IP to ASN Intelligence — with Infrastructure Classification
Map any IPv4 address to its network prefix, autonomous system, operator, and infrastructure type. Integer range-bound join keys, refreshed daily.
- Coverage
- IPv4
- Refresh
- Daily
- ASNs profiled
- 79k
- Every ASN announcing routes — none missing
- License
- Clean for redistribution
Overview
Maps any IPv4 address to its network prefix, autonomous system (ASN), and operator, enriched with an infrastructure type classification: cloud, hosting, CDN, ISP, or enterprise.
Ships with integer range-bound join keys, so the lookup is an ordinary range join in your warehouse — no UDFs, no external calls, no per-row API cost.
Natively built by Datazag. License-clean for redistribution, and refreshed daily.
Coverage is IPv4, and it is complete: every ASN announcing routes on the public internet is profiled — all 79k of them. There is no sampled subset and no long tail left out, so a lookup that returns nothing means the address is unannounced, not that we are missing the network.
Datazag observes 360M+ live domains daily across those networks; this dataset is the IP-to-ASN layer of that corpus.
Schema reference
Table: DATAZAG_IP_ASN
| Column | Type | Description |
|---|---|---|
ip_start_intJoin key | NUMBER | Start of the IP range, unsigned integer. |
ip_end_intJoin key | NUMBER | End of the IP range, unsigned integer. |
prefix | VARCHAR | CIDR prefix, e.g. 98.125.248.0/22. |
asn | NUMBER | Autonomous System Number. |
asn_name | VARCHAR | Operator name for the ASN. |
asn_org | VARCHAR | Registered organization for the ASN. |
country | VARCHAR | ISO country code for the allocation. |
asn_type | VARCHAR | Infrastructure classification: cloud / hosting / cdn / isp / enterprise. |
reputation_flag | VARCHAR | Coarse infrastructure-risk indicator: clean / watch / risky. An indicator only, not a calibrated score. |
snapshot_date | DATE | Date the row was produced (daily refresh). |
The START_IP_INT / END_IP_INT range-bound naming matches the MaxMind and IPinfo convention, so this drops into join code you already have.
Join guide
Every row covers a contiguous range of addresses, bounded by two integers. Convert your IP to an integer once, then range-join. This is the whole integration.
Enrich your events with ASN and infrastructure type
The integer range join. Bound comparisons on both sides let the optimizer prune, which a BETWEEN scan over dotted strings cannot.
SELECT e.*, d.asn, d.asn_name, d.asn_type, d.reputation_flag
FROM your_events e
JOIN DATAZAG_IP_ASN d
ON e.ip_int >= d.ip_start_int AND e.ip_int <= d.ip_end_int;Convert a dotted IPv4 address to the integer join key
Run this once over your side of the join and store the result. Do not compute it per query.
SELECT ip,
(SPLIT_PART(ip,'.',1)*16777216 + SPLIT_PART(ip,'.',2)*65536
+ SPLIT_PART(ip,'.',3)*256 + SPLIT_PART(ip,'.',4)) AS ip_int
FROM your_ips;The four terms are the octets weighted by 256^3, 256^2, 256, and 1 — the standard unsigned 32-bit representation.
Methodology & caveats
How asn_type is derived
asn_type comes from authoritative provider ranges plus Datazag classification. Large named providers are individually attributed; the long tail is bucketed by type.
CDN caveat
For CDN-fronted ranges, the classification reflects the internet-facing provider, which may differ from the origin host. An address classified as cdn tells you who serves the traffic, not who runs the application behind it.
reputation_flag is a signpost, not a score
Three states — clean, watch, risky — deliberately coarse. It tells you where to look. It is not calibrated, carries no confidence value, and should not be thresholded as if it were a score. Full reason-coded ASN and prefix reputation (routing hygiene, abuse density, confidence) is in the paid ASN Reputation dataset.
Changelog
Initial release. IPv4 coverage with prefix, ASN, operator, country, asn_type classification, and reputation_flag. Daily refresh.