IP to ASN Intelligence
Map any IPv4 address to its network prefix, autonomous system, operator, and registry country. Integer range-bound join keys, refreshed daily.
Need it somewhere other than Snowflake? Ask us about other delivery modes.
- Coverage
- IPv4
- Refresh
- Daily
- ASNs profiled
- 79k
- Every ASN announcing routes in the BGP data we collect
- License
- Clean for redistribution
Overview
Maps any IPv4 address to its network prefix, the autonomous system (ASN) announcing it, and the operator of that network. Each range also carries the country the registry records for its address block, and a coarse reputation band.
Ships with integer range-bound join keys, so the lookup is an ordinary range join in your warehouse — no UDFs, no external calls, no per-row API cost.
Natively built by Datazag. License-clean for redistribution, and refreshed daily.
Coverage is IPv4. Every ASN announcing routes in the BGP data we collect is profiled — 79k of them. It is not a sample, so a lookup that returns nothing usually means the address is not announced, not that we skipped the network.
Datazag tracks 362.4M live domains across those networks; this dataset is the IP-to-ASN layer of that corpus.
Schema reference
Table: ip_prefix_asn
| Column | Type | Description |
|---|---|---|
ip_start_intJoin key | BIGINT | First address of the range as an unsigned 32-bit integer. The range includes both endpoints. |
ip_end_intJoin key | BIGINT | Last address of the range as an unsigned 32-bit integer, inclusive. |
asn | BIGINT | Autonomous System Number announcing this range. |
prefix | VARCHAR | The range in CIDR notation, for example 98.125.248.0/22. |
isp | VARCHAR | Name of the organization operating the autonomous system. NULL where the registry publishes only an opaque handle, not a usable name. |
country | VARCHAR | ISO 3166-1 alpha-2 country the Regional Internet Registry records for the address block containing this range, where the block's holder is registered. Where that block carries no country, the announcing autonomous system's registry country is used. Not a geolocation of the addresses, and it can differ between ranges announced by the same autonomous system. RIPE NCC records a few EU-wide blocks as EU. |
reputation_flag | VARCHAR | Coarse reputation band: clean, watch, or risky. A teaser indicator, not a calibrated score. Large shared networks such as cloud, CDN, and hosting providers are assessed on abuse observed on the specific range rather than flagged wholesale. NULL where not assessed — absence is never reported as clean. |
ipv4_only | BOOLEAN | Always true. This dataset covers IPv4 ranges only. |
snapshot_date | DATE | The date this row was built. Every row in a release carries the same date, so you can pin to a snapshot. |
tier | VARCHAR | Distribution tier. Always free in this dataset. |
data_completeness | VARCHAR | Per-row JSON recording, for each optional signal, whether it was observed or not observed for this range. |
The ip_start_int / ip_end_int range-bound naming matches the MaxMind and IPinfo convention, so this drops into join code you already have. On Snowflake the share holds this one table in a schema called free, so qualify it as your_database.free.ip_prefix_asn or set your context first. The three integer columns arrive there as NUMBER(19,0) and the text columns as VARCHAR.
Join guide
Every row covers a contiguous range of addresses, bounded by two integers. Convert your IP to an integer once, then range-join. Announced prefixes can nest — a smaller prefix inside a larger one — so one address can match more than one row. Use the second query when you want exactly one row per address.
Enrich your events with ASN, operator, and reputation
The integer range join. Bound comparisons on both sides let the optimizer prune, which a BETWEEN scan over dotted strings cannot. Returns every range that contains the address.
SELECT e.*, d.prefix, d.asn, d.isp, d.country, d.reputation_flag
FROM your_events e
JOIN ip_prefix_asn d
ON e.ip_int >= d.ip_start_int AND e.ip_int <= d.ip_end_int;One row per address: the most specific prefix wins
Where prefixes nest, keep the narrowest range, which is the most specific route for that address.
SELECT e.*, d.prefix, d.asn, d.isp, d.country, d.reputation_flag
FROM your_events e
JOIN ip_prefix_asn d
ON e.ip_int >= d.ip_start_int AND e.ip_int <= d.ip_end_int
QUALIFY ROW_NUMBER() OVER (
PARTITION BY e.ip_int
ORDER BY d.ip_end_int - d.ip_start_int
) = 1;QUALIFY works in Snowflake and Databricks SQL. Elsewhere, wrap the join in a subquery and filter on the row number.
Convert a dotted IPv4 address to the integer join key
Run this once over your side of the join and store the result. Do not compute it per query.
SELECT ip,
(SPLIT_PART(ip,'.',1)*16777216 + SPLIT_PART(ip,'.',2)*65536
+ SPLIT_PART(ip,'.',3)*256 + SPLIT_PART(ip,'.',4)) AS ip_int
FROM your_ips;The four terms are the octets weighted by 256^3, 256^2, 256, and 1 — the standard unsigned 32-bit representation.
Methodology & caveats
How isp is chosen
isp is the operator name published for the network. Where the routing data holds only a placeholder such as AS followed by a number, we fall back to the registry record. Where neither holds a usable name, isp is NULL rather than a placeholder.
country is the registry country of the address block
country is the country the Regional Internet Registry records for the address block that contains the range: where the block's holder is registered. One autonomous system can announce blocks registered in several countries, so country can differ between its ranges. It is not the location of the addresses. Do not use it as IP geolocation.
reputation_flag is a signpost, not a score
Three states — clean, watch, risky — deliberately coarse. It tells you where to look. It is not calibrated, carries no confidence value, and should not be thresholded as if it were a score. Large shared networks such as cloud, CDN, and hosting providers are judged on abuse observed on the specific range, so a major provider is not flagged wholesale for abuse elsewhere on its network. A NULL means the range or network has not been assessed; it does not mean clean.
Changelog
country is now described as the registry country of each range's address block, which can differ between ranges of the same autonomous system. It was previously described as the autonomous system's registration country, which was inaccurate. isp no longer carries bare AS-number handles; where no usable name exists it is NULL.
reputation_flag no longer flags large shared networks wholesale: cloud, CDN, and hosting providers are assessed on abuse observed on the specific range. Smaller networks are still assessed as a whole.
Available on Snowflake Marketplace as a free listing.
Documentation corrected to the shipped schema. Removed asn_name, asn_org, and asn_type, which the dataset does not include; the operator name is in isp. Added ipv4_only, tier, and data_completeness, and a join for nested prefixes.
Initial release. IPv4 coverage with prefix, ASN, operator name, registration country, and reputation_flag. Daily refresh.