Miner for google ASN

[igarcia]

Hello all,

Has anybody created or know a way to mine the IPs published by a ASN, f.i. Google ASN?'

BR,

[xhoms]

Hi @igarcia,

some companies like https://ipinfo.io/pricing provide subscriptions plans to extract IP data programmatically using a lot of different search criterias being the AS number of of them. Their API is compatible with the MineMeld SimpleJSON class so only a single prototype would be needed for paid accounts.

If you're looking for a free way to get that information then you could create a HttpFT class prototype to parse the content of the pages they generate when you call their https://ipinfo.io/AS<xxxxx> entry point. This method is not as reliable as the paid one because any change in the page layout might crash the HTML parsing process.

The following pair of HttpFT class prototypes (one for IPv4 / one for IPv6) are successfully extracting the Google prefixes (AS15169) as of now in my lab.

For IPv4 prefixes:

age_out:
    default: null
    interval: 3600
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator:
    regex: AS15169\/(([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2})
    transform: \1
interval: 3600
source_name: google.ipv4
url: https://ipinfo.io/AS15169

For IPv6 prefixes:

age_out:
    default: null
    interval: 3600
    sudden_death: true
attributes:
    confidence: 100
    share_level: green
    type: IPv4
indicator:
    regex: AS15169\/([0-9a-f]{1,4}:[0-9a-f:]+\/[0-9]{1,3})
    transform: \1
interval: 3600
source_name: google.ipv4
url: https://ipinfo.io/AS15169

[SOCGC]

Hi @xhoms

Your method worked perfectly.

we have a paid subscription with ipinfo.io, but without API,  we tried to do the same as the "free" option but it seems to not be working. I think we have problems adding the personal token to the entry point.

can you help us out?

Regards

[xhoms]

Hi @SOCGC,

let me know how could I help you.