---
title: "Sugra NetAtlas"
description: "First-party network intelligence: IP, ASN, BGP, RPKI, Tor, and privacy signals from primary internet sources."
slug: sugra-netatlas
status: published
published_at: 2026-06-09
author: Arman Obosyan
author_url: https://sugra.systems/about
section: foundation
series_order: 4
primary_keyword: sugra netatlas network api
hero_image: /blog/images/posts/sugra-netatlas-hero.jpg
hero_alt: "Sugra NetAtlas - Sugra API blog"
og_image: /blog/images/posts/sugra-netatlas-hero.jpg
tags:
  - netatlas
  - network
  - api
---

# Sugra NetAtlas: first-party network intelligence (IP, ASN, BGP, RPKI, Tor)

**Series:** Sugra product directions (4 of 7)  
**Audience:** developers integrating the Sugra API over HTTP  
**Live samples verified:** 2026-07-24 against `https://sugra.ai`  
**Auth:** `x-api-key` header on every data call  
**Base namespace:** `https://sugra.ai/api/v1/network`

Standalone article. NetAtlas is internet-infrastructure intelligence Sugra builds from primary sources - not a resold commercial geo database.

---

## Essence

> Network intelligence Sugra builds itself - IP, ASN, BGP, RPKI, Tor - a daily atlas from primary sources, not resold.

Sugra ingests RIR delegated stats, route collectors, RPKI ROAs, Tor directory data, Certificate Transparency, IODA outages, RIPE Atlas, operator geofeeds, and related Tier S / A feeds, then serves a queryable atlas (daily rebuild) plus live sub-APIs.

**65 endpoints** under the `Sugra NetAtlas` OpenAPI tag (portal catalog).

---

## What this direction is not

| Not this | Why |
|---|---|
| Commercial city-level geo precision product | Geo is honest about accuracy; often country-focused provenance |
| Person-level tracking | Infrastructure and resource intelligence |
| Crypto chain analytics | **Sugra Finance** / crypto surfaces |
| Airports and aviation weather | **Sugra Earth** (`/api/v2/transport/...`) |
| Sanctions person screening | **Sugra Entity** |

---

## Capability map

| Module | Endpoints (approx.) | What it covers |
|---|---|---|
| IP intelligence | 6 | `/ip/{ip}` overview, asn, geo, privacy, abuse, rdns |
| ASN | 11 | holder, peers, prefixes, routing, whois, abuse, RPKI posture |
| Prefix and routing | 7 | overview, RPKI, history, more/less-specifics |
| Hijacks | 3 | recent, by ASN, by prefix |
| Registry graph | 6 | whois objects, orgs, maintainers, abuse, geofeeds |
| Domains | 3 | DNS, whois, RDAP |
| TLS / CT | 5 | search, subdomains, issuers, revoked, history |
| Outages | 4 | IODA alerts and entities |
| Tor | 8 | summary, details, bandwidth, clients, flags |
| RIPE Atlas | 8 | probes, anchors, measurements |
| Bulk / search | 3 | free-text search, `POST /bulk/ip`, `POST /bulk/asn` |
| Provenance | 1 | `/sources/coverage` |

---

## Critical envelope difference

Most Sugra directions return:

```json
{ "data": { ... }, "meta": { ... } }
```

NetAtlas composed lookups often return the **payload at the top level** with an inline **`_meta`** block:

```json
{
  "ip": "1.1.1.1",
  "privacy": { ... },
  "_meta": {
    "product": "Sugra NetAtlas",
    "atlas_built_at": "2026-07-24T04:10:09.092483Z",
    "confidence": "high",
    "sources": ["RIR delegated", "RouteViews", "Geofeeds", "..."]
  }
}
```

Clients must branch on shape. Cookbook `06_network_ip_intelligence.py` documents this.

---

## Why the response shape is useful

### 1. Privacy composite ready for fraud

Live `1.1.1.1` privacy:

```json
"privacy": {
  "is_tor": false,
  "is_vpn_asn": false,
  "is_hosting": true,
  "is_anycast": true,
  "is_mobile": false,
  "risk_score": 10,
  "confidence": "high"
}
```

### 2. Full IP overview in one call

Live `/network/ip/1.1.1.1` included country, city (with low geo confidence), ASN Cloudflare 13335, prefix `1.1.1.0/24`, rdns `one.one.one.one`, abuse `abuse@cloudflare.com`, and privacy block.

### 3. RPKI authorization in one call

Live: `GET /network/prefix/1.1.1.0/24/rpki?asn=13335` -> **`status: valid`**.

### 4. Provenance on every lookup

`_meta.sources`, `atlas_built_at`, `confidence`, sometimes `partial` and `geo_confidence`.

### 5. Zero Tier C commercial vendors

RIR, RouteViews, RIPEstat, RPKI, Tor Metrics, IODA, geofeeds, GeoNames, open IP lists - all named.

---

## Developer path

```bash
export SUGRA_API_KEY="YOUR_API_KEY"
BASE="https://sugra.ai/api/v1/network"

curl -H "x-api-key: $SUGRA_API_KEY" "$BASE/ip/1.1.1.1/privacy"
curl -H "x-api-key: $SUGRA_API_KEY" "$BASE/prefix/1.1.1.0/24/rpki?asn=13335"
```

```python
import os, requests
H = {"x-api-key": os.environ["SUGRA_API_KEY"]}
BASE = "https://sugra.ai/api/v1/network"
ip = requests.get(f"{BASE}/ip/1.1.1.1", headers=H, timeout=30).json()
privacy = ip.get("privacy") or ip  # tolerate nested vs dedicated route
meta = ip.get("_meta", {})
```

---

## Use case 1: Signup and login enrichment

**Goal.** Score or tag registrations by IP risk class.

**Calls.** `/ip/{ip}/privacy`, `/ip/{ip}/abuse`, optionally full `/ip/{ip}`.

**Strength.** Hosting / Tor / VPN / anycast flags + abuse contact.  
**Pitfalls.** `risk_score` is a signal, not a ban decision. Anycast DNS resolvers look "hosting."

---

## Use case 2: Bulk traffic triage

**Goal.** Enrich up to 100 addresses per request.

**Call.** `POST /bulk/ip` (and `/bulk/asn`).

**Strength.** High-volume path without N serial lookups.  
**Pitfalls.** Max batch size; respect daily quota.

---

## Use case 3: ASN ownership desk

**Goal.** Who runs AS13335, what they announce, peers.

**Calls.** `/asn/13335`, `/asn/13335/prefixes`, `/asn/13335/peers`, `/asn/13335/routing`.

**Strength.** Holder + announcement surface for netops and research.  
**Pitfalls.** Peering views depend on collector visibility.

---

## Use case 4: RPKI hygiene

**Goal.** Is this prefix-origin pair authorized?

**Call.** `/prefix/{cidr}/rpki?asn={asn}`.

**Live.** `1.1.1.0/24` + AS13335 -> `valid`.  
**Pitfalls.** Invalid is a routing security signal, not proof of malice alone.

---

## Use case 5: Hijack watch

**Goal.** Watch your ASN or prefixes for suspected origin changes.

**Calls.** `/hijack/recent`, `/hijack/asn/{asn}`, prefix hijack routes.

**Strength.** RouteViews-diff style monitoring without running collectors.  
**Pitfalls.** Suspected, not courtroom proof; false positives exist.

---

## Use case 6: Outage awareness

**Goal.** Country or ASN connectivity alerts.

**Call.** `/outage/alerts` (IODA-backed).

**Strength.** Ops context for "is the internet degraded there?"  
**Pitfalls.** Not a substitute for your own synthetic monitoring.

---

## Use case 7: Attack surface via CT

**Goal.** Enumerate certificates and subdomains for a domain.

**Calls.** `/cert/search?domain=`, `/cert/subdomains`, `/cert/issuers`, `/cert/revoked`, `/cert/history`.

**Live.** `domain=sugra.ai` returned certificate rows with issuer and validity windows.  
**Pitfalls.** CT is public log data; pagination/cursors matter.

---

## Use case 8: Tor and anonymity path

**Goal.** Research or fraud checks for Tor exits/relays.

**Calls.** `/tor/summary`, `/tor/details`, `/tor/search`, combine with `/ip/{ip}/privacy` (`is_tor`).

**Strength.** Live Tor Metrics surface + privacy flag.  
**Pitfalls.** Tor use is not inherently abuse; policy is yours.

---

## Use case 9: Domain DNS / WHOIS / RDAP

**Goal.** Resolve registration and DNS facts in one namespace.

**Calls.** `/domain/{host}/dns`, `/whois`, `/rdap`.

**Strength.** Single product surface for recon.  
**Pitfalls.** WHOIS redaction and rate limits vary by registry.

---

## Antipatterns

1. Assuming standard `data`/`meta` envelope without checking `_meta`  
2. Treating city geo as high-precision tracking  
3. Using privacy `risk_score` as a legal determination  
4. Ignoring `atlas_built_at` staleness for critical decisions  

---

## Scenarios where NetAtlas alone is enough

- Fraud / abuse IP enrichment  
- Netops RPKI and hijack monitors  
- Security research on CT and ASN graphs  
- Tor directory analytics  

---

## Live verification (2026-07-24)

| Call | Result |
|---|---|
| `/ip/1.1.1.1` (+ privacy, asn) | 200 |
| `/asn/13335` | 200 |
| `/prefix/1.1.1.0/24/rpki?asn=13335` | 200, valid |
| hijack recent, outage alerts, tor summary | 200 |
| cert search sugra.ai | 200 |

---

## Where to go next

- Portal: Sugra NetAtlas direction + sources  
- Cookbook: `06_network_ip_intelligence.py`  
- Series: Entity (previous), News (next)

| # | Direction | Status |
|---|---|---|
| 1-3 | Finance, Macro, Entity | Published |
| 4 | **NetAtlas** | This article |
| 5 | News | Next |
| 6-7 | Earth, Research | Upcoming |

---