timezone data ipregistryAPI with proxy detection Big Data CloudClient and server side APIs ipwhois.ioFree tier geolocation API
Interface 01

WHOIS Lookup Service

The whois daemon accepts single queries on the command line and bulk IP submissions when paired with GNU netcat. Roughly 10,000 IPs return in under a minute on a moderate link.

whois.cymru.com

Maps an IP address to its BGP origin ASN and prefix. Also reachable at v4.whois.cymru.com. This is the server most workflows want.

peer.whois.cymru.com

Maps an IP to the possible BGP peer ASNs one hop from the origin, a fast read on likely upstreams. Also at v4-peer.whois.cymru.com. Peer discovery is not exact, and upstream loses meaning when the origin is a Tier 1.

Use Bulk Mode or DNS for Volume

IPs that hammer the whois server with large numbers of individual queries are null routed. Send groups of IPs as one netcat submission, or use the DNS interface for individual lookups, which is far more efficient.

Query Flags

Command line flags on the left, netcat keywords on the right. Wrap single IP queries in quotes with a leading space so your local client does not interpret the flags.

WHOISNetcatWhat it does
n/abeginEnable bulk input mode netcat only
n/aendExit the client netcat only
-pprefixInclude the matching prefix
-qnoprefixDisable the matching prefix default
-ccountrycodeInclude the matching country code
-dnocountrycodeDisable country codes default
-nasnameInclude AS names default
-onoasnameDisable AS names
-rregistryDisplay the matching registry
-snoregistryDisable registry display default
-aallocdateEnable the allocation date
-bnoallocdateDisable the allocation date default
-ttruncateTruncate AS names default
-unotruncateDo not truncate AS names
-vverboseEnable all flags
-eheaderEnable column headings default
-fnoheaderDisable column headings
-wasnumberInclude the AS number column default
-xnoasnumberDisable the AS number column, which will not work for IP mappings
-hhelpPrint the help message
Interface 01 / bulk

Run Thousands of WHOIS Lookups in One Query

Use GNU netcat, not nc. The venerable nc buffers against our server and will not always return full output on larger lists. GNU netcat is available from sourceforge, and is the same as gnetcat in FreeBSD ports.

1

Build Your List

One IP or ASN per line, with begin at the top and end at the bottom. Flags and comments from the table above can be added inside the file.

list01

begin
verbose
68.22.187.5      2005-06-30 05:05:05 GMT
207.229.165.18   2005-06-30 05:05:05 GMT
198.6.1.65       2005-06-30 05:05:05 GMT
end
2

Pipe It Through GNU Netcat

Output comes back sorted by origin AS.

Bulk submission over TCP 43

$ netcat whois.cymru.com 43 < list01 | sort -n > list02
# Bulk mode; whois.cymru.com [2018-08-29 21:04:00 +0000]
701   | 198.6.1.65     | 198.6.0.0/16     | US | arin | 1992-11-10 | UUNET, US
6079  | 207.229.165.18 | 207.229.128.0/18 | US | arin | 1996-11-01 | RCN-AS - RCN, US
23028 | 68.22.187.5    | 68.22.187.0/24   | US | arin | 2002-03-15 | TEAM-CYMRU, US
3

Submit ASNs the Same Way

A list can hold IPs and ASNs together, though mixed output is harder to parse. Keep runs to a few thousand addresses, and move recurring jobs to the DNS interface.

ASN list, and a mixed list

# list02: begin / verbose / as23028 / end
$ nc whois.cymru.com 43 < file
23028 | US | arin | 2002-01-04 | TEAM-CYMRU, US

# list03: begin / verbose / 8.8.0.0 / as23028 / end
3356  | 8.8.0.0 | 8.0.0.0/12 | US | arin | 1992-12-01 | LEVEL3, US
23028 | US | arin | 2002-01-04 | TEAM-CYMRU, US

Need the full flag list from the server, or hit a problem?

whois -h whois.cymru.com help Email support@cymru.com
Interface 02

DNS Zones for Rapid Lookups

Built for rapid reverse lookups in the same style as RBL queries. Because it runs over UDP and caches, overhead is far lower than WHOIS. Prepend the reversed octets of your address to the zone. A prefix we do not hold returns NXDOMAIN.

IPv4origin
origin.asn.cymru.com

Maps an IPv4 address or prefix to its BGP origin ASN.

IPv6origin6
origin6.asn.cymru.com

Maps an IPv6 address or prefix to its BGP origin ASN. Reverse the nibbles, padding omitted zeroes.

Peerspeer
peer.asn.cymru.com

Returns the peer ASNs one AS hop from the origin prefix.

asn.cymru.com

Returns the AS description and registry detail for a given BGP ASN. Query it directly, for example dig +short AS23028.asn.cymru.com TXT, which returns "23028 | US | arin | 2002-01-04 | TEAM-CYMRU - Team Cymru Inc., US". Format mirrors the verbose WHOIS response, minus the AS description column on the origin and peer zones.

Interface 03

HTTPS and the Tools Built on It

Run a lookup in the browser, or use the interface the way these public security projects already do.

Open the lookup tool
Net::Abuse::UtilsPerl module for abuse reporting nmapNetwork scanner and NSE scripts MXToolboxDNS and mail diagnostics ourmonNetwork monitoring and anomaly detection
Beyond the mapping

You Have the ASN. Now Find the Activity.

IP to ASN mapping tells you who announces a prefix. It does not tell you what that infrastructure is doing, who it talks to, or how it moved last week. This service runs on the same Pure Signal™ visibility behind Team Cymru's commercial products, and that visibility is open to you.

Explore Pure Signal See All No-Cost Services
See Everything Connected to That Address Passive discovery of exposed IPs, domains, and infrastructure, auto-enriched with ASN, country code, and behavioral tags. No scanning. RADAR One Console for the Whole Investigation Discover, enrich, investigate, attribute, and respond in a single environment, queryable in natural language. Command See How Traffic Actually Moves Global visibility into internet traffic beyond your own edge, the foundation everything else is built on. NetFlow Where This Service Comes From The exchange that returns community visibility as protection: no-cost services, coordinated takedowns, and CSIRT support. GDX

FAQ

Questions From Operators

Why do I see two or more different ASNs for the same address or prefix?
Why does a.0.0.0 return a different ASN than a.b.c.d in the same range?
Why do I get an origin ASN when I query a bogon address?
Is there a limit on how many addresses I can submit to the bulk interface?
Should I aggregate IPs inside the same /24 or /64?
Can I use IP to ASN mapping for IP geolocation?
How often is the data refreshed, and where does it come from?
Does this service cost anything?

Report an issue or ask a question. Community services are supported by the same team that runs them.

Get Operational Support