103.239.0.0/22

This prefix's full card — announcers, RPKI/anycast status and MOAS conflicts.

MATCH (ap:ANNOUNCED_PREFIX {name: $cidr})
OPTIONAL MATCH (a:ASN)-[:ROUTES]->(ap) WHERE a.name IS NOT NULL
OPTIONAL MATCH (a)-[:HAS_NAME]->(an:ASN_NAME)
OPTIONAL MATCH (ap)-[:HAS_COUNTRY]->(c:COUNTRY)
WITH ap, a, an, c
LIMIT 20
WITH ap,
     collect({asn: a.name, network: an.name}) AS announcers,
     collect(a.name) AS announcerNames,
     collect(c.name) AS countries,
     head(collect(a)) AS primaryAsn
OPTIONAL MATCH (ap)-[:CONFLICTS_WITH]->(other:ASN) WHERE other.name IS NOT NULL
OPTIONAL MATCH (other)-[:HAS_NAME]->(othern:ASN_NAME)
OPTIONAL MATCH (other)-[:HAS_COUNTRY]->(otherc:COUNTRY)
WITH ap, announcers, announcerNames, countries, primaryAsn,
     collect({asn: other.name, operator: othern.name, country: otherc.name})[0..50] AS conflicts
CALL { WITH primaryAsn MATCH (primaryAsn)-[:ROUTES]->(p:ANNOUNCED_PREFIX) RETURN count(p) AS asnPrefixCount }
CALL { WITH primaryAsn MATCH (primaryAsn)-[:BGP_NEIGHBOR]-(peer:ASN) RETURN count(peer) AS asnPeerCount }
RETURN ap.name AS name,
       ap.isMoas AS isMoas,
       ap.rpkiStatus AS rpkiStatus,
       ap.isAnycast AS isAnycast,
       ap.dominantCity AS dominantCity,
       ap.roaAsn AS roaAsn,
       ap.roaMaxLength AS roaMaxLength,
       ap.prefixLength AS prefixLength,
       ap.rpkiInvalidReason AS rpkiInvalidReason,
       ap.martianReason AS martianReason,
       ap.abuseEmail AS abuseEmail,
       ap.spamhausDrop AS spamhausDrop,
       ap.isWithdrawn AS isWithdrawn,
       ap.rir AS rir,
       ap.registrationDate AS registrationDate,
       announcers, announcerNames, countries, conflicts,
       asnPrefixCount, asnPeerCount

The covering block's curated signals, cloud region and SaaS vendor.

MATCH (p:PREFIX {name: $cidr})
OPTIONAL MATCH (p)-[:HAS_SIGNAL]->(t:THREAT_SIGNAL_TYPE)
OPTIONAL MATCH (p)-[:PREFIX_IN_REGION]->(reg:CLOUD_REGION)
OPTIONAL MATCH (p)-[:DELEGATED_TO]->(v:VENDOR)
RETURN collect(DISTINCT t.name) AS signals,
       collect(DISTINCT reg.name) AS regions,
       collect(DISTINCT v.name) AS vendors

Sample addresses, by name prefix of the block's octet-aligned supernet.

  MATCH (ip:IPV4) WHERE ip.name STARTS WITH "103.239."
  RETURN ip.name AS ip
  LIMIT 25