This first hit on a newly installed server will most likely come
from an address announced by DigitalOcean, AS14061 (I used whois
to get the AS number from an actual IP address).
How do we find the list of prefixes announced by an autonomous system? I mean only the prefixes that originate from the AS not
Ripe has a Data API to get that list (here).
curl --location --request GET "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS14061"
The output contains the list of prefixes as strings. Assuming that we are only interested in IPv4 prefixes, here is a short script returning the sorted list.
#! /usr/bin/env python
import json
import re
with open("as_output.txt") as f:
p = json.load(f)
ipv4_prefixes = []
pattern = re.compile("^(\d+)\.(\d+).(\d+).(\d+)\/(\d+)$")
for e in p["data"]["prefixes"]:
if matches := pattern.match(e["prefix"]):
ipv4_prefixes.append(matches.groups())
ipv4_sorted_prefixes = sorted(ipv4_prefixes,
key=lambda x: (int(x[0]), int(x[1]), int(x[2]), int(x[3])))
for e in ipv4_sorted_prefixes:
print(f"{e[0]}.{e[1]}.{e[2]}.{e[3]}/{e[4]}")
Can we make this list shorter by merging prefixes?