sugra.blog

Blogfoundation

Sugra NetAtlas

First-party network intelligence: IP, ASN, BGP, RPKI, Tor, and privacy signals from primary internet sources.

Arman Obosyan - Founder and CEO of Sugra Systems
Founder & CEO

Arman Obosyan

Published
  • #netatlas
  • #network
  • #api
ShareXLinkedInFacebookTelegramRedditEmailCopy linkMarkdown
Sugra NetAtlas - Sugra API blog

Sugra NetAtlas: first-party network intelligence (IP, ASN, BGP, RPKI, Tor)

Series: Sugra product directions (4 of 7)
Audience: developers integrating the Sugra API over HTTP
Live samples verified: 2026-07-24 against https://sugra.ai
Auth: x-api-key header on every data call
Base namespace: https://sugra.ai/api/v1/network

Standalone article. NetAtlas is internet-infrastructure intelligence Sugra builds from primary sources - not a resold commercial geo database.

Essence

Network intelligence Sugra builds itself - IP, ASN, BGP, RPKI, Tor - a daily atlas from primary sources, not resold.

Sugra ingests RIR delegated stats, route collectors, RPKI ROAs, Tor directory data, Certificate Transparency, IODA outages, RIPE Atlas, operator geofeeds, and related Tier S / A feeds, then serves a queryable atlas (daily rebuild) plus live sub-APIs.

65 endpoints under the Sugra NetAtlas OpenAPI tag (portal catalog).

What this direction is not

Not this Why
Commercial city-level geo precision product Geo is honest about accuracy; often country-focused provenance
Person-level tracking Infrastructure and resource intelligence
Crypto chain analytics Sugra Finance / crypto surfaces
Airports and aviation weather Sugra Earth (/api/v2/transport/...)
Sanctions person screening Sugra Entity

Capability map

Module Endpoints (approx.) What it covers
IP intelligence 6 /ip/{ip} overview, asn, geo, privacy, abuse, rdns
ASN 11 holder, peers, prefixes, routing, whois, abuse, RPKI posture
Prefix and routing 7 overview, RPKI, history, more/less-specifics
Hijacks 3 recent, by ASN, by prefix
Registry graph 6 whois objects, orgs, maintainers, abuse, geofeeds
Domains 3 DNS, whois, RDAP
TLS / CT 5 search, subdomains, issuers, revoked, history
Outages 4 IODA alerts and entities
Tor 8 summary, details, bandwidth, clients, flags
RIPE Atlas 8 probes, anchors, measurements
Bulk / search 3 free-text search, POST /bulk/ip, POST /bulk/asn
Provenance 1 /sources/coverage

Critical envelope difference

Most Sugra directions return:

{ "data": { ... }, "meta": { ... } }

NetAtlas composed lookups often return the payload at the top level with an inline _meta block:

{
  "ip": "1.1.1.1",
  "privacy": { ... },
  "_meta": {
    "product": "Sugra NetAtlas",
    "atlas_built_at": "2026-07-24T04:10:09.092483Z",
    "confidence": "high",
    "sources": ["RIR delegated", "RouteViews", "Geofeeds", "..."]
  }
}

Clients must branch on shape. Cookbook 06_network_ip_intelligence.py documents this.

Why the response shape is useful

1. Privacy composite ready for fraud

Live 1.1.1.1 privacy:

"privacy": {
  "is_tor": false,
  "is_vpn_asn": false,
  "is_hosting": true,
  "is_anycast": true,
  "is_mobile": false,
  "risk_score": 10,
  "confidence": "high"
}

2. Full IP overview in one call

Live /network/ip/1.1.1.1 included country, city (with low geo confidence), ASN Cloudflare 13335, prefix 1.1.1.0/24, rdns one.one.one.one, abuse abuse@cloudflare.com, and privacy block.

3. RPKI authorization in one call

Live: GET /network/prefix/1.1.1.0/24/rpki?asn=13335 -> status: valid.

4. Provenance on every lookup

_meta.sources, atlas_built_at, confidence, sometimes partial and geo_confidence.

5. Zero Tier C commercial vendors

RIR, RouteViews, RIPEstat, RPKI, Tor Metrics, IODA, geofeeds, GeoNames, open IP lists - all named.

Developer path

export SUGRA_API_KEY="YOUR_API_KEY"
BASE="https://sugra.ai/api/v1/network"

curl -H "x-api-key: $SUGRA_API_KEY" "$BASE/ip/1.1.1.1/privacy"
curl -H "x-api-key: $SUGRA_API_KEY" "$BASE/prefix/1.1.1.0/24/rpki?asn=13335"
import os, requests
H = {"x-api-key": os.environ["SUGRA_API_KEY"]}
BASE = "https://sugra.ai/api/v1/network"
ip = requests.get(f"{BASE}/ip/1.1.1.1", headers=H, timeout=30).json()
privacy = ip.get("privacy") or ip  # tolerate nested vs dedicated route
meta = ip.get("_meta", {})

Use case 1: Signup and login enrichment

Goal. Score or tag registrations by IP risk class.

Calls. /ip/{ip}/privacy, /ip/{ip}/abuse, optionally full /ip/{ip}.

Strength. Hosting / Tor / VPN / anycast flags + abuse contact.
Pitfalls. risk_score is a signal, not a ban decision. Anycast DNS resolvers look “hosting.”

Use case 2: Bulk traffic triage

Goal. Enrich up to 100 addresses per request.

Call. POST /bulk/ip (and /bulk/asn).

Strength. High-volume path without N serial lookups.
Pitfalls. Max batch size; respect daily quota.

Use case 3: ASN ownership desk

Goal. Who runs AS13335, what they announce, peers.

Calls. /asn/13335, /asn/13335/prefixes, /asn/13335/peers, /asn/13335/routing.

Strength. Holder + announcement surface for netops and research.
Pitfalls. Peering views depend on collector visibility.

Use case 4: RPKI hygiene

Goal. Is this prefix-origin pair authorized?

Call. /prefix/{cidr}/rpki?asn={asn}.

Live. 1.1.1.0/24 + AS13335 -> valid.
Pitfalls. Invalid is a routing security signal, not proof of malice alone.

Use case 5: Hijack watch

Goal. Watch your ASN or prefixes for suspected origin changes.

Calls. /hijack/recent, /hijack/asn/{asn}, prefix hijack routes.

Strength. RouteViews-diff style monitoring without running collectors.
Pitfalls. Suspected, not courtroom proof; false positives exist.

Use case 6: Outage awareness

Goal. Country or ASN connectivity alerts.

Call. /outage/alerts (IODA-backed).

Strength. Ops context for “is the internet degraded there?”
Pitfalls. Not a substitute for your own synthetic monitoring.

Use case 7: Attack surface via CT

Goal. Enumerate certificates and subdomains for a domain.

Calls. /cert/search?domain=, /cert/subdomains, /cert/issuers, /cert/revoked, /cert/history.

Live. domain=sugra.ai returned certificate rows with issuer and validity windows.
Pitfalls. CT is public log data; pagination/cursors matter.

Use case 8: Tor and anonymity path

Goal. Research or fraud checks for Tor exits/relays.

Calls. /tor/summary, /tor/details, /tor/search, combine with /ip/{ip}/privacy (is_tor).

Strength. Live Tor Metrics surface + privacy flag.
Pitfalls. Tor use is not inherently abuse; policy is yours.

Use case 9: Domain DNS / WHOIS / RDAP

Goal. Resolve registration and DNS facts in one namespace.

Calls. /domain/{host}/dns, /whois, /rdap.

Strength. Single product surface for recon.
Pitfalls. WHOIS redaction and rate limits vary by registry.

Antipatterns

  1. Assuming standard data/meta envelope without checking _meta
  2. Treating city geo as high-precision tracking
  3. Using privacy risk_score as a legal determination
  4. Ignoring atlas_built_at staleness for critical decisions

Scenarios where NetAtlas alone is enough

  • Fraud / abuse IP enrichment
  • Netops RPKI and hijack monitors
  • Security research on CT and ASN graphs
  • Tor directory analytics

Live verification (2026-07-24)

Call Result
/ip/1.1.1.1 (+ privacy, asn) 200
/asn/13335 200
/prefix/1.1.1.0/24/rpki?asn=13335 200, valid
hijack recent, outage alerts, tor summary 200
cert search sugra.ai 200

Where to go next

  • Portal: Sugra NetAtlas direction + sources
  • Cookbook: 06_network_ip_intelligence.py
  • Series: Entity (previous), News (next)
# Direction Status
1-3 Finance, Macro, Entity Published
4 NetAtlas This article
5 News Next
6-7 Earth, Research Upcoming

Integrate with one key across every product direction.

Get API keyDocsFamily