How well does this network actually reach the internet?
Profile a network or address block into a full routing and reachability health card.
No credit card needed.
What it solves
Network engineers assessing a network’s resilience usually need to check announcements, peering, RPKI coverage and facility presence separately, and a network that looks fine on one of those axes can still have a single point of failure on another. A health card that reconciles all of them at once is what a BGP looking glass alone doesn’t give you.
It reads the network’s BGP status and any MOAS conflicts on its announced prefixes, checks RIR allocation and RPKI ROA coverage, maps its peering and AS-SET membership through IRR records, and finds the physical facilities and internet exchanges it connects through, rolling all of it into a reputation and identity profile.
Assessing a network’s routing health end to end usually means checking a looking glass, an RPKI validator and PeeringDB separately, with nothing tying the three reads together.
- a BGP looking glass
- an RPKI validator
- PeeringDB
- an IRR whois client
What this means
- Give it a network or address block and it reads what it announces, who it peers and buys transit from, and whether it leans on a single upstream.
- It returns a routing and reachability health card crossing the BGP, RPKI and physical layers, built for a one-look resilience read.
Dig deeper
Read the how-to
What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.
Open the documentationWhy teams run this
The job this flow does, the failure mode it removes, and the proof it produces.
Security leadersRelated flows
All use casesAnycast DNS-Root Sovereignty
Could a country still resolve names if it were isolated? This assesses a nation's DNS-root resilience — how many of the core root servers have a copy inside its borders, and who operates them — the sovereignty read for national-resilience and policy analysis.
BGP Hijack & Routing-Hygiene Audit
Routing security you can act on. This grades a network on the conflicts and gaps that make route hijacking possible, then traces any conflict to the specific domains and organisations exposed on the affected blocks. An adversarial audit — not just a profile — for finding where a hijack could hurt and who it would hit.
Threat Investigation
The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'
Indicator Enrichment
Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.
Digital Infrastructure Mapping
Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner — even behind privacy WHOIS and CDNs — via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned.