chore: 更新多个 ASN 的 IPv6 前缀

.github/workflows/build.yml

@@ -3,11 +3,18 @@ name: 创建IPv6检测的前缀
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 0 * * 0'
+    - cron: '0 0 * * *'
+
+concurrency:
+  group: backtrace-ipv6-prefix-sync
+  cancel-in-progress: false
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions:
+  contents: write
+
 jobs:
   fetch-ipv6-prefixes:
     runs-on: ubuntu-latest
@@ -17,32 +24,20 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: 设置 Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
       - name: 获取并处理多个ASN的IPv6前缀
         run: |
-          mkdir -p bk/prefix/
-          for asn in AS4809 AS4134 AS9929 AS4837 AS58807 AS9808 AS58453 AS23764; do
-            echo "处理 $asn..."
-            curl -s -A "Mozilla/5.0" \
-                 "https://bgp.he.net/$asn" > "${asn}.html"
-            grep -oE '[0-9a-f:]+::/[0-9]+' "${asn}.html" | sort -u > tmp_prefixes.txt
-            {
-              while read prefix; do
-                ip_part=$(echo "$prefix" | cut -d/ -f1)
-                prefix_len=$(echo "$prefix" | cut -d/ -f2)
-                keep_segments=$((prefix_len / 16))
-                segments=$(echo "$ip_part" | tr ':' '\n' | grep -v '^$')
-                kept=$(echo "$segments" | head -n "$keep_segments" | tr '\n' ':' | sed 's/:$//')
-                echo "$kept"
-              done < tmp_prefixes.txt
-            } | sort -u > "bk/prefix/${asn,,}.txt"
-            rm -f "${asn}.html" tmp_prefixes.txt
-          done
+          go run ./cmd/update-prefixes -output-dir bk/prefix
 
       - name: 提交更新到仓库
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add bk/prefix/*.txt
+          git add bk/prefix/*.txt bk/prefix/*.txt.manifest.json
           if git diff --cached --quiet; then
             echo "无变更，跳过提交。"
           else

.github/workflows/ci.yaml

@@ -34,7 +34,7 @@ jobs:
         run: |
           git config --global user.name 'github-actions'
           git config --global user.email 'github-actions@github.com'
-          TAG="v0.0.10-$(date +'%Y%m%d%H%M%S')"
+          TAG="v0.0.11-$(date +'%Y%m%d%H%M%S')"
           git tag $TAG
           git push origin $TAG
           echo "TAG=$TAG" >> $GITHUB_ENV

.github/workflows/sync-asn-metadata.yml

@@ -0,0 +1,51 @@
+name: Sync ASN metadata
+
+on:
+  schedule:
+    - cron: "29 3 * * *"
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/sync-asn-metadata.yml"
+      - "cmd/update-asn-metadata/**"
+      - "bgptools/data/**"
+      - "bgptools/asn_metadata.go"
+      - "bgptools/asn_metadata_test.go"
+      - "model/model.go"
+      - "go.mod"
+      - "go.sum"
+
+concurrency:
+  group: backtrace-asn-metadata-sync
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Update snapshot
+        run: go run ./cmd/update-asn-metadata
+      - name: Validate updater and runtime loader
+        run: go test -race ./cmd/update-asn-metadata ./bgptools
+      - name: Vet updater and runtime loader
+        run: go vet ./cmd/update-asn-metadata ./bgptools
+      - name: Commit semantic changes
+        run: |
+          if git diff --quiet -- bgptools/data/bgp-asn-map.json bgptools/data/bgp-asn-map.manifest.json; then
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add bgptools/data/bgp-asn-map.json bgptools/data/bgp-asn-map.manifest.json
+          git commit -m "chore(data): update ASN metadata"
+          git push

back/generate.go

@@ -1,30 +1,72 @@
 package backtrace
 
 import (
+	"errors"
+	"fmt"
 	"net"
 )
 
-// GeneratePrefixList 生成指定前缀的IP地址列表
+const defaultPrefixListLimit = 1 << 16
+
+var (
+	ErrInvalidPrefix         = errors.New("invalid IPv4 prefix")
+	ErrIPv6PrefixUnsupported = errors.New("IPv6 prefix generation is unsupported")
+	ErrPrefixListTooLarge    = errors.New("prefix list exceeds limit")
+)
+
+// GeneratePrefixList generates the legacy list of /24 address prefixes.  The
+// old API cannot return an error, so invalid, IPv6, and over-sized inputs
+// return nil.  Callers that need to distinguish these cases should use
+// GeneratePrefixListWithLimit.
 func GeneratePrefixList(prefix string) []string {
-	// 解析CIDR表示法的IP地址
-	_, ipNet, err := net.ParseCIDR(prefix)
+	result, err := GeneratePrefixListWithLimit(prefix, defaultPrefixListLimit)
 	if err != nil {
 		return nil
 	}
-	// 获取IP地址的32位整数表示
-	ip := ipNet.IP.To4()
-	start := binaryIPToInt(ip)
-	maskSize, _ := ipNet.Mask.Size()
-	end := start | (1<<(32-maskSize) - 1)
-	// 生成IP地址列表
-	var prefixList []string
-	for i := start; i <= end; i++ {
-		if (i-start)%256 == 0 {
-			tempText := intToBinaryIP(i).String()
-			prefixList = append(prefixList, tempText[:len(tempText)-2])
-		}
+	return result
+}
+
+// GeneratePrefixListWithLimit generates one entry for every /24-sized block
+// covered by an IPv4 CIDR.  Prefixes narrower than /24 are rejected once the
+// number of blocks exceeds maxEntries; this keeps /0 and similarly broad
+// input from allocating or iterating unbounded data.  A prefix longer than
+// /24 still produces the containing block, preserving the legacy behaviour.
+func GeneratePrefixListWithLimit(prefix string, maxEntries int) ([]string, error) {
+	if maxEntries <= 0 {
+		maxEntries = defaultPrefixListLimit
 	}
-	return prefixList
+	_, ipNet, err := net.ParseCIDR(prefix)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %q", ErrInvalidPrefix, prefix)
+	}
+	maskSize, bits := ipNet.Mask.Size()
+	if bits == 128 {
+		return nil, fmt.Errorf("%w: %q", ErrIPv6PrefixUnsupported, prefix)
+	}
+	if bits != 32 || maskSize < 0 || maskSize > 32 || ipNet.IP.To4() == nil {
+		return nil, fmt.Errorf("%w: %q", ErrInvalidPrefix, prefix)
+	}
+
+	// A /24 block is the output unit used by the original implementation.  A
+	// /25-/32 prefix therefore has one containing block, while a /0 would need
+	// 2^24 entries and is rejected before allocation.
+	blocks := uint64(1)
+	if maskSize < 24 {
+		blocks = uint64(1) << uint(24-maskSize)
+	}
+	if blocks > uint64(maxEntries) {
+		return nil, fmt.Errorf("%w: %d entries (limit %d)", ErrPrefixListTooLarge, blocks, maxEntries)
+	}
+
+	start := binaryIPToInt(ipNet.IP.To4()) &^ uint32(255)
+	result := make([]string, 0, int(blocks))
+	for index := uint64(0); index < blocks; index++ {
+		// The arithmetic is bounded by 2^24 blocks, so this multiplication and
+		// addition cannot overflow uint32 for a valid IPv4 network.
+		value := start + uint32(index*256)
+		result = append(result, fmt.Sprintf("%d.%d.%d", byte(value>>24), byte(value>>16), byte(value>>8)))
+	}
+	return result, nil
 }
 
 // 将IP地址转换为32位整数

back/generate_test.go

@@ -0,0 +1,57 @@
+package backtrace
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+)
+
+func TestGeneratePrefixListCompatibility(t *testing.T) {
+	got := GeneratePrefixList("192.0.2.0/23")
+	want := []string{"192.0.2", "192.0.3"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("GeneratePrefixList() = %v, want %v", got, want)
+	}
+
+	got = GeneratePrefixList("192.0.2.128/25")
+	want = []string{"192.0.2"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("GeneratePrefixList(/25) = %v, want %v", got, want)
+	}
+}
+
+func TestGeneratePrefixListRejectsUnsafeInputs(t *testing.T) {
+	tests := []struct {
+		name   string
+		prefix string
+		want   error
+	}{
+		{name: "empty", prefix: "", want: ErrInvalidPrefix},
+		{name: "invalid", prefix: "not-a-prefix", want: ErrInvalidPrefix},
+		{name: "IPv6", prefix: "2001:db8::/32", want: ErrIPv6PrefixUnsupported},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := GeneratePrefixList(test.prefix); got != nil {
+				t.Fatalf("legacy API returned %v, want nil", got)
+			}
+			if _, err := GeneratePrefixListWithLimit(test.prefix, 16); !errors.Is(err, test.want) {
+				t.Fatalf("GeneratePrefixListWithLimit() error = %v, want %v", err, test.want)
+			}
+		})
+	}
+}
+
+func TestGeneratePrefixListLimitsBroadPrefixesBeforeAllocation(t *testing.T) {
+	if _, err := GeneratePrefixListWithLimit("0.0.0.0/0", 1024); !errors.Is(err, ErrPrefixListTooLarge) {
+		t.Fatalf("GeneratePrefixListWithLimit(/0) error = %v, want %v", err, ErrPrefixListTooLarge)
+	}
+
+	got, err := GeneratePrefixListWithLimit("10.0.0.0/16", 256)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 256 || got[0] != "10.0.0" || got[255] != "10.0.255" {
+		t.Fatalf("unexpected bounded result: len=%d first=%q last=%q", len(got), got[0], got[len(got)-1])
+	}
+}

bgptools/asn_metadata.go

@@ -0,0 +1,229 @@
+package bgptools
+
+import (
+	"context"
+	"crypto/sha256"
+	_ "embed"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const (
+	ASNMetadataSchema         = "backtrace.asn-metadata/v1"
+	ASNMetadataManifestSchema = "backtrace.asn-metadata-manifest/v1"
+	ASNMetadataMinimum        = 50
+)
+
+var asnMetadataSnapshotURLs = []string{
+	"https://cdn.spiritlhl.net/https://raw.githubusercontent.com/oneclickvirt/backtrace/main/bgptools/data/bgp-asn-map.json",
+	"https://raw.githubusercontent.com/oneclickvirt/backtrace/main/bgptools/data/bgp-asn-map.json",
+}
+
+//go:embed data/bgp-asn-map.json
+var embeddedASNMetadata []byte
+
+//go:embed data/bgp-asn-map.manifest.json
+var embeddedASNMetadataManifest []byte
+
+type ASNMetadata struct {
+	ASN  uint32 `json:"asn"`
+	Name string `json:"name"`
+}
+
+type ASNMetadataSource struct {
+	Schema      string    `json:"schema"`
+	Count       int       `json:"count"`
+	GeneratedAt time.Time `json:"generated_at,omitempty"`
+	Source      string    `json:"source"`
+	Fallback    bool      `json:"fallback"`
+}
+
+type asnMetadataDocument struct {
+	Schema      string        `json:"schema"`
+	GeneratedAt time.Time     `json:"generated_at"`
+	Entries     []ASNMetadata `json:"entries"`
+}
+
+type asnMetadataManifest struct {
+	Schema      string    `json:"schema"`
+	File        string    `json:"file"`
+	Count       int       `json:"count"`
+	SHA256      string    `json:"sha256"`
+	GeneratedAt time.Time `json:"generated_at"`
+}
+
+// LoadASNMetadata prefers the component's validated remote snapshot and
+// falls back to the compile-time snapshot. Upstream registry URLs and parsing
+// rules are intentionally not exposed to callers.
+func LoadASNMetadata(ctx context.Context, client *http.Client) ([]ASNMetadata, ASNMetadataSource, error) {
+	return loadASNMetadata(ctx, client, asnMetadataSnapshotURLs, embeddedASNMetadata, embeddedASNMetadataManifest, ASNMetadataMinimum)
+}
+
+// EmbeddedASNMetadata returns the validated compile-time snapshot without
+// performing network access.
+func EmbeddedASNMetadata() ([]ASNMetadata, ASNMetadataSource, error) {
+	entries, generatedAt, err := parseASNMetadataDocument(embeddedASNMetadata, ASNMetadataMinimum)
+	if err != nil {
+		return nil, ASNMetadataSource{}, err
+	}
+	if err := validateASNMetadataManifest(embeddedASNMetadataManifest, embeddedASNMetadata, len(entries), generatedAt); err != nil {
+		return nil, ASNMetadataSource{}, fmt.Errorf("validate embedded ASN metadata manifest: %w", err)
+	}
+	return entries, ASNMetadataSource{Schema: ASNMetadataSchema, Count: len(entries), GeneratedAt: generatedAt, Source: "embedded", Fallback: true}, nil
+}
+
+// LookupASNMetadata resolves one ASN from the current component registry.
+func LookupASNMetadata(ctx context.Context, client *http.Client, asn string) (ASNMetadata, ASNMetadataSource, bool, error) {
+	normalized, err := normalizeASN(asn)
+	if err != nil {
+		return ASNMetadata{}, ASNMetadataSource{}, false, err
+	}
+	number, _ := strconv.ParseUint(normalized, 10, 32)
+	entries, source, err := LoadASNMetadata(ctx, client)
+	if err != nil {
+		return ASNMetadata{}, ASNMetadataSource{}, false, err
+	}
+	index := sort.Search(len(entries), func(index int) bool { return entries[index].ASN >= uint32(number) })
+	if index >= len(entries) || entries[index].ASN != uint32(number) {
+		return ASNMetadata{}, source, false, nil
+	}
+	return entries[index], source, true, nil
+}
+
+func loadASNMetadata(ctx context.Context, client *http.Client, urls []string, embedded, embeddedManifest []byte, minimum int) ([]ASNMetadata, ASNMetadataSource, error) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	embeddedEntries, embeddedAt, err := parseASNMetadataDocument(embedded, minimum)
+	if err != nil {
+		return nil, ASNMetadataSource{}, fmt.Errorf("invalid embedded ASN metadata: %w", err)
+	}
+	if err := validateASNMetadataManifest(embeddedManifest, embedded, len(embeddedEntries), embeddedAt); err != nil {
+		return nil, ASNMetadataSource{}, fmt.Errorf("invalid embedded ASN metadata manifest: %w", err)
+	}
+	if client == nil {
+		client = &http.Client{Timeout: 6 * time.Second}
+	}
+	minimumRemote := max(minimum, len(embeddedEntries)*65/100)
+	for index, snapshotURL := range urls {
+		manifest, fetchErr := fetchASNMetadata(ctx, client, asnMetadataManifestURL(snapshotURL))
+		if fetchErr != nil {
+			continue
+		}
+		data, fetchErr := fetchASNMetadata(ctx, client, snapshotURL)
+		if fetchErr != nil {
+			continue
+		}
+		entries, generatedAt, parseErr := parseASNMetadataDocument(data, minimumRemote)
+		if parseErr == nil && validateASNMetadataManifest(manifest, data, len(entries), generatedAt) == nil {
+			return entries, ASNMetadataSource{Schema: ASNMetadataSchema, Count: len(entries), GeneratedAt: generatedAt, Source: metadataRemoteSource(index), Fallback: index > 0}, nil
+		}
+	}
+	return embeddedEntries, ASNMetadataSource{Schema: ASNMetadataSchema, Count: len(embeddedEntries), GeneratedAt: embeddedAt, Source: "embedded", Fallback: true}, nil
+}
+
+func metadataRemoteSource(index int) string {
+	if index == 0 {
+		return "cdn"
+	}
+	if index == 1 {
+		return "raw"
+	}
+	return "remote"
+}
+
+func asnMetadataManifestURL(snapshotURL string) string {
+	return strings.TrimSuffix(snapshotURL, ".json") + ".manifest.json"
+}
+
+func validateASNMetadataManifest(data, snapshot []byte, count int, generatedAt time.Time) error {
+	var manifest asnMetadataManifest
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&manifest); err != nil {
+		return fmt.Errorf("decode manifest: %w", err)
+	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		return errors.New("manifest contains trailing JSON")
+	}
+	if manifest.Schema != ASNMetadataManifestSchema || manifest.File != "bgp-asn-map.json" || manifest.Count != count || manifest.GeneratedAt.IsZero() || !manifest.GeneratedAt.Equal(generatedAt) {
+		return errors.New("manifest schema, file, count, or generated_at is invalid")
+	}
+	hash := sha256.Sum256(snapshot)
+	if !strings.EqualFold(manifest.SHA256, hex.EncodeToString(hash[:])) {
+		return errors.New("manifest SHA-256 does not match snapshot")
+	}
+	return nil
+}
+
+func fetchASNMetadata(ctx context.Context, client *http.Client, snapshotURL string) ([]byte, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, snapshotURL, nil)
+	if err != nil {
+		return nil, errors.New("create ASN metadata request failed")
+	}
+	request.Header.Set("Accept", "application/json")
+	request.Header.Set("User-Agent", "oneclickvirt-backtrace-asn-metadata/1")
+	response, err := client.Do(request)
+	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, ctxErr
+		}
+		return nil, errors.New("ASN metadata request failed")
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d", response.StatusCode)
+	}
+	const maximumSize = 4 << 20
+	data, err := io.ReadAll(io.LimitReader(response.Body, maximumSize+1))
+	if err != nil {
+		return nil, errors.New("ASN metadata response read failed")
+	}
+	if len(data) > maximumSize {
+		return nil, fmt.Errorf("ASN metadata exceeds %d bytes", maximumSize)
+	}
+	return data, nil
+}
+
+func parseASNMetadataDocument(data []byte, minimum int) ([]ASNMetadata, time.Time, error) {
+	var document asnMetadataDocument
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&document); err != nil {
+		return nil, time.Time{}, err
+	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		return nil, time.Time{}, errors.New("ASN metadata contains trailing JSON")
+	}
+	if document.Schema != ASNMetadataSchema || document.GeneratedAt.IsZero() {
+		return nil, time.Time{}, errors.New("ASN metadata schema or generated_at is invalid")
+	}
+	seen := make(map[uint32]struct{}, len(document.Entries))
+	entries := make([]ASNMetadata, 0, len(document.Entries))
+	for _, entry := range document.Entries {
+		entry.Name = strings.TrimSpace(entry.Name)
+		if entry.ASN == 0 || entry.Name == "" {
+			return nil, time.Time{}, errors.New("ASN metadata contains an invalid entry")
+		}
+		if _, exists := seen[entry.ASN]; exists {
+			return nil, time.Time{}, fmt.Errorf("ASN metadata contains duplicate AS%d", entry.ASN)
+		}
+		seen[entry.ASN] = struct{}{}
+		entries = append(entries, entry)
+	}
+	if len(entries) < minimum {
+		return nil, time.Time{}, fmt.Errorf("ASN metadata count %d is below minimum %d", len(entries), minimum)
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].ASN < entries[j].ASN })
+	return entries, document.GeneratedAt, nil
+}

bgptools/asn_metadata_test.go

@@ -0,0 +1,83 @@
+package bgptools
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestLoadASNMetadataPrefersValidatedRemote(t *testing.T) {
+	payload := `{"schema":"backtrace.asn-metadata/v1","generated_at":"2026-07-20T00:00:00Z","entries":[{"asn":2,"name":"Two"},{"asn":1,"name":"One"}]}`
+	manifest := manifestFor([]byte(payload), "bgp-asn-map.json", 2)
+	if err := validateASNMetadataManifest(manifest, []byte(payload), 2, time.Date(2026, 7, 20, 0, 0, 0, 0, time.UTC)); err != nil {
+		t.Fatal(err)
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		if strings.HasSuffix(request.URL.Path, ".manifest.json") {
+			_, _ = w.Write(manifest)
+			return
+		}
+		_, _ = w.Write([]byte(payload))
+	}))
+	defer server.Close()
+	entries, source, err := loadASNMetadata(context.Background(), server.Client(), []string{server.URL + "/bgp-asn-map.json"}, []byte(payload), manifest, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if source.Source != "cdn" || source.Fallback || source.Count != 2 || entries[0].ASN != 1 {
+		t.Fatalf("unexpected result: %#v %#v", entries, source)
+	}
+}
+
+func TestLoadASNMetadataFallsBackOnSchemaFailure(t *testing.T) {
+	embedded := `{"schema":"backtrace.asn-metadata/v1","generated_at":"2026-07-20T00:00:00Z","entries":[{"asn":1,"name":"One"}]}`
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte(`{"schema":"wrong"}`)) }))
+	defer server.Close()
+	manifest := manifestFor([]byte(embedded), "bgp-asn-map.json", 1)
+	entries, source, err := loadASNMetadata(context.Background(), server.Client(), []string{server.URL + "/bgp-asn-map.json"}, []byte(embedded), manifest, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if source.Source != "embedded" || !source.Fallback || len(entries) != 1 {
+		t.Fatalf("unexpected fallback: %#v %#v", entries, source)
+	}
+}
+
+func TestLoadASNMetadataFallsBackFromCDNToRaw(t *testing.T) {
+	payload := []byte(`{"schema":"backtrace.asn-metadata/v1","generated_at":"2026-07-20T00:00:00Z","entries":[{"asn":1,"name":"One"}]}`)
+	validManifest := manifestFor(payload, "bgp-asn-map.json", 1)
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		if request.URL.Path == "/cdn/bgp-asn-map.manifest.json" {
+			_, _ = writer.Write([]byte(`{"schema":"backtrace.asn-metadata-manifest/v1","file":"bgp-asn-map.json","count":1,"sha256":"bad","generated_at":"2026-07-20T00:00:00Z"}`))
+			return
+		}
+		if request.URL.Path == "/raw/bgp-asn-map.manifest.json" {
+			_, _ = writer.Write(validManifest)
+			return
+		}
+		_, _ = writer.Write(payload)
+	}))
+	defer server.Close()
+	entries, source, err := loadASNMetadata(context.Background(), server.Client(), []string{server.URL + "/cdn/bgp-asn-map.json", server.URL + "/raw/bgp-asn-map.json"}, payload, validManifest, 1)
+	if err != nil || len(entries) != 1 || source.Source != "raw" || !source.Fallback {
+		t.Fatalf("unexpected raw fallback: entries=%#v source=%#v err=%v", entries, source, err)
+	}
+}
+
+func manifestFor(snapshot []byte, file string, count int) []byte {
+	hash := sha256.Sum256(snapshot)
+	return []byte(fmt.Sprintf(`{"schema":"backtrace.asn-metadata-manifest/v1","file":"%s","count":%d,"sha256":"%s","generated_at":"2026-07-20T00:00:00Z"}`, file, count, hex.EncodeToString(hash[:])))
+}
+
+func TestParseASNMetadataRejectsDuplicateAndDrop(t *testing.T) {
+	payload := []byte(`{"schema":"backtrace.asn-metadata/v1","generated_at":"2026-07-20T00:00:00Z","entries":[{"asn":1,"name":"One"},{"asn":1,"name":"Again"}]}`)
+	if _, _, err := parseASNMetadataDocument(payload, 1); err == nil {
+		t.Fatal("duplicate ASN unexpectedly accepted")
+	}
+}

bgptools/data/bgp-asn-map.json

@@ -0,0 +1,342 @@
+{
+  "schema": "backtrace.asn-metadata/v1",
+  "generated_at": "2026-07-21T15:33:49.459211Z",
+  "entries": [
+    {
+      "asn": 174,
+      "name": "Cogent"
+    },
+    {
+      "asn": 701,
+      "name": "Verizon"
+    },
+    {
+      "asn": 702,
+      "name": "Verizon"
+    },
+    {
+      "asn": 1239,
+      "name": "Sprint"
+    },
+    {
+      "asn": 1273,
+      "name": "Vodafone"
+    },
+    {
+      "asn": 1299,
+      "name": "Arelion"
+    },
+    {
+      "asn": 1729,
+      "name": "Telia"
+    },
+    {
+      "asn": 2497,
+      "name": "IIJ"
+    },
+    {
+      "asn": 2516,
+      "name": "KDDI"
+    },
+    {
+      "asn": 2914,
+      "name": "NTT"
+    },
+    {
+      "asn": 3209,
+      "name": "Vodafone"
+    },
+    {
+      "asn": 3257,
+      "name": "GTT"
+    },
+    {
+      "asn": 3258,
+      "name": "xTom"
+    },
+    {
+      "asn": 3301,
+      "name": "Telia"
+    },
+    {
+      "asn": 3308,
+      "name": "Telia"
+    },
+    {
+      "asn": 3320,
+      "name": "DTAG"
+    },
+    {
+      "asn": 3356,
+      "name": "Lumen"
+    },
+    {
+      "asn": 3462,
+      "name": "Hinet"
+    },
+    {
+      "asn": 3491,
+      "name": "PCCW"
+    },
+    {
+      "asn": 3786,
+      "name": "LG"
+    },
+    {
+      "asn": 4445,
+      "name": "Vodafone"
+    },
+    {
+      "asn": 4609,
+      "name": "CTM"
+    },
+    {
+      "asn": 4637,
+      "name": "Telstra"
+    },
+    {
+      "asn": 4657,
+      "name": "StarHub"
+    },
+    {
+      "asn": 4766,
+      "name": "KT"
+    },
+    {
+      "asn": 4788,
+      "name": "TMNet"
+    },
+    {
+      "asn": 5378,
+      "name": "Vodafone"
+    },
+    {
+      "asn": 5511,
+      "name": "Orange"
+    },
+    {
+      "asn": 6233,
+      "name": "xTom"
+    },
+    {
+      "asn": 6453,
+      "name": "TATA"
+    },
+    {
+      "asn": 6461,
+      "name": "Zayo"
+    },
+    {
+      "asn": 6762,
+      "name": "Sparkle"
+    },
+    {
+      "asn": 6830,
+      "name": "Liberty"
+    },
+    {
+      "asn": 6939,
+      "name": "HE"
+    },
+    {
+      "asn": 7018,
+      "name": "AT\u0026T"
+    },
+    {
+      "asn": 7473,
+      "name": "SingTel"
+    },
+    {
+      "asn": 7922,
+      "name": "Comcast"
+    },
+    {
+      "asn": 7979,
+      "name": "Servers"
+    },
+    {
+      "asn": 8075,
+      "name": "MS"
+    },
+    {
+      "asn": 8888,
+      "name": "xTom"
+    },
+    {
+      "asn": 9002,
+      "name": "RETN"
+    },
+    {
+      "asn": 9269,
+      "name": "HKBN"
+    },
+    {
+      "asn": 9304,
+      "name": "HGC"
+    },
+    {
+      "asn": 9505,
+      "name": "CHT"
+    },
+    {
+      "asn": 9644,
+      "name": "SK"
+    },
+    {
+      "asn": 9886,
+      "name": "CTCSCI"
+    },
+    {
+      "asn": 9924,
+      "name": "TFN"
+    },
+    {
+      "asn": 12389,
+      "name": "RT_RU"
+    },
+    {
+      "asn": 12876,
+      "name": "Scaleway"
+    },
+    {
+      "asn": 12956,
+      "name": "Telxius"
+    },
+    {
+      "asn": 13335,
+      "name": "CF"
+    },
+    {
+      "asn": 15169,
+      "name": "Google"
+    },
+    {
+      "asn": 15802,
+      "name": "DU"
+    },
+    {
+      "asn": 16276,
+      "name": "OVH"
+    },
+    {
+      "asn": 16509,
+      "name": "Amazon"
+    },
+    {
+      "asn": 17676,
+      "name": "Softbank"
+    },
+    {
+      "asn": 18403,
+      "name": "FPT"
+    },
+    {
+      "asn": 20473,
+      "name": "Vultr"
+    },
+    {
+      "asn": 20485,
+      "name": "TTK_RU"
+    },
+    {
+      "asn": 23961,
+      "name": "Misaka"
+    },
+    {
+      "asn": 24940,
+      "name": "Hetzner"
+    },
+    {
+      "asn": 25820,
+      "name": "IT7"
+    },
+    {
+      "asn": 30844,
+      "name": "Liquid"
+    },
+    {
+      "asn": 31898,
+      "name": "Oracle"
+    },
+    {
+      "asn": 37700,
+      "name": "JINX"
+    },
+    {
+      "asn": 38731,
+      "name": "CHT"
+    },
+    {
+      "asn": 45102,
+      "name": "Alibaba"
+    },
+    {
+      "asn": 45899,
+      "name": "VNPT"
+    },
+    {
+      "asn": 49304,
+      "name": "SAKURA"
+    },
+    {
+      "asn": 51847,
+      "name": "Nearoute"
+    },
+    {
+      "asn": 58652,
+      "name": "Level3"
+    },
+    {
+      "asn": 60068,
+      "name": "Datacamp"
+    },
+    {
+      "asn": 63150,
+      "name": "Bage"
+    },
+    {
+      "asn": 132203,
+      "name": "Tencent"
+    },
+    {
+      "asn": 133613,
+      "name": "MTel"
+    },
+    {
+      "asn": 136907,
+      "name": "Huawei"
+    },
+    {
+      "asn": 137409,
+      "name": "GSL"
+    },
+    {
+      "asn": 140096,
+      "name": "JINX"
+    },
+    {
+      "asn": 152672,
+      "name": "Aiyun"
+    },
+    {
+      "asn": 202662,
+      "name": "Hytron"
+    },
+    {
+      "asn": 209242,
+      "name": "CF"
+    },
+    {
+      "asn": 211392,
+      "name": "Dream"
+    },
+    {
+      "asn": 214996,
+      "name": "netcup"
+    },
+    {
+      "asn": 216382,
+      "name": "Layer"
+    }
+  ]
+}

bgptools/data/bgp-asn-map.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-metadata-manifest/v1",
+  "file": "bgp-asn-map.json",
+  "count": 84,
+  "sha256": "f681dd78d55c27d4615d2e705de9bde24d111e8897d37a489b91e263f27f1a66",
+  "generated_at": "2026-07-21T15:33:49.459211Z"
+}

bgptools/origin.go

@@ -0,0 +1,129 @@
+package bgptools
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const defaultOriginASNURL = "https://stat.ripe.net/data/network-info/data.json"
+
+var (
+	ErrOriginASNMissing     = errors.New("origin ASN response has no usable ASN")
+	ErrOriginASNRateLimited = errors.New("origin ASN resolver rate limited")
+)
+
+type OriginASNConfig struct {
+	Client          *http.Client
+	BaseURL         string
+	Timeout         time.Duration
+	MaxResponseSize int64
+}
+
+func ResolveOriginASN(ctx context.Context, ip string) (string, error) {
+	return ResolveOriginASNWithConfig(ctx, ip, OriginASNConfig{})
+}
+
+func ResolveOriginASNWithConfig(parent context.Context, ip string, config OriginASNConfig) (string, error) {
+	parsed := net.ParseIP(strings.TrimSpace(ip))
+	if parsed == nil {
+		return "", ErrInvalidIPAddress
+	}
+	if parent == nil {
+		parent = context.Background()
+	}
+	if config.Timeout <= 0 {
+		config.Timeout = 8 * time.Second
+	}
+	if config.MaxResponseSize <= 0 {
+		config.MaxResponseSize = 1 << 20
+	}
+	if config.Client == nil {
+		config.Client = &http.Client{}
+	}
+	if strings.TrimSpace(config.BaseURL) == "" {
+		config.BaseURL = defaultOriginASNURL
+	}
+	requestURL, err := addQuery(config.BaseURL, "resource", parsed.String())
+	if err != nil {
+		return "", errors.New("invalid origin ASN source")
+	}
+	ctx, cancel := context.WithTimeout(parent, config.Timeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL, nil)
+	if err != nil {
+		return "", errors.New("create origin ASN request failed")
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("User-Agent", "oneclickvirt-backtrace-origin-asn/1")
+	response, err := config.Client.Do(req)
+	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return "", ctxErr
+		}
+		return "", errors.New("origin ASN request failed")
+	}
+	defer response.Body.Close()
+	if response.StatusCode == http.StatusTooManyRequests {
+		return "", ErrOriginASNRateLimited
+	}
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("origin ASN HTTP %d", response.StatusCode)
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, config.MaxResponseSize+1))
+	if err != nil {
+		return "", errors.New("origin ASN response read failed")
+	}
+	if int64(len(body)) > config.MaxResponseSize {
+		return "", fmt.Errorf("origin ASN response exceeds %d bytes", config.MaxResponseSize)
+	}
+	var payload struct {
+		Status string `json:"status"`
+		Data   *struct {
+			ASNs []json.RawMessage `json:"asns"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(body, &payload); err != nil {
+		return "", err
+	}
+	if status := strings.TrimSpace(payload.Status); status != "" && !strings.EqualFold(status, "ok") {
+		return "", fmt.Errorf("origin ASN response status %q", status)
+	}
+	if payload.Data == nil || len(payload.Data.ASNs) == 0 {
+		return "", ErrOriginASNMissing
+	}
+	for _, raw := range payload.Data.ASNs {
+		value, err := originASNValue(raw)
+		if err != nil {
+			continue
+		}
+		if normalized, err := normalizeASN(value); err == nil {
+			return normalized, nil
+		}
+	}
+	return "", ErrOriginASNMissing
+}
+
+func originASNValue(raw json.RawMessage) (string, error) {
+	var text string
+	if err := json.Unmarshal(raw, &text); err == nil {
+		return text, nil
+	}
+	var number json.Number
+	decoder := json.NewDecoder(strings.NewReader(string(raw)))
+	decoder.UseNumber()
+	if err := decoder.Decode(&number); err != nil {
+		return "", err
+	}
+	if _, err := strconv.ParseUint(number.String(), 10, 32); err != nil {
+		return "", err
+	}
+	return number.String(), nil
+}

bgptools/origin_test.go

@@ -0,0 +1,58 @@
+package bgptools
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestResolveOriginASNOfflineFixture(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.URL.Query().Get("resource"); got != "192.0.2.1" {
+			t.Errorf("resource = %q", got)
+		}
+		_, _ = w.Write([]byte(`{"status":"ok","data":{"asns":["AS64500",64501],"prefix":"192.0.2.0/24"}}`))
+	}))
+	defer server.Close()
+
+	asn, err := ResolveOriginASNWithConfig(context.Background(), "192.0.2.1", OriginASNConfig{
+		Client: server.Client(), BaseURL: server.URL, Timeout: time.Second,
+	})
+	if err != nil || asn != "64500" {
+		t.Fatalf("ResolveOriginASNWithConfig() = %q, %v", asn, err)
+	}
+}
+
+func TestResolveOriginASNRejectsMissingAndDriftedData(t *testing.T) {
+	for _, payload := range []string{
+		`{"status":"ok","data":{"asns":[]}}`,
+		`{"status":"ok","data":{"asns":"64500"}}`,
+		`{"status":"ok","data":{"asns":["not-an-asn"]}}`,
+		`{"status":"error","data":{"asns":[64500]}}`,
+	} {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			_, _ = w.Write([]byte(payload))
+		}))
+		_, err := ResolveOriginASNWithConfig(context.Background(), "2001:db8::1", OriginASNConfig{
+			Client: server.Client(), BaseURL: server.URL, Timeout: time.Second,
+		})
+		server.Close()
+		if err == nil {
+			t.Fatalf("payload %s unexpectedly succeeded", payload)
+		}
+	}
+}
+
+func TestResolveOriginASNReportsRateLimit(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusTooManyRequests)
+	}))
+	defer server.Close()
+	_, err := ResolveOriginASNWithConfig(context.Background(), "192.0.2.1", OriginASNConfig{Client: server.Client(), BaseURL: server.URL})
+	if !errors.Is(err, ErrOriginASNRateLimited) {
+		t.Fatalf("rate limit error = %v", err)
+	}
+}

bgptools/privacy_test.go

@@ -0,0 +1,97 @@
+package bgptools
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+type privacyRoundTripper func(*http.Request) (*http.Response, error)
+
+func (fn privacyRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
+	return fn(request)
+}
+
+func TestStructuredReportErrorsDoNotExposeRemoteURLs(t *testing.T) {
+	var rdap *httptest.Server
+	rdap = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = fmt.Fprintf(w, `{"handle":"TEST","links":[{"rel":"geofeed","href":"https://private.example/geofeed?token=secret"}]}`)
+	}))
+	defer rdap.Close()
+	failing := &http.Client{Transport: privacyRoundTripper(func(request *http.Request) (*http.Response, error) {
+		return nil, errors.New("dial " + request.URL.String())
+	})}
+	report, err := QueryIPBGPReport(context.Background(), "192.0.2.1", IPBGPReportConfig{
+		RDAPClient:    rdap.Client(),
+		RDAPBaseURL:   rdap.URL,
+		FetchGeofeed:  true,
+		GeofeedClient: failing,
+		ResolveASN: func(context.Context, string) (string, error) {
+			return "", errors.New("resolver https://private.example/asn?key=secret")
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, source := range report.Sources {
+		for _, field := range []string{source.Source, source.Error} {
+			for _, forbidden := range []string{"private.example", "token=", "key=", "secret"} {
+				if strings.Contains(field, forbidden) {
+					t.Fatalf("structured source leaked %q: %+v", forbidden, source)
+				}
+			}
+		}
+	}
+	if len(report.Geofeeds) != 1 || report.Geofeeds[0].Error != "request_failed" {
+		t.Fatalf("geofeed error was not stabilized: %+v", report.Geofeeds)
+	}
+	encoded, err := json.Marshal(report)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, forbidden := range []string{"token=", "key=", "secret", "userinfo@"} {
+		if strings.Contains(string(encoded), forbidden) {
+			t.Fatalf("structured report leaked %q: %s", forbidden, encoded)
+		}
+	}
+	if report.RDAP == nil || len(report.RDAP.GeofeedURLs) != 1 || report.RDAP.GeofeedURLs[0] != "https://private.example/geofeed" || report.Geofeeds[0].URL != "https://private.example/geofeed" {
+		t.Fatalf("geofeed URL was not sanitized consistently: %+v", report)
+	}
+}
+
+func TestRemoteFetchErrorsDoNotExposeSourceURL(t *testing.T) {
+	client := &http.Client{Transport: privacyRoundTripper(func(request *http.Request) (*http.Response, error) {
+		return nil, errors.New("dial " + request.URL.String())
+	})}
+	tests := []struct {
+		name string
+		run  func() error
+	}{
+		{name: "ASN metadata", run: func() error {
+			_, err := fetchASNMetadata(context.Background(), client, "https://private.example/asn?token=secret")
+			return err
+		}},
+		{name: "RDAP", run: func() error {
+			_, err := QueryRDAP(context.Background(), "192.0.2.1", client, "https://private.example/rdap?token=secret")
+			return err
+		}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := test.run()
+			if err == nil {
+				t.Fatal("expected request failure")
+			}
+			for _, forbidden := range []string{"private.example", "token=", "secret"} {
+				if strings.Contains(err.Error(), forbidden) {
+					t.Fatalf("error leaked %q: %v", forbidden, err)
+				}
+			}
+		})
+	}
+}

bgptools/rdap.go

@@ -0,0 +1,211 @@
+package bgptools
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"sort"
+	"strings"
+	"time"
+)
+
+var (
+	ErrInvalidIPAddress     = errors.New("invalid IP address")
+	ErrRDAPRateLimited      = errors.New("rdap rate limited")
+	ErrRDAPResponseTooLarge = errors.New("rdap response too large")
+)
+
+type RDAPEntity struct {
+	Handle string   `json:"handle,omitempty"`
+	Roles  []string `json:"roles,omitempty"`
+}
+
+type RDAPRecord struct {
+	IP               string       `json:"ip"`
+	Handle           string       `json:"handle,omitempty"`
+	Name             string       `json:"name,omitempty"`
+	Type             string       `json:"type,omitempty"`
+	Country          string       `json:"country,omitempty"`
+	StartAddress     string       `json:"start_address,omitempty"`
+	EndAddress       string       `json:"end_address,omitempty"`
+	ParentHandle     string       `json:"parent_handle,omitempty"`
+	Prefixes         []string     `json:"prefixes,omitempty"`
+	RegistrationDate *time.Time   `json:"registration_date,omitempty"`
+	LastChangedDate  *time.Time   `json:"last_changed_date,omitempty"`
+	GeofeedURLs      []string     `json:"geofeed_urls,omitempty"`
+	Entities         []RDAPEntity `json:"entities,omitempty"`
+	Port43           string       `json:"port43,omitempty"`
+	Status           []string     `json:"status,omitempty"`
+	Source           string       `json:"source"`
+}
+
+func QueryRDAP(ctx context.Context, ip string, client *http.Client, baseURL string) (RDAPRecord, error) {
+	parsed := net.ParseIP(strings.TrimSpace(ip))
+	if parsed == nil {
+		return RDAPRecord{}, ErrInvalidIPAddress
+	}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	if client == nil {
+		client = &http.Client{Timeout: 8 * time.Second}
+	}
+	if strings.TrimSpace(baseURL) == "" {
+		baseURL = "https://rdap.org/ip/"
+	}
+	requestURL := strings.TrimRight(baseURL, "/") + "/" + parsed.String()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL, nil)
+	if err != nil {
+		return RDAPRecord{}, errors.New("create RDAP request failed")
+	}
+	req.Header.Set("Accept", "application/rdap+json, application/json")
+	req.Header.Set("User-Agent", "oneclickvirt-backtrace-rdap/1")
+	response, err := client.Do(req)
+	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return RDAPRecord{}, ctxErr
+		}
+		return RDAPRecord{}, errors.New("RDAP request failed")
+	}
+	defer response.Body.Close()
+	if response.StatusCode == http.StatusTooManyRequests {
+		return RDAPRecord{}, ErrRDAPRateLimited
+	}
+	if response.StatusCode != http.StatusOK {
+		return RDAPRecord{}, fmt.Errorf("rdap HTTP %d", response.StatusCode)
+	}
+	data, err := io.ReadAll(io.LimitReader(response.Body, (4<<20)+1))
+	if err != nil {
+		return RDAPRecord{}, errors.New("RDAP response read failed")
+	}
+	if len(data) > 4<<20 {
+		return RDAPRecord{}, ErrRDAPResponseTooLarge
+	}
+	source := requestURL
+	if response.Request != nil && response.Request.URL != nil {
+		source = response.Request.URL.String()
+	}
+	return parseRDAPRecord(parsed.String(), source, data)
+}
+
+func parseRDAPRecord(ip, source string, data []byte) (RDAPRecord, error) {
+	var payload struct {
+		Handle       string   `json:"handle"`
+		Name         string   `json:"name"`
+		Type         string   `json:"type"`
+		Country      string   `json:"country"`
+		StartAddress string   `json:"startAddress"`
+		EndAddress   string   `json:"endAddress"`
+		ParentHandle string   `json:"parentHandle"`
+		Port43       string   `json:"port43"`
+		Status       []string `json:"status"`
+		Events       []struct {
+			Action string    `json:"eventAction"`
+			Date   time.Time `json:"eventDate"`
+		} `json:"events"`
+		Links []struct {
+			Rel  string `json:"rel"`
+			Href string `json:"href"`
+			Type string `json:"type"`
+		} `json:"links"`
+		Entities []struct {
+			Handle string   `json:"handle"`
+			Roles  []string `json:"roles"`
+		} `json:"entities"`
+		CIDRs []struct {
+			V4Prefix string `json:"v4prefix"`
+			V6Prefix string `json:"v6prefix"`
+			Length   *int   `json:"length"`
+		} `json:"cidr0_cidrs"`
+	}
+	if err := json.Unmarshal(data, &payload); err != nil {
+		return RDAPRecord{}, err
+	}
+	record := RDAPRecord{
+		IP: ip, Handle: payload.Handle, Name: payload.Name, Type: payload.Type,
+		Country: payload.Country, StartAddress: payload.StartAddress, EndAddress: payload.EndAddress,
+		ParentHandle: payload.ParentHandle, Port43: payload.Port43, Status: payload.Status, Source: "rdap",
+	}
+	for _, event := range payload.Events {
+		switch strings.ToLower(event.Action) {
+		case "registration":
+			if !event.Date.IsZero() && (record.RegistrationDate == nil || event.Date.Before(*record.RegistrationDate)) {
+				value := event.Date
+				record.RegistrationDate = &value
+			}
+		case "last changed", "last update of rdap database":
+			if !event.Date.IsZero() && (record.LastChangedDate == nil || event.Date.After(*record.LastChangedDate)) {
+				value := event.Date
+				record.LastChangedDate = &value
+			}
+		}
+	}
+	for _, link := range payload.Links {
+		if strings.EqualFold(link.Rel, "geofeed") || strings.Contains(strings.ToLower(link.Type), "geofeed") {
+			if href := strings.TrimSpace(link.Href); href != "" {
+				record.GeofeedURLs = append(record.GeofeedURLs, href)
+			}
+		}
+	}
+	for _, entity := range payload.Entities {
+		record.Entities = append(record.Entities, RDAPEntity{Handle: entity.Handle, Roles: entity.Roles})
+	}
+	for _, cidr := range payload.CIDRs {
+		prefix := cidr.V4Prefix
+		if prefix == "" {
+			prefix = cidr.V6Prefix
+		}
+		if cidr.Length == nil {
+			continue
+		}
+		if normalized, ok := normalizeRDAPPrefix(ip, prefix, *cidr.Length); ok {
+			record.Prefixes = append(record.Prefixes, normalized)
+		}
+	}
+	record.Prefixes = uniqueSortedStrings(record.Prefixes)
+	record.GeofeedURLs = uniqueSortedStrings(record.GeofeedURLs)
+	return record, nil
+}
+
+func normalizeRDAPPrefix(targetIP, prefix string, length int) (string, bool) {
+	target := net.ParseIP(strings.TrimSpace(targetIP))
+	parsed := net.ParseIP(strings.TrimSpace(prefix))
+	if target == nil || parsed == nil || (target.To4() == nil) != (parsed.To4() == nil) {
+		return "", false
+	}
+	bits := 128
+	if parsed.To4() != nil {
+		bits = 32
+	}
+	if length < 0 || length > bits {
+		return "", false
+	}
+	_, network, err := net.ParseCIDR(fmt.Sprintf("%s/%d", parsed.String(), length))
+	if err != nil {
+		return "", false
+	}
+	if !network.Contains(target) {
+		return "", false
+	}
+	return network.String(), true
+}
+
+func uniqueSortedStrings(values []string) []string {
+	seen := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			seen[value] = struct{}{}
+		}
+	}
+	result := make([]string, 0, len(seen))
+	for value := range seen {
+		result = append(result, value)
+	}
+	sort.Strings(result)
+	return result
+}

bgptools/rdap_test.go

@@ -0,0 +1,48 @@
+package bgptools
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestQueryRDAPParsesRegistrationAndGeofeed(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/rdap+json")
+		_, _ = w.Write([]byte(`{"handle":"NET-TEST","name":"TEST-NET","country":"US","startAddress":"192.0.2.0","endAddress":"192.0.2.255","cidr0_cidrs":[{"v4prefix":"192.0.2.0","length":24}],"events":[{"eventAction":"registration","eventDate":"2020-01-02T03:04:05Z"}],"links":[{"rel":"geofeed","href":"https://example.test/geofeed.csv"}],"entities":[{"handle":"EXAMPLE","roles":["registrant"]}]}`))
+	}))
+	defer server.Close()
+	record, err := QueryRDAP(context.Background(), "192.0.2.1", server.Client(), server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if record.Handle != "NET-TEST" || record.RegistrationDate == nil || len(record.GeofeedURLs) != 1 || len(record.Entities) != 1 || len(record.Prefixes) != 1 || record.Prefixes[0] != "192.0.2.0/24" {
+		t.Fatalf("unexpected record: %+v", record)
+	}
+}
+
+func TestQueryRDAPRejectsInvalidIP(t *testing.T) {
+	if _, err := QueryRDAP(context.Background(), "invalid", nil, ""); err == nil {
+		t.Fatal("expected invalid IP error")
+	}
+}
+
+func TestQueryRDAPCanonicalizesAndFiltersPrefixes(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := strings.TrimPrefix(r.URL.Path, "/"); got != "2001:db8::1" {
+			t.Errorf("RDAP path IP = %q", got)
+		}
+		_, _ = w.Write([]byte(`{"port43":"whois.ripe.net","cidr0_cidrs":[{"v6prefix":"2001:db8::99","length":32},{"v6prefix":"2001:db8::"},{"v6prefix":"2001:db9::","length":32},{"v6prefix":"not-an-ip","length":32},{"v6prefix":"2001:db8::","length":129},{"v4prefix":"192.0.2.0","length":24}],"events":[{"eventAction":"registration"}]}`))
+	}))
+	defer server.Close()
+
+	record, err := QueryRDAP(nil, "2001:db8::1", server.Client(), server.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(record.Prefixes) != 1 || record.Prefixes[0] != "2001:db8::/32" {
+		t.Fatalf("unexpected filtered prefixes: %+v", record.Prefixes)
+	}
+}

bgptools/relationships.go

@@ -0,0 +1,489 @@
+package bgptools
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// RelationshipKind is the relationship of a neighbouring network to the
+// target ASN.  RIPEstat does not always publish a direction, in which case a
+// neighbour is reported as peer with Inferred=true instead of pretending that
+// the direction is known.
+type RelationshipKind string
+
+const (
+	RelationshipUpstream RelationshipKind = "upstream"
+	RelationshipPeer     RelationshipKind = "peer"
+	RelationshipIXP      RelationshipKind = "ixp"
+)
+
+// RelationshipStatus is deliberately small and stable so callers can render
+// a partial report without parsing provider-specific error strings.
+type RelationshipStatus string
+
+const (
+	RelationshipAvailable     RelationshipStatus = "available"
+	RelationshipPartial       RelationshipStatus = "partial"
+	RelationshipRateLimited   RelationshipStatus = "rate_limited"
+	RelationshipTimeout       RelationshipStatus = "timeout"
+	RelationshipMissingFields RelationshipStatus = "missing_fields"
+	RelationshipError         RelationshipStatus = "error"
+	RelationshipUnsupported   RelationshipStatus = "unsupported"
+)
+
+var errRelationshipMissingFields = errors.New("relationship response missing required fields")
+
+// ASNRelationship is a normalized relationship entry.  ASN is empty for an
+// IXP that has no ASN in PeeringDB; IXPID and Name remain usable identifiers.
+type ASNRelationship struct {
+	ASN         string             `json:"asn,omitempty"`
+	Name        string             `json:"name,omitempty"`
+	Kind        RelationshipKind   `json:"kind"`
+	Source      string             `json:"source"`
+	Status      RelationshipStatus `json:"status"`
+	Power       float64            `json:"power,omitempty"`
+	IXPID       string             `json:"ixp_id,omitempty"`
+	Inferred    bool               `json:"inferred,omitempty"`
+	RateLimited bool               `json:"rate_limited,omitempty"`
+	Timeout     bool               `json:"timeout,omitempty"`
+}
+
+// RelationshipSourceStatus records the result of each upstream API.  A
+// report may be partial when one API is unavailable and the other succeeds.
+type RelationshipSourceStatus struct {
+	Source      string             `json:"source"`
+	Status      RelationshipStatus `json:"status"`
+	RateLimited bool               `json:"rate_limited"`
+	Timeout     bool               `json:"timeout"`
+	Error       string             `json:"error,omitempty"`
+}
+
+// ASNRelationshipReport contains normalized upstream, peer and IXP entries.
+// SourceStatuses allows callers to distinguish a clean empty result from a
+// provider timeout or rate limit.
+type ASNRelationshipReport struct {
+	TargetASN      string                     `json:"target_asn"`
+	Status         RelationshipStatus         `json:"status"`
+	RateLimited    bool                       `json:"rate_limited"`
+	Timeout        bool                       `json:"timeout"`
+	Upstreams      []ASNRelationship          `json:"upstreams,omitempty"`
+	Peers          []ASNRelationship          `json:"peers,omitempty"`
+	IXPs           []ASNRelationship          `json:"ixps,omitempty"`
+	SourceStatuses []RelationshipSourceStatus `json:"sources,omitempty"`
+}
+
+// RelationshipConfig controls the public API endpoints.  URLs are explicit
+// Go configuration so callers can use local fixtures without environment
+// variables.  Empty URLs select the documented public endpoints.
+type RelationshipConfig struct {
+	Client          *http.Client
+	RIPEstatURL     string
+	PeeringDBURL    string
+	Timeout         time.Duration
+	MaxResponseSize int64
+}
+
+const (
+	defaultRIPEstatURL  = "https://stat.ripe.net/data/asn-neighbours/data.json"
+	defaultPeeringDBURL = "https://www.peeringdb.com/api/netixlan"
+)
+
+// QueryASNRelationships fetches relationship data from RIPEstat and IXP
+// membership data from PeeringDB.  It returns a report even when one source
+// fails; only an invalid ASN or caller cancellation is returned as an error.
+func QueryASNRelationships(ctx context.Context, asn string, cfg RelationshipConfig) (*ASNRelationshipReport, error) {
+	normalized, err := normalizeASN(asn)
+	if err != nil {
+		return nil, err
+	}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	if cfg.Timeout <= 0 {
+		cfg.Timeout = 8 * time.Second
+	}
+	if cfg.MaxResponseSize <= 0 {
+		cfg.MaxResponseSize = 4 << 20
+	}
+	if cfg.Client == nil {
+		cfg.Client = &http.Client{}
+	}
+	if strings.TrimSpace(cfg.RIPEstatURL) == "" {
+		cfg.RIPEstatURL = defaultRIPEstatURL
+	}
+	if strings.TrimSpace(cfg.PeeringDBURL) == "" {
+		cfg.PeeringDBURL = defaultPeeringDBURL
+	}
+
+	report := &ASNRelationshipReport{TargetASN: normalized}
+	ripeURL, err := addQuery(cfg.RIPEstatURL, "resource", normalized)
+	if err != nil {
+		return nil, errors.New("invalid relationship source configuration")
+	}
+	ripeRaw, ripeStatus, ripeErr := fetchRelationshipJSON(ctx, cfg, "ripestat", ripeURL)
+	report.SourceStatuses = append(report.SourceStatuses, sourceStatus("ripestat", ripeStatus, ripeErr))
+	if ripeErr == nil {
+		entries, parseErr := parseRIPEstatRelationships(ripeRaw, normalized)
+		if parseErr != nil {
+			ripeStatus = statusForParseError(parseErr)
+			report.SourceStatuses[len(report.SourceStatuses)-1] = sourceStatus("ripestat", ripeStatus, parseErr)
+		} else {
+			for _, entry := range entries {
+				if entry.Kind == RelationshipUpstream {
+					report.Upstreams = append(report.Upstreams, entry)
+				} else {
+					report.Peers = append(report.Peers, entry)
+				}
+			}
+		}
+	}
+
+	peeringURL, err := addQuery(cfg.PeeringDBURL, "asn", normalized)
+	if err != nil {
+		return nil, errors.New("invalid relationship source configuration")
+	}
+	peeringRaw, peeringStatus, peeringErr := fetchRelationshipJSON(ctx, cfg, "peeringdb", peeringURL)
+	report.SourceStatuses = append(report.SourceStatuses, sourceStatus("peeringdb", peeringStatus, peeringErr))
+	if peeringErr == nil {
+		entries, parseErr := parsePeeringDBIXPs(peeringRaw)
+		if parseErr != nil {
+			peeringStatus = statusForParseError(parseErr)
+			report.SourceStatuses[len(report.SourceStatuses)-1] = sourceStatus("peeringdb", peeringStatus, parseErr)
+		} else {
+			report.IXPs = append(report.IXPs, entries...)
+		}
+	}
+
+	sortRelationships(report)
+	report.Status = aggregateRelationshipStatus(report.SourceStatuses)
+	for _, source := range report.SourceStatuses {
+		report.RateLimited = report.RateLimited || source.RateLimited
+		report.Timeout = report.Timeout || source.Timeout
+	}
+	if err := ctx.Err(); err != nil {
+		return report, err
+	}
+	return report, nil
+}
+
+// QueryASNRelationshipReport is a descriptive alias for QueryASNRelationships.
+func QueryASNRelationshipReport(ctx context.Context, asn string, cfg RelationshipConfig) (*ASNRelationshipReport, error) {
+	return QueryASNRelationships(ctx, asn, cfg)
+}
+
+func normalizeASN(value string) (string, error) {
+	value = strings.TrimPrefix(strings.ToUpper(strings.TrimSpace(value)), "AS")
+	if value == "" {
+		return "", errors.New("ASN cannot be empty")
+	}
+	n, err := strconv.ParseUint(value, 10, 32)
+	if err != nil || n == 0 {
+		return "", fmt.Errorf("invalid ASN %q", value)
+	}
+	return strconv.FormatUint(n, 10), nil
+}
+
+func addQuery(rawURL, key, value string) (string, error) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return "", err
+	}
+	query := u.Query()
+	query.Set(key, value)
+	u.RawQuery = query.Encode()
+	return u.String(), nil
+}
+
+func fetchRelationshipJSON(parent context.Context, cfg RelationshipConfig, source, requestURL string) ([]byte, RelationshipStatus, error) {
+	ctx, cancel := context.WithTimeout(parent, cfg.Timeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, requestURL, nil)
+	if err != nil {
+		return nil, RelationshipError, err
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("User-Agent", "oneclickvirt-backtrace-relationships/1")
+	resp, err := cfg.Client.Do(req)
+	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) || (netErrTimeout(err)) {
+			return nil, RelationshipTimeout, err
+		}
+		return nil, RelationshipError, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusTooManyRequests {
+		return nil, RelationshipRateLimited, fmt.Errorf("%s HTTP %d", source, resp.StatusCode)
+	}
+	if resp.StatusCode == http.StatusRequestTimeout || resp.StatusCode == http.StatusGatewayTimeout {
+		return nil, RelationshipTimeout, fmt.Errorf("%s HTTP %d", source, resp.StatusCode)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, RelationshipError, fmt.Errorf("%s HTTP %d", source, resp.StatusCode)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, cfg.MaxResponseSize+1))
+	if err != nil {
+		return nil, RelationshipError, err
+	}
+	if int64(len(body)) > cfg.MaxResponseSize {
+		return nil, RelationshipError, fmt.Errorf("%s response exceeds %d bytes", source, cfg.MaxResponseSize)
+	}
+	return body, RelationshipAvailable, nil
+}
+
+func netErrTimeout(err error) bool {
+	var netErr net.Error
+	return errors.As(err, &netErr) && netErr.Timeout()
+}
+
+func sourceStatus(source string, status RelationshipStatus, err error) RelationshipSourceStatus {
+	item := RelationshipSourceStatus{
+		Source: source, Status: status,
+		RateLimited: status == RelationshipRateLimited,
+		Timeout:     status == RelationshipTimeout,
+	}
+	if err != nil {
+		switch status {
+		case RelationshipRateLimited:
+			item.Error = "rate_limited"
+		case RelationshipTimeout:
+			item.Error = "timeout"
+		case RelationshipMissingFields:
+			item.Error = "missing_fields"
+		default:
+			item.Error = "request_failed"
+		}
+	}
+	return item
+}
+
+func statusForParseError(err error) RelationshipStatus {
+	if errors.Is(err, errRelationshipMissingFields) {
+		return RelationshipMissingFields
+	}
+	return RelationshipError
+}
+
+func aggregateRelationshipStatus(sources []RelationshipSourceStatus) RelationshipStatus {
+	available := 0
+	for _, source := range sources {
+		if source.Status == RelationshipAvailable {
+			available++
+		}
+	}
+	if available == len(sources) {
+		return RelationshipAvailable
+	}
+	if available > 0 {
+		return RelationshipPartial
+	}
+	for _, source := range sources {
+		if source.Status == RelationshipRateLimited {
+			return RelationshipRateLimited
+		}
+	}
+	for _, source := range sources {
+		if source.Status == RelationshipTimeout {
+			return RelationshipTimeout
+		}
+	}
+	for _, source := range sources {
+		if source.Status == RelationshipMissingFields {
+			return RelationshipMissingFields
+		}
+	}
+	return RelationshipError
+}
+
+type ripeNeighbourResponse struct {
+	Data *struct {
+		Neighbours json.RawMessage `json:"neighbours"`
+	} `json:"data"`
+}
+
+type ripeNeighbour struct {
+	ASN          json.RawMessage `json:"asn"`
+	Name         string          `json:"name"`
+	Power        float64         `json:"power"`
+	Type         string          `json:"type"`
+	Relationship string          `json:"relationship"`
+	Direction    string          `json:"direction"`
+}
+
+func parseRIPEstatRelationships(payload []byte, targetASN string) ([]ASNRelationship, error) {
+	var response ripeNeighbourResponse
+	if err := json.Unmarshal(payload, &response); err != nil {
+		return nil, err
+	}
+	if response.Data == nil || len(response.Data.Neighbours) == 0 || string(response.Data.Neighbours) == "null" {
+		return nil, errRelationshipMissingFields
+	}
+	var neighbours []ripeNeighbour
+	if err := json.Unmarshal(response.Data.Neighbours, &neighbours); err != nil {
+		return nil, errRelationshipMissingFields
+	}
+	var result []ASNRelationship
+	for _, neighbour := range neighbours {
+		asn, err := parseJSONASN(neighbour.ASN)
+		if err != nil || asn == targetASN {
+			continue
+		}
+		kind, inferred := relationshipKind(neighbour.Relationship, neighbour.Type, neighbour.Direction)
+		result = append(result, ASNRelationship{
+			ASN: asn, Name: strings.TrimSpace(neighbour.Name), Kind: kind,
+			Source: "ripestat", Status: RelationshipAvailable,
+			Power: neighbour.Power, Inferred: inferred,
+		})
+	}
+	return dedupeRelationships(result), nil
+}
+
+func relationshipKind(values ...string) (RelationshipKind, bool) {
+	for _, value := range values {
+		switch strings.ToLower(strings.TrimSpace(value)) {
+		case "upstream", "provider", "transit":
+			return RelationshipUpstream, false
+		case "peer", "peering", "customer", "downstream":
+			return RelationshipPeer, false
+		case "ixp", "internet exchange", "exchange":
+			return RelationshipIXP, false
+		}
+	}
+	return RelationshipPeer, true
+}
+
+func parseJSONASN(raw json.RawMessage) (string, error) {
+	if len(raw) == 0 || string(raw) == "null" {
+		return "", errors.New("missing ASN")
+	}
+	var value string
+	if raw[0] == '"' {
+		if err := json.Unmarshal(raw, &value); err != nil {
+			return "", err
+		}
+	} else {
+		var number json.Number
+		decoder := json.NewDecoder(strings.NewReader(string(raw)))
+		decoder.UseNumber()
+		if err := decoder.Decode(&number); err != nil {
+			return "", err
+		}
+		value = number.String()
+	}
+	return normalizeASN(value)
+}
+
+func dedupeRelationships(values []ASNRelationship) []ASNRelationship {
+	seen := make(map[string]ASNRelationship, len(values))
+	for _, value := range values {
+		key := string(value.Kind) + ":" + value.ASN + ":" + value.IXPID
+		if previous, ok := seen[key]; !ok || previous.Name == "" && value.Name != "" {
+			seen[key] = value
+		}
+	}
+	result := make([]ASNRelationship, 0, len(seen))
+	for _, value := range seen {
+		result = append(result, value)
+	}
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].Kind != result[j].Kind {
+			return result[i].Kind < result[j].Kind
+		}
+		if result[i].ASN != result[j].ASN {
+			return result[i].ASN < result[j].ASN
+		}
+		return result[i].IXPID < result[j].IXPID
+	})
+	return result
+}
+
+type peeringDBResponse struct {
+	Data json.RawMessage `json:"data"`
+}
+
+func parsePeeringDBIXPs(payload []byte) ([]ASNRelationship, error) {
+	var response peeringDBResponse
+	if err := json.Unmarshal(payload, &response); err != nil {
+		return nil, err
+	}
+	if len(response.Data) == 0 || string(response.Data) == "null" {
+		return nil, errRelationshipMissingFields
+	}
+	var records []map[string]json.RawMessage
+	if err := json.Unmarshal(response.Data, &records); err != nil {
+		return nil, errRelationshipMissingFields
+	}
+	result := make([]ASNRelationship, 0, len(records))
+	for _, record := range records {
+		id := firstString(record, "ix_id", "ixlan_id", "id")
+		name := firstString(record, "name", "ix_name")
+		if nested, ok := record["ixlan"]; ok {
+			var object map[string]json.RawMessage
+			if json.Unmarshal(nested, &object) == nil {
+				if id == "" {
+					id = firstString(object, "ix_id", "id")
+				}
+				if name == "" {
+					name = firstString(object, "name", "name_long")
+				}
+			}
+		}
+		if nested, ok := record["ix"]; ok {
+			var object map[string]json.RawMessage
+			if json.Unmarshal(nested, &object) == nil {
+				if id == "" {
+					id = firstString(object, "id", "ix_id")
+				}
+				if name == "" {
+					name = firstString(object, "name", "name_long")
+				}
+			}
+		}
+		if id == "" && name == "" {
+			continue
+		}
+		result = append(result, ASNRelationship{
+			Name: name, Kind: RelationshipIXP, Source: "peeringdb",
+			Status: RelationshipAvailable, IXPID: id,
+		})
+	}
+	return dedupeRelationships(result), nil
+}
+
+func firstString(values map[string]json.RawMessage, keys ...string) string {
+	for _, key := range keys {
+		raw, ok := values[key]
+		if !ok {
+			continue
+		}
+		var value string
+		if json.Unmarshal(raw, &value) == nil && strings.TrimSpace(value) != "" {
+			return strings.TrimSpace(value)
+		}
+		if number, err := parseJSONASN(raw); err == nil {
+			return number
+		}
+	}
+	return ""
+}
+
+func sortRelationships(report *ASNRelationshipReport) {
+	report.Upstreams = dedupeRelationships(report.Upstreams)
+	report.Peers = dedupeRelationships(report.Peers)
+	report.IXPs = dedupeRelationships(report.IXPs)
+	sort.Slice(report.SourceStatuses, func(i, j int) bool {
+		return report.SourceStatuses[i].Source < report.SourceStatuses[j].Source
+	})
+}

bgptools/relationships_test.go

@@ -0,0 +1,182 @@
+package bgptools
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestQueryASNRelationshipsFixture(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/ripe":
+			if got := r.URL.Query().Get("resource"); got != "64500" {
+				t.Errorf("resource query = %q", got)
+			}
+			_, _ = w.Write([]byte(`{"data":{"neighbours":[{"asn":64501,"name":"Transit Example","relationship":"upstream","power":12.5},{"asn":"64502","name":"Peer Example","type":"peer","power":3.25},{"asn":64500,"name":"target"}]}}`))
+		case "/peering":
+			if got := r.URL.Query().Get("asn"); got != "64500" {
+				t.Errorf("asn query = %q", got)
+			}
+			_, _ = w.Write([]byte(`{"data":[{"id":101,"ix_id":7,"name":"Example IX"},{"ixlan":{"id":202,"name":"Nested IX"}}]}`))
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	report, err := QueryASNRelationships(context.Background(), "AS64500", RelationshipConfig{
+		Client:       server.Client(),
+		RIPEstatURL:  server.URL + "/ripe",
+		PeeringDBURL: server.URL + "/peering",
+		Timeout:      time.Second,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if report.TargetASN != "64500" || report.Status != RelationshipAvailable {
+		t.Fatalf("unexpected report status: %+v", report)
+	}
+	if len(report.Upstreams) != 1 || report.Upstreams[0].ASN != "64501" || report.Upstreams[0].Source != "ripestat" {
+		t.Fatalf("unexpected upstreams: %+v", report.Upstreams)
+	}
+	if len(report.Peers) != 1 || report.Peers[0].ASN != "64502" {
+		t.Fatalf("unexpected peers: %+v", report.Peers)
+	}
+	if len(report.IXPs) != 2 || report.IXPs[0].Kind != RelationshipIXP {
+		t.Fatalf("unexpected IXPs: %+v", report.IXPs)
+	}
+	for _, source := range report.SourceStatuses {
+		if source.Status != RelationshipAvailable || source.RateLimited || source.Timeout {
+			t.Fatalf("unexpected source status: %+v", source)
+		}
+	}
+}
+
+func TestQueryASNRelationshipsRateLimitAndTimeout(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/limited":
+			w.WriteHeader(http.StatusTooManyRequests)
+		case "/slow":
+			<-r.Context().Done()
+		default:
+			_, _ = w.Write([]byte(`{"data":[]}`))
+		}
+	}))
+	defer server.Close()
+
+	limited, err := QueryASNRelationships(context.Background(), "64500", RelationshipConfig{
+		Client:       server.Client(),
+		RIPEstatURL:  server.URL + "/limited",
+		PeeringDBURL: server.URL + "/peering",
+		Timeout:      time.Second,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if limited.Status != RelationshipPartial || !limited.RateLimited {
+		t.Fatalf("expected partial rate-limited report: %+v", limited)
+	}
+	if status := sourceStatusByName(limited, "ripestat"); status.Status != RelationshipRateLimited || !status.RateLimited || status.Timeout {
+		t.Fatalf("unexpected rate-limit source: %+v", status)
+	}
+
+	timed, err := QueryASNRelationships(context.Background(), "64500", RelationshipConfig{
+		Client:       server.Client(),
+		RIPEstatURL:  server.URL + "/slow",
+		PeeringDBURL: server.URL + "/slow",
+		Timeout:      20 * time.Millisecond,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if timed.Status != RelationshipTimeout || !timed.Timeout {
+		t.Fatalf("expected timeout report: %+v", timed)
+	}
+	for _, source := range timed.SourceStatuses {
+		if source.Status != RelationshipTimeout || !source.Timeout || source.RateLimited {
+			t.Fatalf("unexpected timeout source: %+v", source)
+		}
+	}
+}
+
+func TestQueryASNRelationshipsFieldDrift(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/ripe" {
+			_, _ = w.Write([]byte(`{"data":{"neighbors":[]}}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{"results":[]}`))
+	}))
+	defer server.Close()
+
+	report, err := QueryASNRelationships(context.Background(), "64500", RelationshipConfig{
+		Client:       server.Client(),
+		RIPEstatURL:  server.URL + "/ripe",
+		PeeringDBURL: server.URL + "/peering",
+		Timeout:      time.Second,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if report.Status != RelationshipMissingFields {
+		t.Fatalf("expected missing_fields report: %+v", report)
+	}
+	for _, source := range report.SourceStatuses {
+		if source.Status != RelationshipMissingFields {
+			t.Fatalf("expected missing_fields source, got %+v", source)
+		}
+	}
+}
+
+func TestQueryASNRelationshipsContextCancellation(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		<-r.Context().Done()
+	}))
+	defer server.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	started := time.Now()
+	_, err := QueryASNRelationships(ctx, "64500", RelationshipConfig{
+		Client:       server.Client(),
+		RIPEstatURL:  server.URL,
+		PeeringDBURL: server.URL,
+		Timeout:      time.Second,
+	})
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("expected context cancellation, got %v", err)
+	}
+	if time.Since(started) > 200*time.Millisecond {
+		t.Fatalf("cancellation was not immediate: %v", time.Since(started))
+	}
+}
+
+func TestNormalizeASN(t *testing.T) {
+	for _, input := range []string{"AS64500", " as64500 ", "64500"} {
+		if got, err := normalizeASN(input); err != nil || got != "64500" {
+			t.Fatalf("normalizeASN(%q) = %q, %v", input, got, err)
+		}
+	}
+	for _, input := range []string{"", "AS0", "AS4294967296", "AS-not-an-asn"} {
+		if _, err := normalizeASN(input); err == nil {
+			t.Fatalf("normalizeASN(%q) unexpectedly succeeded", input)
+		}
+	}
+}
+
+func sourceStatusByName(report *ASNRelationshipReport, name string) RelationshipSourceStatus {
+	for _, source := range report.SourceStatuses {
+		if strings.EqualFold(source.Source, name) {
+			return source
+		}
+	}
+	return RelationshipSourceStatus{Source: name, Status: RelationshipError}
+}

bgptools/report.go

@@ -0,0 +1,630 @@
+package bgptools
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+)
+
+// ReportStatus is the provider-neutral status used by the unified IP/BGP
+// report.  A report deliberately keeps source-level failures instead of
+// turning them into an empty successful result.
+type ReportStatus string
+
+const (
+	ReportAvailable     ReportStatus = "available"
+	ReportPartial       ReportStatus = "partial"
+	ReportRateLimited   ReportStatus = "rate_limited"
+	ReportTimeout       ReportStatus = "timeout"
+	ReportMissingFields ReportStatus = "missing_fields"
+	ReportError         ReportStatus = "error"
+	ReportUnsupported   ReportStatus = "unsupported"
+)
+
+// IPBGPSourceStatus records the outcome of one logical source in a unified
+// report.  Error is intentionally a short diagnostic, never a raw response.
+type IPBGPSourceStatus struct {
+	Source string       `json:"source"`
+	Status ReportStatus `json:"status"`
+	Error  string       `json:"error,omitempty"`
+}
+
+// RIRInfo describes the registry inference and its evidence source.  The
+// inference is conservative: country and address ownership are not used as a
+// substitute for an explicit RDAP/WHOIS registry signal.
+type RIRInfo struct {
+	Name   string       `json:"name,omitempty"`
+	Source string       `json:"source,omitempty"`
+	Status ReportStatus `json:"status"`
+}
+
+// GeofeedResult contains an RDAP/WHOIS geofeed URL and, when requested, the
+// bounded fetch result.  The payload itself is not retained in the report.
+type GeofeedResult struct {
+	URL        string       `json:"url"`
+	Status     ReportStatus `json:"status"`
+	HTTPStatus int          `json:"http_status,omitempty"`
+	Bytes      int64        `json:"bytes,omitempty"`
+	Error      string       `json:"error,omitempty"`
+}
+
+// WHOISRecord is the small, structured subset used when RDAP is unavailable
+// or missing required fields.  Raw port-43 text is never returned.
+type WHOISRecord struct {
+	Server           string       `json:"server"`
+	Status           ReportStatus `json:"status"`
+	Prefixes         []string     `json:"prefixes,omitempty"`
+	RegistrationDate *time.Time   `json:"registration_date,omitempty"`
+	GeofeedURLs      []string     `json:"geofeed_urls,omitempty"`
+	RIR              RIRInfo      `json:"rir"`
+}
+
+// IPBGPReport combines RDAP, registry metadata, optional geofeed fetches and
+// ASN relationship data.  Relationships are requested only when ASN or an
+// injected ASN resolver supplies a target ASN.
+type IPBGPReport struct {
+	IP               string                 `json:"ip"`
+	ASN              string                 `json:"asn,omitempty"`
+	Status           ReportStatus           `json:"status"`
+	RDAP             *RDAPRecord            `json:"rdap,omitempty"`
+	WHOIS            *WHOISRecord           `json:"whois,omitempty"`
+	Prefixes         []string               `json:"prefixes,omitempty"`
+	PrefixSource     string                 `json:"prefix_source,omitempty"`
+	RegistrationDate *time.Time             `json:"registration_date,omitempty"`
+	RIR              RIRInfo                `json:"rir"`
+	Geofeeds         []GeofeedResult        `json:"geofeeds,omitempty"`
+	Relationships    *ASNRelationshipReport `json:"relationships,omitempty"`
+	Sources          []IPBGPSourceStatus    `json:"sources"`
+}
+
+// ASNResolver allows a caller to supply an existing, structured IP-to-ASN
+// result without making this package invent a provider or read environment
+// variables.
+type ASNResolver func(context.Context, string) (string, error)
+
+// WHOISDialContext is injectable so port-43 fallback can be tested entirely
+// with a local TCP fixture.
+type WHOISDialContext func(context.Context, string, string) (net.Conn, error)
+
+// IPBGPReportConfig keeps every network dependency explicit and injectable.
+// WHOIS fallback is opt-in; when enabled it always has its own finite timeout.
+type IPBGPReportConfig struct {
+	Timeout time.Duration
+
+	RDAPClient  *http.Client
+	RDAPBaseURL string
+
+	ASN           string
+	ResolveASN    ASNResolver
+	Relationships RelationshipConfig
+
+	FetchGeofeed    bool
+	GeofeedClient   *http.Client
+	GeofeedTimeout  time.Duration
+	MaxGeofeedBytes int64
+
+	EnableWHOISFallback bool
+	WHOISServer         string
+	WHOISTimeout        time.Duration
+	MaxWHOISBytes       int64
+	WHOISDialContext    WHOISDialContext
+
+	WHOISBootstrapClient   *http.Client
+	WHOISBootstrapURL      string
+	MaxWHOISBootstrapBytes int64
+}
+
+const (
+	defaultIPBGPReportTimeout = 15 * time.Second
+	defaultGeofeedTimeout     = 3 * time.Second
+	defaultWHOISTimeout       = 3 * time.Second
+	defaultGeofeedBytes       = 1 << 20
+	defaultWHOISBytes         = 1 << 20
+)
+
+// QueryIPBGPReport executes the structured IP/BGP collection with a bounded
+// context.  Provider failures produce a partial report; invalid input and
+// caller cancellation are returned as errors for compatibility with the
+// lower-level APIs.
+func QueryIPBGPReport(parent context.Context, ip string, cfg IPBGPReportConfig) (*IPBGPReport, error) {
+	if parent == nil {
+		parent = context.Background()
+	}
+	parsed := net.ParseIP(strings.TrimSpace(ip))
+	if parsed == nil {
+		return nil, ErrInvalidIPAddress
+	}
+	if cfg.Timeout <= 0 {
+		cfg.Timeout = defaultIPBGPReportTimeout
+	}
+	ctx, cancel := context.WithTimeout(parent, cfg.Timeout)
+	defer cancel()
+
+	report := &IPBGPReport{IP: parsed.String(), Status: ReportError}
+
+	rdap, rdapErr := QueryRDAP(ctx, report.IP, cfg.RDAPClient, cfg.RDAPBaseURL)
+	rdapStatus := reportStatusForError(rdapErr)
+	if rdapErr == nil {
+		report.RDAP = &rdap
+		report.Prefixes = uniqueSortedStrings(rdap.Prefixes)
+		if len(report.Prefixes) > 0 {
+			report.PrefixSource = "rdap"
+		}
+		report.RegistrationDate = rdap.RegistrationDate
+		rdapStatus = ReportAvailable
+		if len(report.Prefixes) == 0 || report.RegistrationDate == nil {
+			rdapStatus = ReportMissingFields
+		}
+		report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "rdap", Status: rdapStatus})
+	} else {
+		report.Sources = append(report.Sources, sourceStatusForError("rdap", rdapStatus, rdapErr))
+	}
+
+	report.RIR = inferRIR(rdap, rdapErr == nil)
+	if report.RIR.Status == "" {
+		report.RIR.Status = ReportMissingFields
+	}
+
+	if cfg.EnableWHOISFallback && (rdapErr != nil || len(report.Prefixes) == 0 || report.RegistrationDate == nil || report.RIR.Status != ReportAvailable) {
+		server := strings.TrimSpace(cfg.WHOISServer)
+		if server == "" {
+			server = strings.TrimSpace(rdap.Port43)
+		}
+		if server == "" {
+			resolved, err := resolveWHOISServer(ctx, report.IP, cfg)
+			if err != nil {
+				report.Sources = append(report.Sources, sourceStatusForError("whois_bootstrap", reportStatusForError(err), err))
+			} else {
+				server = resolved
+				report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "whois_bootstrap", Status: ReportAvailable})
+			}
+		}
+		if server == "" {
+			status := IPBGPSourceStatus{Source: "whois", Status: ReportUnsupported, Error: "no port-43 server resolved"}
+			report.Sources = append(report.Sources, status)
+		} else {
+			whois, err := queryWHOIS(ctx, report.IP, server, cfg)
+			if err != nil {
+				report.Sources = append(report.Sources, sourceStatusForError("whois", reportStatusForError(err), err))
+			} else {
+				report.WHOIS = &whois
+				report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "whois", Status: whois.Status})
+				if len(report.Prefixes) == 0 && len(whois.Prefixes) > 0 {
+					report.Prefixes = append([]string(nil), whois.Prefixes...)
+					report.PrefixSource = "whois"
+				}
+				if report.RegistrationDate == nil {
+					report.RegistrationDate = whois.RegistrationDate
+				}
+				if report.RIR.Status != ReportAvailable && whois.RIR.Status == ReportAvailable {
+					report.RIR = whois.RIR
+				}
+			}
+		}
+	}
+	report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "rir", Status: report.RIR.Status})
+
+	geofeedURLs := append([]string(nil), rdap.GeofeedURLs...)
+	if report.WHOIS != nil {
+		geofeedURLs = append(geofeedURLs, report.WHOIS.GeofeedURLs...)
+	}
+	geofeedURLs = uniqueSortedStrings(geofeedURLs)
+	if report.RDAP != nil {
+		report.RDAP.GeofeedURLs = sanitizeReportURLs(report.RDAP.GeofeedURLs)
+	}
+	if report.WHOIS != nil {
+		report.WHOIS.GeofeedURLs = sanitizeReportURLs(report.WHOIS.GeofeedURLs)
+	}
+	for _, geofeedURL := range geofeedURLs {
+		if !cfg.FetchGeofeed {
+			report.Geofeeds = append(report.Geofeeds, GeofeedResult{URL: geofeedURL, Status: ReportUnsupported, Error: "fetch disabled"})
+			continue
+		}
+		result := fetchGeofeed(ctx, geofeedURL, cfg)
+		report.Geofeeds = append(report.Geofeeds, result)
+		report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "geofeed", Status: result.Status, Error: result.Error})
+	}
+
+	asn := strings.TrimSpace(cfg.ASN)
+	if asn == "" && cfg.ResolveASN != nil {
+		resolved, err := cfg.ResolveASN(ctx, report.IP)
+		if err != nil {
+			report.Sources = append(report.Sources, sourceStatusForError("asn_resolver", reportStatusForError(err), err))
+		} else {
+			asn = strings.TrimSpace(resolved)
+			report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "asn_resolver", Status: ReportAvailable})
+		}
+	}
+	if asn != "" {
+		normalizedASN, err := normalizeASN(asn)
+		if err != nil {
+			return report, err
+		}
+		report.ASN = normalizedASN
+		relationships, err := QueryASNRelationships(ctx, normalizedASN, cfg.Relationships)
+		if relationships != nil {
+			report.Relationships = relationships
+		}
+		if err != nil {
+			if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+				return report, err
+			}
+			report.Sources = append(report.Sources, sourceStatusForError("asn_relationships", reportStatusForError(err), err))
+		} else {
+			report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "asn_relationships", Status: reportStatusFromRelationship(relationships.Status)})
+		}
+	} else {
+		report.Sources = append(report.Sources, IPBGPSourceStatus{Source: "asn_relationships", Status: ReportUnsupported, Error: "ASN not supplied"})
+	}
+
+	if err := ctx.Err(); err != nil {
+		return report, err
+	}
+	report.Prefixes = uniqueSortedStrings(report.Prefixes)
+	sort.SliceStable(report.Sources, func(i, j int) bool { return report.Sources[i].Source < report.Sources[j].Source })
+	report.Status = aggregateReportStatus(report.Sources)
+	return report, nil
+}
+
+// QueryIPBGP is a short alias for callers that prefer the domain name over the
+// implementation-oriented Report suffix.
+func QueryIPBGP(ctx context.Context, ip string, cfg IPBGPReportConfig) (*IPBGPReport, error) {
+	return QueryIPBGPReport(ctx, ip, cfg)
+}
+
+func inferRIR(record RDAPRecord, available bool) RIRInfo {
+	if !available {
+		return RIRInfo{Status: ReportMissingFields}
+	}
+	text := strings.Join([]string{record.Source, record.Port43, record.Handle, record.ParentHandle}, " ")
+	if name := rirNameFromText(text); name != "" {
+		return RIRInfo{Name: name, Source: "rdap", Status: ReportAvailable}
+	}
+	return RIRInfo{Source: "rdap", Status: ReportMissingFields}
+}
+
+func fetchGeofeed(parent context.Context, rawURL string, cfg IPBGPReportConfig) GeofeedResult {
+	result := GeofeedResult{URL: sanitizeReportURL(rawURL)}
+	u, err := url.Parse(rawURL)
+	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
+		result.Status = ReportUnsupported
+		result.Error = "unsupported geofeed URL"
+		return result
+	}
+	timeout := cfg.GeofeedTimeout
+	if timeout <= 0 {
+		timeout = defaultGeofeedTimeout
+	}
+	maxBytes := cfg.MaxGeofeedBytes
+	if maxBytes <= 0 {
+		maxBytes = defaultGeofeedBytes
+	}
+	client := cfg.GeofeedClient
+	if client == nil {
+		client = &http.Client{}
+	}
+	ctx, cancel := context.WithTimeout(parent, timeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		result.Status = ReportError
+		result.Error = stableReportError(result.Status, err)
+		return result
+	}
+	req.Header.Set("Accept", "text/csv, text/plain, */*")
+	req.Header.Set("User-Agent", "oneclickvirt-backtrace-geofeed/1")
+	resp, err := client.Do(req)
+	if err != nil {
+		result.Status = reportStatusForError(err)
+		result.Error = stableReportError(result.Status, err)
+		return result
+	}
+	defer resp.Body.Close()
+	result.HTTPStatus = resp.StatusCode
+	if resp.StatusCode == http.StatusTooManyRequests {
+		result.Status = ReportRateLimited
+		result.Error = fmt.Sprintf("HTTP %d", resp.StatusCode)
+		return result
+	}
+	if resp.StatusCode == http.StatusRequestTimeout || resp.StatusCode == http.StatusGatewayTimeout {
+		result.Status = ReportTimeout
+		result.Error = fmt.Sprintf("HTTP %d", resp.StatusCode)
+		return result
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		result.Status = ReportError
+		result.Error = fmt.Sprintf("HTTP %d", resp.StatusCode)
+		return result
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxBytes+1))
+	if err != nil {
+		result.Status = reportStatusForError(err)
+		result.Error = stableReportError(result.Status, err)
+		return result
+	}
+	if int64(len(body)) > maxBytes {
+		result.Status = ReportError
+		result.Error = fmt.Sprintf("response exceeds %d bytes", maxBytes)
+		return result
+	}
+	result.Status = ReportAvailable
+	result.Bytes = int64(len(body))
+	return result
+}
+
+func queryWHOIS(parent context.Context, ip, server string, cfg IPBGPReportConfig) (WHOISRecord, error) {
+	address, err := normalizeWHOISAddress(server)
+	if err != nil {
+		return WHOISRecord{}, err
+	}
+	timeout := cfg.WHOISTimeout
+	if timeout <= 0 {
+		timeout = defaultWHOISTimeout
+	}
+	maxBytes := cfg.MaxWHOISBytes
+	if maxBytes <= 0 {
+		maxBytes = defaultWHOISBytes
+	}
+	ctx, cancel := context.WithTimeout(parent, timeout)
+	defer cancel()
+	dial := cfg.WHOISDialContext
+	if dial == nil {
+		dialer := &net.Dialer{}
+		dial = dialer.DialContext
+	}
+	conn, err := dial(ctx, "tcp", address)
+	if err != nil {
+		return WHOISRecord{}, err
+	}
+	defer conn.Close()
+	if deadline, ok := ctx.Deadline(); ok {
+		_ = conn.SetDeadline(deadline)
+	}
+	if _, err := fmt.Fprintf(conn, "%s\r\n", ip); err != nil {
+		return WHOISRecord{}, err
+	}
+	body, err := io.ReadAll(io.LimitReader(conn, maxBytes+1))
+	if err != nil {
+		return WHOISRecord{}, err
+	}
+	if int64(len(body)) > maxBytes {
+		return WHOISRecord{}, fmt.Errorf("whois response exceeds %d bytes", maxBytes)
+	}
+	result, err := parseWHOISRecord(address, body)
+	if err != nil {
+		return WHOISRecord{}, err
+	}
+	if len(result.Prefixes) == 0 && result.RegistrationDate == nil && result.RIR.Status != ReportAvailable && len(result.GeofeedURLs) == 0 {
+		result.Status = ReportMissingFields
+	} else {
+		result.Status = ReportAvailable
+	}
+	return result, nil
+}
+
+func normalizeWHOISAddress(server string) (string, error) {
+	server = strings.TrimSpace(strings.TrimPrefix(strings.TrimPrefix(server, "whois://"), "tcp://"))
+	if server == "" || strings.ContainsAny(server, "/ \t\r\n") {
+		return "", errors.New("invalid WHOIS server")
+	}
+	if host, port, err := net.SplitHostPort(server); err == nil {
+		if host == "" || port == "" {
+			return "", errors.New("invalid WHOIS server")
+		}
+		return net.JoinHostPort(host, port), nil
+	}
+	if strings.Contains(server, ":") && net.ParseIP(server) == nil {
+		return "", errors.New("invalid WHOIS server")
+	}
+	return net.JoinHostPort(server, "43"), nil
+}
+
+func parseWHOISRecord(server string, body []byte) (WHOISRecord, error) {
+	result := WHOISRecord{Server: server, RIR: RIRInfo{Status: ReportMissingFields}}
+	scanner := bufio.NewScanner(strings.NewReader(string(body)))
+	scanner.Buffer(make([]byte, 1024), 1<<20)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "%") || strings.HasPrefix(line, "#") {
+			continue
+		}
+		key, value, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		key = strings.ToLower(strings.TrimSpace(key))
+		value = strings.TrimSpace(value)
+		switch key {
+		case "cidr", "route", "route6", "inet6route", "prefix":
+			for _, item := range strings.FieldsFunc(value, func(r rune) bool { return r == ',' || r == ';' || r == ' ' || r == '\t' }) {
+				if normalized, ok := normalizeWHOISPrefix(item); ok {
+					result.Prefixes = append(result.Prefixes, normalized)
+				}
+			}
+		case "registration date", "regdate", "created", "created date", "creation date":
+			if parsed, ok := parseWHOISDate(value); ok {
+				result.RegistrationDate = &parsed
+			}
+		case "geofeed", "geofeed url", "geofeed-url":
+			if parsed, err := url.Parse(value); err == nil && parsed.Host != "" && (parsed.Scheme == "http" || parsed.Scheme == "https") {
+				result.GeofeedURLs = append(result.GeofeedURLs, parsed.String())
+			}
+		case "rir", "registry", "source", "whois server":
+			if name := rirNameFromText(value); name != "" {
+				result.RIR = RIRInfo{Name: name, Source: "whois", Status: ReportAvailable}
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return WHOISRecord{}, err
+	}
+	result.Prefixes = uniqueSortedStrings(result.Prefixes)
+	result.GeofeedURLs = uniqueSortedStrings(result.GeofeedURLs)
+	if result.RIR.Status != ReportAvailable {
+		if name := rirNameFromText(server); name != "" {
+			result.RIR = RIRInfo{Name: name, Source: "whois", Status: ReportAvailable}
+		}
+	}
+	return result, nil
+}
+
+func normalizeWHOISPrefix(value string) (string, bool) {
+	value = strings.TrimSpace(value)
+	_, network, err := net.ParseCIDR(value)
+	if err != nil {
+		return "", false
+	}
+	return network.String(), true
+}
+
+func parseWHOISDate(value string) (time.Time, bool) {
+	value = strings.TrimSpace(value)
+	for _, layout := range []string{
+		time.RFC3339,
+		"2006-01-02 15:04:05",
+		"2006-01-02",
+		"02-Jan-2006",
+		"20060102",
+	} {
+		if parsed, err := time.Parse(layout, value); err == nil {
+			return parsed, true
+		}
+	}
+	return time.Time{}, false
+}
+
+func rirNameFromText(value string) string {
+	tokens := strings.FieldsFunc(strings.ToLower(value), func(r rune) bool {
+		return !((r >= 'a' && r <= 'z') || (r >= '0' && r <= '9'))
+	})
+	registries := map[string]string{
+		"arin":    "ARIN",
+		"ripe":    "RIPE NCC",
+		"apnic":   "APNIC",
+		"lacnic":  "LACNIC",
+		"afrinic": "AFRINIC",
+	}
+	for _, token := range tokens {
+		if name := registries[token]; name != "" {
+			return name
+		}
+	}
+	return ""
+}
+
+func sourceStatusForError(source string, status ReportStatus, err error) IPBGPSourceStatus {
+	item := IPBGPSourceStatus{Source: source, Status: status}
+	if err != nil {
+		item.Error = stableReportError(status, err)
+	}
+	return item
+}
+
+func stableReportError(status ReportStatus, err error) string {
+	if errors.Is(err, context.Canceled) {
+		return "canceled"
+	}
+	switch status {
+	case ReportRateLimited:
+		return "rate_limited"
+	case ReportTimeout:
+		return "timeout"
+	case ReportUnsupported:
+		return "unsupported"
+	case ReportMissingFields:
+		return "missing_fields"
+	default:
+		return "request_failed"
+	}
+}
+
+func sanitizeReportURL(raw string) string {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil || parsed.Host == "" || (parsed.Scheme != "http" && parsed.Scheme != "https") {
+		return ""
+	}
+	parsed.User = nil
+	parsed.RawQuery = ""
+	parsed.ForceQuery = false
+	parsed.Fragment = ""
+	return parsed.String()
+}
+
+func sanitizeReportURLs(values []string) []string {
+	result := make([]string, 0, len(values))
+	for _, value := range values {
+		if sanitized := sanitizeReportURL(value); sanitized != "" {
+			result = append(result, sanitized)
+		}
+	}
+	return uniqueSortedStrings(result)
+}
+
+func reportStatusForError(err error) ReportStatus {
+	if err == nil {
+		return ReportAvailable
+	}
+	if errors.Is(err, ErrRDAPRateLimited) || errors.Is(err, ErrOriginASNRateLimited) {
+		return ReportRateLimited
+	}
+	if errors.Is(err, context.DeadlineExceeded) || netErrTimeout(err) {
+		return ReportTimeout
+	}
+	return ReportError
+}
+
+func reportStatusFromRelationship(status RelationshipStatus) ReportStatus {
+	switch status {
+	case RelationshipAvailable:
+		return ReportAvailable
+	case RelationshipPartial:
+		return ReportPartial
+	case RelationshipRateLimited:
+		return ReportRateLimited
+	case RelationshipTimeout:
+		return ReportTimeout
+	case RelationshipMissingFields:
+		return ReportMissingFields
+	case RelationshipUnsupported:
+		return ReportUnsupported
+	default:
+		return ReportError
+	}
+}
+
+func aggregateReportStatus(sources []IPBGPSourceStatus) ReportStatus {
+	if len(sources) == 0 {
+		return ReportUnsupported
+	}
+	hasAvailable := false
+	var first ReportStatus
+	for _, source := range sources {
+		if source.Status == ReportAvailable {
+			hasAvailable = true
+			continue
+		}
+		if first == "" {
+			first = source.Status
+		}
+	}
+	if first == "" {
+		return ReportAvailable
+	}
+	if hasAvailable {
+		return ReportPartial
+	}
+	for _, source := range sources {
+		if source.Status != first {
+			return ReportPartial
+		}
+	}
+	return first
+}

bgptools/report_test.go

@@ -0,0 +1,252 @@
+package bgptools
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestQueryIPBGPReportOfflineFixtures(t *testing.T) {
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasPrefix(r.URL.Path, "/rdap/"):
+			if got := strings.TrimPrefix(r.URL.Path, "/rdap/"); got != "192.0.2.1" {
+				t.Errorf("RDAP IP = %q", got)
+			}
+			w.Header().Set("Content-Type", "application/rdap+json")
+			_, _ = fmt.Fprintf(w, `{"handle":"NET-ARIN-TEST","port43":"whois.arin.net","cidr0_cidrs":[{"v4prefix":"192.0.2.42","length":24}],"events":[{"eventAction":"registration","eventDate":"2020-01-02T03:04:05Z"}],"links":[{"rel":"geofeed","href":%q}]}`, server.URL+"/geofeed.csv")
+		case r.URL.Path == "/geofeed.csv":
+			_, _ = io.WriteString(w, "192.0.2.0/24,US,US-CA,Example City,\n")
+		case r.URL.Path == "/ripe":
+			if got := r.URL.Query().Get("resource"); got != "64500" {
+				t.Errorf("resource query = %q", got)
+			}
+			_, _ = io.WriteString(w, `{"data":{"neighbours":[{"asn":64501,"name":"Transit","relationship":"upstream"},{"asn":64502,"name":"Peer","relationship":"peer"}]}}`)
+		case r.URL.Path == "/peering":
+			_, _ = io.WriteString(w, `{"data":[{"ix_id":7,"name":"Example IX"}]}`)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	report, err := QueryIPBGPReport(context.Background(), "192.0.2.1", IPBGPReportConfig{
+		Timeout:       time.Second,
+		RDAPClient:    server.Client(),
+		RDAPBaseURL:   server.URL + "/rdap",
+		FetchGeofeed:  true,
+		GeofeedClient: server.Client(),
+		ResolveASN: func(_ context.Context, ip string) (string, error) {
+			if ip != "192.0.2.1" {
+				t.Fatalf("resolver IP = %q", ip)
+			}
+			return "AS64500", nil
+		},
+		Relationships: RelationshipConfig{
+			Client:       server.Client(),
+			RIPEstatURL:  server.URL + "/ripe",
+			PeeringDBURL: server.URL + "/peering",
+			Timeout:      time.Second,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if report.Status != ReportAvailable || report.IP != "192.0.2.1" || report.ASN != "64500" {
+		t.Fatalf("unexpected report identity/status: %+v", report)
+	}
+	if len(report.Prefixes) != 1 || report.Prefixes[0] != "192.0.2.0/24" || report.PrefixSource != "rdap" {
+		t.Fatalf("unexpected prefixes: %+v source=%q", report.Prefixes, report.PrefixSource)
+	}
+	if report.RIR.Name != "ARIN" || report.RIR.Status != ReportAvailable || report.RegistrationDate == nil {
+		t.Fatalf("unexpected registry fields: RIR=%+v registration=%v", report.RIR, report.RegistrationDate)
+	}
+	if len(report.Geofeeds) != 1 || report.Geofeeds[0].Status != ReportAvailable || report.Geofeeds[0].Bytes == 0 {
+		t.Fatalf("unexpected geofeed result: %+v", report.Geofeeds)
+	}
+	if report.Relationships == nil || len(report.Relationships.Upstreams) != 1 || len(report.Relationships.Peers) != 1 || len(report.Relationships.IXPs) != 1 {
+		t.Fatalf("unexpected relationships: %+v", report.Relationships)
+	}
+}
+
+func TestQueryIPBGPReportWHOISFallbackTCPFixture(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+	tcpErr := make(chan error, 1)
+	go func() {
+		conn, err := listener.Accept()
+		if err != nil {
+			tcpErr <- err
+			return
+		}
+		defer conn.Close()
+		query, err := bufio.NewReader(conn).ReadString('\n')
+		if err != nil {
+			tcpErr <- err
+			return
+		}
+		if strings.TrimSpace(query) != "203.0.113.9" {
+			tcpErr <- fmt.Errorf("WHOIS query = %q", query)
+			return
+		}
+		_, err = io.WriteString(conn, "CIDR: 203.0.113.99/24\r\nRegDate: 2021-02-03\r\nSource: ARIN\r\nGeofeed: https://example.test/geofeed.csv\r\n")
+		tcpErr <- err
+	}()
+
+	rdapServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "unavailable", http.StatusServiceUnavailable)
+	}))
+	defer rdapServer.Close()
+
+	report, err := QueryIPBGPReport(context.Background(), "203.0.113.9", IPBGPReportConfig{
+		Timeout:             time.Second,
+		RDAPClient:          rdapServer.Client(),
+		RDAPBaseURL:         rdapServer.URL,
+		EnableWHOISFallback: true,
+		WHOISServer:         listener.Addr().String(),
+		WHOISTimeout:        250 * time.Millisecond,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := <-tcpErr; err != nil {
+		t.Fatal(err)
+	}
+	if report.Status != ReportPartial || report.WHOIS == nil || report.WHOIS.Status != ReportAvailable {
+		t.Fatalf("unexpected fallback status: %+v", report)
+	}
+	if report.PrefixSource != "whois" || len(report.Prefixes) != 1 || report.Prefixes[0] != "203.0.113.0/24" {
+		t.Fatalf("unexpected WHOIS prefixes: %+v", report.Prefixes)
+	}
+	if report.RIR.Name != "ARIN" || report.RIR.Source != "whois" || report.RegistrationDate == nil {
+		t.Fatalf("unexpected WHOIS metadata: RIR=%+v registration=%v", report.RIR, report.RegistrationDate)
+	}
+	if len(report.Geofeeds) != 1 || report.Geofeeds[0].Status != ReportUnsupported {
+		t.Fatalf("disabled geofeed fetch was not explicit: %+v", report.Geofeeds)
+	}
+}
+
+func TestQueryIPBGPReportWHOISTimeoutIsBounded(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer listener.Close()
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		conn, err := listener.Accept()
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		_, _ = bufio.NewReader(conn).ReadString('\n')
+		_, _ = io.Copy(io.Discard, conn)
+	}()
+
+	rdapServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "unavailable", http.StatusServiceUnavailable)
+	}))
+	defer rdapServer.Close()
+
+	started := time.Now()
+	report, err := QueryIPBGPReport(context.Background(), "198.51.100.1", IPBGPReportConfig{
+		Timeout:             time.Second,
+		RDAPClient:          rdapServer.Client(),
+		RDAPBaseURL:         rdapServer.URL,
+		EnableWHOISFallback: true,
+		WHOISServer:         listener.Addr().String(),
+		WHOISTimeout:        30 * time.Millisecond,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if elapsed := time.Since(started); elapsed > 500*time.Millisecond {
+		t.Fatalf("WHOIS timeout took %v", elapsed)
+	}
+	if source := unifiedSourceByName(report, "whois"); source.Status != ReportTimeout {
+		t.Fatalf("WHOIS source = %+v, want timeout", source)
+	}
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("TCP fixture did not observe connection cleanup")
+	}
+}
+
+func TestQueryIPBGPReportResolvesWHOISFromIANABootstrap(t *testing.T) {
+	bootstrap := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, `{"services":[[["203.0.113.0/24"],["https://rdap.arin.net/registry/"]]]}`)
+	}))
+	defer bootstrap.Close()
+	rdapServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "unavailable", http.StatusServiceUnavailable)
+	}))
+	defer rdapServer.Close()
+
+	dialed := make(chan string, 1)
+	report, err := QueryIPBGPReport(context.Background(), "203.0.113.9", IPBGPReportConfig{
+		Timeout:              time.Second,
+		RDAPClient:           rdapServer.Client(),
+		RDAPBaseURL:          rdapServer.URL,
+		EnableWHOISFallback:  true,
+		WHOISBootstrapClient: bootstrap.Client(),
+		WHOISBootstrapURL:    bootstrap.URL,
+		WHOISTimeout:         250 * time.Millisecond,
+		WHOISDialContext: func(_ context.Context, _, address string) (net.Conn, error) {
+			dialed <- address
+			client, server := net.Pipe()
+			go func() {
+				defer server.Close()
+				_, _ = bufio.NewReader(server).ReadString('\n')
+				_, _ = io.WriteString(server, "CIDR: 203.0.113.0/24\r\nSource: ARIN\r\n")
+			}()
+			return client, nil
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := <-dialed; got != "whois.arin.net:43" {
+		t.Fatalf("WHOIS address = %q", got)
+	}
+	if report.WHOIS == nil || report.WHOIS.Status != ReportAvailable || unifiedSourceByName(report, "whois_bootstrap").Status != ReportAvailable {
+		t.Fatalf("bootstrap WHOIS evidence missing: %+v", report)
+	}
+}
+
+func TestQueryIPBGPReportRejectsInvalidInput(t *testing.T) {
+	if _, err := QueryIPBGPReport(context.Background(), "", IPBGPReportConfig{}); !errors.Is(err, ErrInvalidIPAddress) {
+		t.Fatalf("error = %v, want %v", err, ErrInvalidIPAddress)
+	}
+}
+
+func TestRIRInferenceRequiresTokenBoundary(t *testing.T) {
+	if got := rirNameFromText("https://example.test/stripe-network"); got != "" {
+		t.Fatalf("false RIR inference = %q", got)
+	}
+	if got := rirNameFromText("whois.ripe.net"); got != "RIPE NCC" {
+		t.Fatalf("RIR inference = %q, want RIPE NCC", got)
+	}
+}
+
+func unifiedSourceByName(report *IPBGPReport, name string) IPBGPSourceStatus {
+	for _, source := range report.Sources {
+		if source.Source == name {
+			return source
+		}
+	}
+	return IPBGPSourceStatus{Source: name, Status: ReportError, Error: "not found"}
+}

bgptools/whois_bootstrap.go

@@ -0,0 +1,125 @@
+package bgptools
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+const (
+	defaultIPv4BootstrapURL   = "https://data.iana.org/rdap/ipv4.json"
+	defaultIPv6BootstrapURL   = "https://data.iana.org/rdap/ipv6.json"
+	defaultWHOISBootstrapSize = 4 << 20
+)
+
+var errWHOISBootstrapMissing = errors.New("IANA bootstrap has no WHOIS service for IP")
+
+// resolveWHOISServer uses the IANA RDAP bootstrap only to identify the
+// responsible RIR. The actual fallback remains a bounded port-43 query.
+func resolveWHOISServer(ctx context.Context, ip string, cfg IPBGPReportConfig) (string, error) {
+	parsed := net.ParseIP(strings.TrimSpace(ip))
+	if parsed == nil {
+		return "", ErrInvalidIPAddress
+	}
+	bootstrapURL := strings.TrimSpace(cfg.WHOISBootstrapURL)
+	if bootstrapURL == "" {
+		bootstrapURL = defaultIPv6BootstrapURL
+		if parsed.To4() != nil {
+			bootstrapURL = defaultIPv4BootstrapURL
+		}
+	}
+	client := cfg.WHOISBootstrapClient
+	if client == nil {
+		client = cfg.RDAPClient
+	}
+	if client == nil {
+		client = &http.Client{}
+	}
+	maximum := cfg.MaxWHOISBootstrapBytes
+	if maximum <= 0 {
+		maximum = defaultWHOISBootstrapSize
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, bootstrapURL, nil)
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("User-Agent", "oneclickvirt-backtrace-whois-bootstrap/1")
+	response, err := client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("IANA bootstrap HTTP %d", response.StatusCode)
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, maximum+1))
+	if err != nil {
+		return "", err
+	}
+	if int64(len(body)) > maximum {
+		return "", fmt.Errorf("IANA bootstrap response exceeds %d bytes", maximum)
+	}
+	var payload struct {
+		Services [][][]string `json:"services"`
+	}
+	if err := json.Unmarshal(body, &payload); err != nil {
+		return "", err
+	}
+
+	bestPrefix := -1
+	bestServer := ""
+	for _, service := range payload.Services {
+		if len(service) < 2 {
+			continue
+		}
+		server := whoisServerForRDAPURLs(service[1])
+		if server == "" {
+			continue
+		}
+		for _, prefix := range service[0] {
+			_, network, err := net.ParseCIDR(strings.TrimSpace(prefix))
+			if err != nil || !network.Contains(parsed) {
+				continue
+			}
+			ones, _ := network.Mask.Size()
+			if ones > bestPrefix {
+				bestPrefix = ones
+				bestServer = server
+			}
+		}
+	}
+	if bestServer == "" {
+		return "", errWHOISBootstrapMissing
+	}
+	return bestServer, nil
+}
+
+func whoisServerForRDAPURLs(values []string) string {
+	for _, value := range values {
+		parsed, err := url.Parse(strings.TrimSpace(value))
+		if err != nil {
+			continue
+		}
+		host := strings.ToLower(parsed.Hostname())
+		switch {
+		case strings.Contains(host, "arin.net"):
+			return "whois.arin.net"
+		case strings.Contains(host, "apnic.net"):
+			return "whois.apnic.net"
+		case strings.Contains(host, "ripe.net"):
+			return "whois.ripe.net"
+		case strings.Contains(host, "afrinic.net"):
+			return "whois.afrinic.net"
+		case strings.Contains(host, "lacnic.net"):
+			return "whois.lacnic.net"
+		}
+	}
+	return ""
+}

bk/backtrace.go

@@ -16,6 +16,7 @@ func safeTraceCall(fn func()) {
 }
 
 func BackTrace(enableIpv6 bool) string {
+	StartASNPrefixRefresh()
 	if model.CachedIcmpData == "" || model.ParsedIcmpTargets == nil || time.Since(model.CachedIcmpDataFetchTime) > time.Hour {
 		model.CachedIcmpData = getData(model.IcmpTargets)
 		model.CachedIcmpDataFetchTime = time.Now()

bk/ipv6_asn.go

@@ -1,8 +1,9 @@
 package backtrace
 
 import (
-	"strings"
 	_ "embed"
+	"net/netip"
+	"strings"
 )
 
 //go:embed prefix/as4809.txt
@@ -44,12 +45,20 @@ var asnPrefixes = map[string][]string{
 // 判断 IPv6 地址是否匹配 ASN 中的某个前缀
 func ipv6Asn(ip string) string {
 	ip = strings.ToLower(ip)
-	for asn, prefixes := range asnPrefixes {
+	for asn, prefixes := range currentASNPrefixes() {
 		for _, prefix := range prefixes {
 			prefix = strings.TrimSpace(prefix)
 			if prefix == "" {
 				continue
 			}
+			if strings.Contains(prefix, "/") {
+				address, addressErr := netip.ParseAddr(ip)
+				network, networkErr := netip.ParsePrefix(prefix)
+				if addressErr == nil && networkErr == nil && network.Contains(address) {
+					return asn
+				}
+				continue
+			}
 			if strings.HasPrefix(ip, prefix) {
 				return asn
 			}

bk/prefix/as23764.txt

@@ -1,30 +1,28 @@
-2400:9380:9002
-2400:9380:9115
-2400:9380:9116
-2400:9380:9206
-2400:9380:9262
-2400:9380:a003
-2400:9380:a00a
-2400:9380:a00c
-2400:9380:a014
-2400:9380:a016
-2400:9380:a01f
-2400:9380:a022
-2400:9380:a026
-2400:9380:a028
-2400:9380:a042
-2400:9380:a110
-240e:97d:8000
-2804:1e48:9003
-2a04:f580:9001
-2a04:f580:9090
-2a04:f581:110b
-2a04:f581:a123
-2a04:f581:a125
-2c0f:f7a8:1
-2c0f:f7a8:2
-2c0f:f7a8:24
-2c0f:f7a8:29
-2c0f:f7a8:37
-2c0f:f7a8:47
-2c0f:f7a8:9011
+2400:9380:9002::/48
+2400:9380:9115::/48
+2400:9380:9116::/48
+2400:9380:9206::/48
+2400:9380:a003::/48
+2400:9380:a00a::/48
+2400:9380:a00c::/48
+2400:9380:a014::/48
+2400:9380:a016::/48
+2400:9380:a01f::/48
+2400:9380:a022::/48
+2400:9380:a028::/48
+2400:9380:a042::/48
+2400:9380:a110::/48
+240e:97d:8000::/48
+2804:1e48:9003::/48
+2a04:f580:9001::/48
+2a04:f580:9090::/48
+2a04:f581:110b::/48
+2a04:f581:a123::/48
+2a04:f581:a125::/48
+2c0f:f7a8:1::/48
+2c0f:f7a8:24::/48
+2c0f:f7a8:29::/48
+2c0f:f7a8:2::/48
+2c0f:f7a8:37::/48
+2c0f:f7a8:47::/48
+2c0f:f7a8:9011::/48

bk/prefix/as23764.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as23764.txt",
+  "count": 28,
+  "sha256": "d853ef48792875af80682ebfb9817bbbcfefd0f904cf057568664d3bdb9373bb",
+  "generated_at": "2026-07-20T19:12:53Z"
+}

bk/prefix/as4134.txt

@@ -1,255 +1,629 @@
-2400:9380:8001
-2400:9380:8003
-2400:9380:8021
-2400:9380:8040
-2400:9380:8140
-2400:9380:8201
-2400:9380:8301
-240e
-240e:1
-240e:100
-240e:101
-240e:103
-240e:104
-240e:106
-240e:108
-240e:11
-240e:11:8001
-240e:12
-240e:144
-240e:16:1001
-240e:16:1008
-240e:16:1009
-240e:184
-240e:1a
-240e:1c7
-240e:1c:112
-240e:2
-240e:218
-240e:219
-240e:21a
-240e:21b
-240e:224
-240e:225
-240e:226
-240e:227
-240e:24
-240e:240
-240e:241
-240e:242
-240e:243
-240e:244
-240e:245
-240e:246
-240e:247
-240e:2c
-240e:318
-240e:319
-240e:31a
-240e:31b
-240e:324
-240e:325
-240e:326
-240e:327
-240e:340
-240e:341
-240e:342
-240e:343
-240e:350:205
-240e:41
-240e:418
-240e:419
-240e:41a
-240e:41b
-240e:42
-240e:424
-240e:425
-240e:426
-240e:427
-240e:42:4000
-240e:43
-240e:43:8000
-240e:44
-240e:440
-240e:441
-240e:442
-240e:443
-240e:444
-240e:445
-240e:446
-240e:447
-240e:45
-240e:45:8000
-240e:46
-240e:46:5008
-240e:47
-240e:47:4
-240e:48
-240e:49
-240e:4a
-240e:4a:4100
-240e:4b
-240e:4b:2
-240e:4c
-240e:4c:4006
-240e:4d
-240e:4d:50ff
-240e:4e
-240e:4e:4000
-240e:4f
-240e:50
-240e:51
-240e:518
-240e:519
-240e:51a
-240e:51b
-240e:52
-240e:524
-240e:525
-240e:526
-240e:527
-240e:52:4802
-240e:53
-240e:54
-240e:540
-240e:541
-240e:542
-240e:543
-240e:544
-240e:545
-240e:546
-240e:547
-240e:55
-240e:56
-240e:56:4807
-240e:57
-240e:5a
-240e:5a:6800
-240e:5b
-240e:5c
-240e:5d
-240e:5e
-240e:5f
-240e:618
-240e:619
-240e:61a
-240e:61b
-240e:61d:1401
-240e:624
-240e:625
-240e:626
-240e:627
-240e:630:b83
-240e:638
-240e:638:b00
-240e:638:b02
-240e:64
-240e:640
-240e:641
-240e:642
-240e:643
-240e:64c:340
-240e:650:2540
-240e:650:280
-240e:650:4400
-240e:658:6c20
-240e:658:6c31
-240e:658:a00
-240e:659:1160
-240e:659:11e0
-240e:659:1b0
-240e:661:6180
-240e:699
-240e:6a0
-240e:6a0:10
-240e:6a0:100
-240e:6a0:105
-240e:6a0:b0c
-240e:7
-240e:718
-240e:719
-240e:71a
-240e:71b
-240e:724
-240e:725
-240e:726
-240e:727
-240e:740
-240e:741
-240e:742
-240e:743
-240e:767
-240e:840
-240e:841
-240e:9
-240e:918
-240e:919
-240e:91a
-240e:91b
-240e:924
-240e:925
-240e:926
-240e:927
-240e:940
-240e:941
-240e:942
-240e:943
-240e:944
-240e:945
-240e:946
-240e:947
-240e:980
-240e:981
-240e:982
-240e:983
-240e:9f:8340
-240e:9f:8400
-240e:9f:8440
-240e:9f:8880
-240e:9f:88c0
-240e:a0c
-240e:a0d
-240e:a0e
-240e:a0f
-240e:a18
-240e:a19
-240e:a1a
-240e:a1b
-240e:a24
-240e:a25
-240e:a26
-240e:a27
-240e:a40
-240e:a41
-240e:a42
-240e:a43
-240e:a44
-240e:a45
-240e:a46
-240e:a47
-240e:a5:8000
-240e:a5:a100
-240e:a5:a140
-240e:a9:8010
-240e:ab:b202
-240e:b
-240e:bd:8000
-240e:cd:8000
-2605:9d80:8001
-2605:9d80:8011
-2605:9d80:8021
-2605:9d80:8031
-2605:9d80:8041
-2605:9d80:8081
-2a04:f580:8010
-2a04:f580:8011
-2a04:f580:8090
-2a04:f580:8210
-2a04:f580:8211
-2a04:f580:8290
-2c0f:f7a8:8011
-2c0f:f7a8:8050
-2c0f:f7a8:805f
-2c0f:f7a8:8150
-2c0f:f7a8:815f
-2c0f:f7a8:8211
+2400:9380:8001::/48
+2400:9380:8003::/48
+2400:9380:8021::/48
+2400:9380:8040::/48
+2400:9380:8140::/48
+2400:9380:8201::/48
+2400:9380:8301::/48
+240e:100:8000::/34
+240e:100:c000::/34
+240e:101::/34
+240e:103:c000::/34
+240e:104:4000::/36
+240e:104:7000::/36
+240e:104:c000::/34
+240e:106:4000::/34
+240e:108:1100::/44
+240e:108:1110::/44
+240e:108:1120::/44
+240e:108:1130::/44
+240e:108:1140::/44
+240e:108:1150::/44
+240e:108:1160::/44
+240e:108:1180::/44
+240e:108:1190::/44
+240e:108:11a0::/44
+240e:108:11b0::/44
+240e:108:11c0::/44
+240e:108:11d0::/44
+240e:108:11e0::/44
+240e:108:1200::/44
+240e:108:1210::/44
+240e:108:12a0::/44
+240e:108:12c0::/44
+240e:108:12d0::/44
+240e:108:1300::/44
+240e:108:1310::/44
+240e:108:1320::/44
+240e:108:1330::/44
+240e:108:1340::/44
+240e:108:1350::/44
+240e:108:1360::/44
+240e:108:1370::/44
+240e:108:1380::/44
+240e:108:1390::/44
+240e:108:13a0::/44
+240e:108:13b0::/44
+240e:108:13c0::/44
+240e:108:13d0::/44
+240e:108:13e0::/44
+240e:11:8001::/48
+240e:12::/32
+240e:144:c000::/34
+240e:14::/31
+240e:16:1001::/48
+240e:16:1008::/48
+240e:184:c000::/34
+240e:1:8000::/33
+240e:1::/33
+240e:1c:112::/48
+240e:1c::/31
+240e:204::/30
+240e:208::/30
+240e:20c::/30
+240e:210::/30
+240e:214::/30
+240e:218::/32
+240e:219::/32
+240e:21a::/32
+240e:21b::/32
+240e:21c::/30
+240e:220::/30
+240e:224::/32
+240e:225::/32
+240e:226::/32
+240e:227::/32
+240e:22c::/30
+240e:230::/30
+240e:234::/30
+240e:238::/30
+240e:23c::/30
+240e:240::/32
+240e:241::/32
+240e:242::/32
+240e:243::/32
+240e:244::/32
+240e:245::/32
+240e:246::/32
+240e:247::/32
+240e:248::/30
+240e:24:8000::/34
+240e:24c::/30
+240e:250::/30
+240e:254::/30
+240e:258::/30
+240e:25c::/30
+240e:260::/30
+240e:264::/30
+240e:268::/30
+240e:26c::/30
+240e:270::/30
+240e:274::/30
+240e:278::/30
+240e:27c::/30
+240e:2::/33
+240e:2c:8000::/34
+240e:304::/30
+240e:308::/30
+240e:30c::/30
+240e:310::/30
+240e:314::/30
+240e:318::/32
+240e:319::/32
+240e:31a::/32
+240e:31b::/32
+240e:31c::/30
+240e:320::/30
+240e:324::/32
+240e:325::/32
+240e:326::/32
+240e:327::/32
+240e:32c::/30
+240e:330::/30
+240e:334::/30
+240e:338::/30
+240e:33c::/30
+240e:340::/32
+240e:341::/32
+240e:342::/32
+240e:343::/32
+240e:344::/30
+240e:348::/30
+240e:34c::/30
+240e:350:205::/48
+240e:350::/29
+240e:358::/29
+240e:360::/29
+240e:368::/29
+240e:370::/29
+240e:378::/29
+240e:380::/29
+240e:388::/29
+240e:390::/29
+240e:398::/29
+240e:3a0::/28
+240e:3b0::/28
+240e:404::/30
+240e:408::/30
+240e:414::/30
+240e:418::/32
+240e:419::/32
+240e:41:8000::/33
+240e:41::/33
+240e:41a::/32
+240e:41b::/32
+240e:41c::/30
+240e:420::/30
+240e:424::/32
+240e:425::/32
+240e:426::/32
+240e:427::/32
+240e:42:4000::/48
+240e:42:8000::/33
+240e:42::/33
+240e:42c::/30
+240e:430::/30
+240e:434::/30
+240e:438::/30
+240e:43:8000::/33
+240e:43:8000::/48
+240e:43::/33
+240e:43c::/30
+240e:440::/32
+240e:441::/32
+240e:442::/32
+240e:443::/32
+240e:444::/32
+240e:445::/32
+240e:446::/32
+240e:447::/32
+240e:448::/30
+240e:44:8000::/33
+240e:44::/33
+240e:44c::/30
+240e:450::/30
+240e:454::/30
+240e:458::/30
+240e:45:8000::/33
+240e:45:8000::/48
+240e:45c::/30
+240e:460::/30
+240e:464::/30
+240e:468::/30
+240e:46:5008::/48
+240e:46:8000::/33
+240e:46::/33
+240e:46c::/30
+240e:470::/30
+240e:474::/30
+240e:478::/30
+240e:47::/32
+240e:47c::/30
+240e:48:8000::/33
+240e:48::/33
+240e:49:8000::/33
+240e:49::/33
+240e:4a:4100::/48
+240e:4a:8000::/33
+240e:4a::/33
+240e:4b:1::/48
+240e:4b:8000::/33
+240e:4b::/33
+240e:4c:4006::/48
+240e:4c:5000::/48
+240e:4c:8000::/33
+240e:4c::/33
+240e:4d:50ff::/48
+240e:4d:8000::/33
+240e:4d::/33
+240e:4e:4000::/48
+240e:4e:8000::/33
+240e:4e::/33
+240e:4f:8000::/33
+240e:4f::/33
+240e:504::/30
+240e:508::/30
+240e:50:8000::/33
+240e:50::/33
+240e:514::/30
+240e:518::/32
+240e:519::/32
+240e:51::/32
+240e:51a::/32
+240e:51b::/32
+240e:51c::/30
+240e:520::/30
+240e:524::/32
+240e:525::/32
+240e:526::/32
+240e:527::/32
+240e:52:4802::/48
+240e:52:8000::/33
+240e:52::/33
+240e:52c::/30
+240e:530::/30
+240e:534::/30
+240e:538::/30
+240e:53:8000::/33
+240e:53::/33
+240e:53c::/30
+240e:540::/32
+240e:541::/32
+240e:542::/32
+240e:543::/32
+240e:544::/32
+240e:545::/32
+240e:546::/32
+240e:547::/32
+240e:548::/30
+240e:54:8000::/33
+240e:54::/33
+240e:54c::/30
+240e:550::/30
+240e:554::/30
+240e:558::/30
+240e:55:8000::/33
+240e:55::/33
+240e:55c::/30
+240e:560::/30
+240e:564::/30
+240e:568::/30
+240e:56:4807::/48
+240e:56:8000::/33
+240e:56::/33
+240e:56c::/30
+240e:570::/30
+240e:574::/30
+240e:578::/30
+240e:57:8000::/33
+240e:57::/33
+240e:57c::/30
+240e:5a:6800::/48
+240e:5a:8000::/33
+240e:5a::/33
+240e:5b:8000::/33
+240e:5b::/33
+240e:5c:8000::/33
+240e:5c::/33
+240e:5d:8000::/33
+240e:5d::/33
+240e:5e:8000::/33
+240e:5e::/33
+240e:5f:8000::/33
+240e:5f::/33
+240e:604::/30
+240e:608::/30
+240e:60::/30
+240e:60c::/30
+240e:610::/30
+240e:614::/30
+240e:618::/32
+240e:619::/32
+240e:61a::/32
+240e:61b::/32
+240e:61c::/30
+240e:61d:1401::/48
+240e:620::/30
+240e:624::/32
+240e:625::/32
+240e:626::/32
+240e:627::/32
+240e:62c::/30
+240e:630::/30
+240e:634::/30
+240e:638::/30
+240e:638::/48
+240e:63c::/30
+240e:640::/32
+240e:641::/32
+240e:642::/32
+240e:643::/32
+240e:644::/30
+240e:648::/30
+240e:64::/32
+240e:64c::/30
+240e:650::/29
+240e:658::/29
+240e:659:1160::/48
+240e:660::/29
+240e:668::/29
+240e:670::/29
+240e:678::/29
+240e:680::/29
+240e:688::/29
+240e:690::/29
+240e:698::/29
+240e:6a0::/28
+240e:6b0::/28
+240e:704::/30
+240e:708::/30
+240e:70c::/30
+240e:710::/30
+240e:714::/30
+240e:718::/32
+240e:719::/32
+240e:71a::/32
+240e:71b::/32
+240e:71c::/30
+240e:720::/30
+240e:724::/32
+240e:725::/32
+240e:726::/32
+240e:727::/32
+240e:72c::/30
+240e:730::/30
+240e:734::/30
+240e:738::/30
+240e:73c::/30
+240e:740::/32
+240e:741::/32
+240e:742::/32
+240e:743::/32
+240e:744::/30
+240e:748::/30
+240e:74c::/30
+240e:750::/29
+240e:758::/29
+240e:760::/29
+240e:768::/29
+240e:770::/29
+240e:778::/29
+240e:780::/29
+240e:788::/29
+240e:790::/29
+240e:798::/29
+240e:7::/32
+240e:7a0::/28
+240e:7b0::/28
+240e:804::/30
+240e:814::/30
+240e:81c::/30
+240e:820::/30
+240e:82c::/30
+240e:830::/30
+240e:834::/30
+240e:838::/30
+240e:83c::/30
+240e:840::/32
+240e:841::/32
+240e:848::/30
+240e:84::/31
+240e:84c::/30
+240e:850::/30
+240e:854::/30
+240e:858::/30
+240e:85c::/30
+240e:860::/30
+240e:864::/30
+240e:868::/30
+240e:86::/31
+240e:86c::/30
+240e:870::/30
+240e:874::/30
+240e:878::/30
+240e:87c::/30
+240e:88::/31
+240e:8a::/31
+240e:8c::/31
+240e:8e::/31
+240e:904::/30
+240e:908::/30
+240e:90::/31
+240e:90c::/30
+240e:910::/30
+240e:914::/30
+240e:918::/32
+240e:919::/32
+240e:91a::/32
+240e:91b::/32
+240e:91c::/30
+240e:920::/30
+240e:924::/32
+240e:925::/32
+240e:926::/32
+240e:927::/32
+240e:92::/31
+240e:92c::/30
+240e:930::/30
+240e:934::/30
+240e:938::/30
+240e:93c::/30
+240e:940::/32
+240e:941::/32
+240e:942::/32
+240e:943::/32
+240e:944::/32
+240e:945::/32
+240e:946::/32
+240e:947::/32
+240e:948::/30
+240e:94c::/30
+240e:950::/30
+240e:954::/30
+240e:958::/30
+240e:95c::/30
+240e:960::/30
+240e:964::/30
+240e:968::/30
+240e:96::/31
+240e:96c::/30
+240e:970::/30
+240e:974::/30
+240e:978::/30
+240e:97c::/30
+240e:980:9400::/40
+240e:981:f000::/36
+240e:982:1000::/36
+240e:982:2000::/36
+240e:982:3000::/36
+240e:982:4000::/36
+240e:982:5000::/36
+240e:982:6000::/36
+240e:982:7000::/36
+240e:982:8000::/36
+240e:982:9000::/36
+240e:982::/36
+240e:982:a000::/36
+240e:982:b000::/36
+240e:982:c000::/36
+240e:982:d000::/36
+240e:982:e000::/36
+240e:983:1000::/40
+240e:983:100::/40
+240e:983:1100::/40
+240e:983:1200::/40
+240e:983:1300::/40
+240e:983:1400::/40
+240e:983:1500::/40
+240e:983:1600::/40
+240e:983:1700::/40
+240e:983:1800::/40
+240e:983:1900::/40
+240e:983:1a00::/40
+240e:983:1b00::/40
+240e:983:1c00::/40
+240e:983:1d00::/40
+240e:983:1e00::/40
+240e:983::/40
+240e:983:a00::/40
+240e:983:c00::/40
+240e:983:d00::/40
+240e:983:f00::/40
+240e:98::/31
+240e:9::/32
+240e:9a::/31
+240e:9c::/30
+240e::/20
+240e::/24
+240e:a04::/30
+240e:a08::/30
+240e:a0::/31
+240e:a0c::/32
+240e:a0d::/32
+240e:a0e::/32
+240e:a0f::/32
+240e:a14::/30
+240e:a18::/32
+240e:a19::/32
+240e:a1a::/32
+240e:a1b::/32
+240e:a1c::/30
+240e:a20::/30
+240e:a24::/32
+240e:a25::/32
+240e:a26::/32
+240e:a27::/32
+240e:a2::/31
+240e:a2c::/30
+240e:a30::/30
+240e:a34::/30
+240e:a38::/30
+240e:a40::/32
+240e:a41::/32
+240e:a42::/32
+240e:a43::/32
+240e:a44::/32
+240e:a45::/32
+240e:a46::/32
+240e:a47::/32
+240e:a48::/30
+240e:a4::/31
+240e:a4c::/30
+240e:a50::/30
+240e:a54::/30
+240e:a58::/30
+240e:a5:8000::/48
+240e:a5c::/30
+240e:a60::/30
+240e:a64::/30
+240e:a68::/30
+240e:a6::/31
+240e:a6c::/30
+240e:a70::/30
+240e:a74::/30
+240e:a78::/30
+240e:a7c::/30
+240e:a8::/31
+240e:aa::/31
+240e:ac::/31
+240e:ae::/31
+240e:b04::/30
+240e:b0::/31
+240e:b0c::/30
+240e:b14::/30
+240e:b1c::/30
+240e:b20::/30
+240e:b2::/31
+240e:b2c::/30
+240e:b30::/30
+240e:b34::/30
+240e:b38::/30
+240e:b44::/30
+240e:b48::/30
+240e:b4::/31
+240e:b4c::/30
+240e:b50::/29
+240e:b60::/29
+240e:b68::/29
+240e:b6::/31
+240e:b70::/29
+240e:b78::/29
+240e:b80::/29
+240e:b88::/29
+240e:b8::/31
+240e:b90::/29
+240e:b98::/29
+240e:b:8000::/33
+240e:b::/33
+240e:ba::/31
+240e:bb0::/28
+240e:bc::/31
+240e:bd:8000::/48
+240e:be::/31
+240e:c0::/31
+240e:c2::/31
+240e:c4::/30
+240e:c60::/30
+240e:c8::/31
+240e:ca::/31
+240e:cc::/31
+240e:cd:8000::/48
+240e:ce::/31
+240e:d0::/31
+240e:d2::/31
+240e:d4::/31
+240e:d6::/31
+240e:d8::/31
+240e:da::/31
+240e:dc::/31
+240e:de::/31
+240e:e8::/31
+240e:ea::/31
+240e:ec::/31
+240e:ee::/31
+240e:f0::/31
+240e:f2::/31
+240e:f4::/31
+240e:f6::/31
+240e:f8::/31
+240e:fa::/31
+240e:fc::/31
+240e:fe::/31
+2605:9d80:8001::/48
+2605:9d80:8011::/48
+2605:9d80:8021::/48
+2605:9d80:8031::/48
+2605:9d80:8041::/48
+2605:9d80:8081::/48
+2a04:f580:8010::/48
+2a04:f580:8011::/48
+2a04:f580:8090::/48
+2a04:f580:8210::/48
+2a04:f580:8211::/48
+2a04:f580:8290::/48
+2c0f:f7a8:8011::/48
+2c0f:f7a8:8050::/48
+2c0f:f7a8:805f::/48
+2c0f:f7a8:8150::/48
+2c0f:f7a8:815f::/48
+2c0f:f7a8:8211::/48

bk/prefix/as4134.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as4134.txt",
+  "count": 629,
+  "sha256": "00941f76c022566166b926670ee9358084c53465cbaaf75a3da7b73d997d1947",
+  "generated_at": "2026-07-23T02:56:31Z"
+}

bk/prefix/as4809.txt

@@ -1,173 +1,179 @@
-2400:9380:9001
-2400:9380:9009
-2400:9380:9020
-2400:9380:9021
-2400:9380:9050
-2400:9380:9051
-2400:9380:9060
-2400:9380:9071
-2400:9380:9080
-2400:9380:9081
-2400:9380:90b1
-2400:9380:90b2
-2400:9380:90b3
-2400:9380:90b4
-2400:9380:90b5
-2400:9380:90b6
-2400:9380:90b7
-2400:9380:9121
-2400:9380:9220
-2400:9380:9221
-2400:9380:9250
-2400:9380:9251
-2400:9380:9260
-2400:9380:9271
-2400:9380:9280
-2400:9380:9281
-2400:9380:92b1
-2400:9380:92b2
-2400:9380:92b3
-2400:9380:92b4
-2400:9380:92b5
-2400:9380:92b6
-2400:9380:92b7
-240e
-240e:182:5401
-240e:182:5501
-240e:409:9000
-240e:409:9001
-240e:410:ff00
-240e:411:ff00
-240e:414
-240e:43d:fff1
-240e:43d:fff3
-240e:43d:fff4
-240e:43d:fff7
-240e:440:ac00
-240e:440:ac01
-240e:440:ac02
-240e:441:ac00
-240e:441:ac01
-240e:441:ac02
-240e:445:3f00
-240e:446:3f00
-240e:451:bfc0
-240e:451:bfe0
-240e:451:ffa0
-240e:451:ffc0
-240e:451:ffe0
-240e:456:fe00
-240e:457:fe00
-240e:469:f400
-240e:476:febf
-240e:476:feff
-240e:604:314
-240e:604:319
-240e:60e
-240e:60e:8000
-240e:60e:8001
-240e:615
-240e:61d
-240e:628
-240e:62c
-240e:62f
-240e:638:f
-240e:63c
-240e:640:178
-240e:640:179
-240e:640:17a
-240e:640:17b
-240e:645
-240e:648:1e
-240e:648:c00f
-240e:648:c40f
-240e:648:c80f
-240e:648:cc0f
-240e:648:d00f
-240e:648:d40f
-240e:648:d80f
-240e:648:dc0f
-240e:649:c00f
-240e:649:c40f
-240e:649:c80f
-240e:649:cc0f
-240e:649:d00f
-240e:649:d40f
-240e:649:d80f
-240e:649:dc0f
-240e:64e
-240e:64e:de0
-240e:64e:dec
-240e:64e:ded
-240e:650
-240e:659:f100
-240e:65f
-240e:669
-240e:670
-240e:679:1001
-240e:679:800
-240e:699
-240e:699:7a00
-240e:699:7a01
-240e:699:7b00
-240e:699:7b06
-240e:699:7b07
-240e:699:7b08
-240e:699:7b0a
-240e:699:7b0c
-240e:699:7b0d
-240e:699:7b0f
-240e:699:7b12
-240e:6a0:d00
-240e:6a0:d07
-240e:6a0:d0a
-240e:713:f020
-240e:713:f021
-240e:733:4c0
-240e:733:4c1
-240e:767:f000
-240e:787:7000
-240e:787:7001
-240e:790
-240e:965:822
-240e:eb
-240e:f6:8002
-240e:f6:8003
-240e:ff:c020
-240e:ff:c022
-240e:ff:c027
-2605:9d80:9003
-2605:9d80:9013
-2605:9d80:9023
-2605:9d80:9033
-2605:9d80:9042
-2605:9d80:9071
-2605:9d80:9092
-2804:1e48
-2804:1e48:9001
-2804:1e48:9002
-2a04:f580:9010
-2a04:f580:9012
-2a04:f580:9013
-2a04:f580:9020
-2a04:f580:9030
-2a04:f580:9040
-2a04:f580:9050
-2a04:f580:9060
-2a04:f580:9070
-2a04:f580:9080
-2a04:f580:9210
-2a04:f580:9212
-2a04:f580:9213
-2a04:f580:9220
-2a04:f580:9230
-2a04:f580:9240
-2a04:f580:9250
-2a04:f580:9260
-2a04:f580:9270
-2a04:f580:9280
-2a04:f580:9290
-2c0f:f7a8:9020
-2c0f:f7a8:9041
-2c0f:f7a8:9211
-2c0f:f7a8:9220
+2400:9380:9001::/48
+2400:9380:9009::/48
+2400:9380:9020::/48
+2400:9380:9021::/48
+2400:9380:9050::/48
+2400:9380:9051::/48
+2400:9380:9060::/48
+2400:9380:9071::/48
+2400:9380:9080::/48
+2400:9380:9081::/48
+2400:9380:90b1::/48
+2400:9380:90b2::/48
+2400:9380:90b3::/48
+2400:9380:90b4::/48
+2400:9380:90b5::/48
+2400:9380:90b6::/48
+2400:9380:90b7::/48
+2400:9380:9121::/48
+2400:9380:9220::/48
+2400:9380:9221::/48
+2400:9380:9250::/48
+2400:9380:9251::/48
+2400:9380:9260::/48
+2400:9380:9271::/48
+2400:9380:9280::/48
+2400:9380:9281::/48
+2400:9380:9282::/48
+2400:9380:92b1::/48
+2400:9380:92b2::/48
+2400:9380:92b3::/48
+2400:9380:92b4::/48
+2400:9380:92b5::/48
+2400:9380:92b6::/48
+2400:9380:92b7::/48
+240e:182:5401::/48
+240e:182:5501::/48
+240e:409:9000::/48
+240e:409:9001::/48
+240e:410:ff00::/48
+240e:411:ff00::/48
+240e:414:e710::/45
+240e:414:e718::/45
+240e:43d:fff1::/48
+240e:43d:fff3::/48
+240e:43d:fff4::/48
+240e:43d:fff7::/48
+240e:440:ac00::/48
+240e:440:ac01::/48
+240e:440:ac02::/48
+240e:441:ac00::/48
+240e:441:ac01::/48
+240e:441:ac02::/48
+240e:445:3f00::/48
+240e:446:3f00::/48
+240e:451:bfc0::/48
+240e:451:bfe0::/48
+240e:451:ffa0::/48
+240e:451:ffc0::/48
+240e:451:ffe0::/48
+240e:456:fe00::/48
+240e:457:fe00::/48
+240e:469:f400::/48
+240e:476:febf::/48
+240e:476:feff::/48
+240e:604:314::/48
+240e:604:319::/48
+240e:60e:8000::/48
+240e:60e:8001::/48
+240e:60e:e000::/35
+240e:615:7000::/40
+240e:61d:e600::/40
+240e:628:10::/45
+240e:62c:1f0::/44
+240e:62f::/48
+240e:638:f::/48
+240e:63c:3f00::/44
+240e:640:178::/48
+240e:640:179::/48
+240e:640:17a::/48
+240e:640:17b::/48
+240e:645:1000::/36
+240e:648:1e::/48
+240e:648:c00f::/48
+240e:648:c40f::/48
+240e:648:c80f::/48
+240e:648:cc0f::/48
+240e:648:d00f::/48
+240e:648:d40f::/48
+240e:648:d80f::/48
+240e:648:dc0f::/48
+240e:649:c00f::/48
+240e:649:c40f::/48
+240e:649:c80f::/48
+240e:649:cc0f::/48
+240e:649:d00f::/48
+240e:649:d40f::/48
+240e:649:d80f::/48
+240e:649:dc0f::/48
+240e:64e:d00::/44
+240e:64e:de0::/48
+240e:64e:dec::/48
+240e:64e:ded::/48
+240e:650:8000::/38
+240e:659:f100::/48
+240e:65f:e000::/36
+240e:669:b000::/40
+240e:670:d000::/36
+240e:679:1001::/48
+240e:688:ed00::/48
+240e:699:7a00::/48
+240e:699:7a01::/48
+240e:699:7b00::/48
+240e:699:7b06::/48
+240e:699:7b07::/48
+240e:699:7b08::/48
+240e:699:7b0a::/48
+240e:699:7b0c::/48
+240e:699:7b0d::/48
+240e:699:7b0f::/48
+240e:699:7b11::/48
+240e:699:7b12::/48
+240e:699:bc00::/38
+240e:6a0:d00::/48
+240e:6a0:d03::/48
+240e:6a0:d04::/48
+240e:6a0:d07::/48
+240e:6a0:d0a::/48
+240e:713:f020::/48
+240e:713:f021::/48
+240e:733:4c0::/48
+240e:733:4c1::/48
+240e:767:f000::/48
+240e:787:7000::/48
+240e:787:7001::/48
+240e:790:ff00::/40
+240e:7b6::/31
+240e:965:822::/48
+240e:eb:e800::/37
+240e:eb:f000::/37
+240e:f6:8002::/48
+240e:f6:8003::/48
+240e:ff:c020::/48
+240e:ff:c022::/48
+240e:ff:c024::/48
+240e:ff:c027::/48
+240e:ff:c029::/48
+2605:9d80:9003::/48
+2605:9d80:9013::/48
+2605:9d80:9023::/48
+2605:9d80:9033::/48
+2605:9d80:9042::/48
+2605:9d80:9071::/48
+2605:9d80:9092::/48
+2804:1e48:9001::/48
+2804:1e48:9002::/48
+2a04:f580:9010::/48
+2a04:f580:9012::/48
+2a04:f580:9013::/48
+2a04:f580:9020::/48
+2a04:f580:9030::/48
+2a04:f580:9040::/48
+2a04:f580:9050::/48
+2a04:f580:9060::/48
+2a04:f580:9070::/48
+2a04:f580:9080::/48
+2a04:f580:9210::/48
+2a04:f580:9212::/48
+2a04:f580:9213::/48
+2a04:f580:9220::/48
+2a04:f580:9230::/48
+2a04:f580:9240::/48
+2a04:f580:9250::/48
+2a04:f580:9260::/48
+2a04:f580:9270::/48
+2a04:f580:9280::/48
+2a04:f580:9290::/48
+2c0f:f7a8:9020::/48
+2c0f:f7a8:9041::/48
+2c0f:f7a8:9220::/48

bk/prefix/as4809.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as4809.txt",
+  "count": 179,
+  "sha256": "1b43123532881e6dc9b08cfd56216a9eda028ff41b8ac6dfb4e8c51cb38d873c",
+  "generated_at": "2026-07-20T19:12:53Z"
+}

bk/prefix/as4837.txt

@@ -1,418 +1,470 @@
-2001:4510
-2001:4511
-2402:18a0
-2402:f140:ff13
-2402:f140:ff14
-2404:6500:dcb3
-2405:1480
-2406:1e40
-2406:cac0
-2407:6c40
-2407:6c40:1500
-2408
-2408:8000
-2408:8000:10fe
-2408:8000:10ff
-2408:8000:2
-2408:8000:3
-2408:8000:5005
-2408:8001
-2408:802a
-2408:802c
-2408:803e
-2408:8056
-2408:80c2
-2408:80c5
-2408:80e2
-2408:80e9
-2408:80f5
-2408:80f9
-2408:815f
-2408:8181
-2408:8182
-2408:8183
-2408:81a2
-2408:81a3
-2408:8210
-2408:8211
-2408:8212
-2408:8213
-2408:8214
-2408:8215
-2408:821a
-2408:821b
-2408:8220
-2408:8221
-2408:8226
-2408:822a
-2408:822b
-2408:822e
-2408:822f
-2408:8230
-2408:8231
-2408:8232
-2408:8233
-2408:8234
-2408:8235
-2408:8236
-2408:8237
-2408:8238
-2408:8239
-2408:823c
-2408:823d
-2408:8240
-2408:8248
-2408:8249
-2408:824a
-2408:824b
-2408:824c
-2408:824e
-2408:824f
-2408:8250
-2408:8251
-2408:8252
-2408:8253
-2408:8254
-2408:825c
-2408:825d
-2408:825f
-2408:8260
-2408:8262
-2408:8263
-2408:8264
-2408:8265
-2408:8266
-2408:826a
-2408:826c
-2408:826d
-2408:826e
-2408:826f
-2408:8270
-2408:8274
-2408:8275
-2408:8276
-2408:8277
-2408:8278
-2408:8279
-2408:827a
-2408:8310
-2408:8311
-2408:8312
-2408:8313
-2408:832a
-2408:832e
-2408:832f
-2408:8330
-2408:8331
-2408:8332
-2408:8333
-2408:8338
-2408:8340
-2408:8348
-2408:8349
-2408:834a
-2408:834b
-2408:834e
-2408:834f
-2408:8350
-2408:8351
-2408:8352
-2408:8353
-2408:8354
-2408:8360
-2408:8361
-2408:8362
-2408:8363
-2408:8364
-2408:8365
-2408:836c
-2408:836d
-2408:836e
-2408:836f
-2408:8374
-2408:8375
-2408:8376
-2408:8377
-2408:8378
-2408:8379
-2408:837a
-2408:8410
-2408:8411
-2408:8412
-2408:8413
-2408:8414
-2408:8415
-2408:8417
-2408:8418
-2408:841a
-2408:841b
-2408:841c
-2408:841d
-2408:841e
-2408:8420
-2408:8421
-2408:8422
-2408:8426
-2408:8427
-2408:842a
-2408:842b
-2408:842c
-2408:842e
-2408:8430
-2408:8431
-2408:8434
-2408:8435
-2408:8436
-2408:8437
-2408:8438
-2408:8439
-2408:843c
-2408:843d
-2408:843e
-2408:843f
-2408:8440
-2408:8441
-2408:8448
-2408:844b
-2408:844c
-2408:844d
-2408:844e
-2408:844f
-2408:8452
-2408:8453
-2408:8454
-2408:8459
-2408:845c
-2408:845d
-2408:8460
-2408:8461
-2408:8462
-2408:8463
-2408:8464
-2408:8465
-2408:8466
-2408:8469
-2408:846a
-2408:846b
-2408:846c
-2408:846d
-2408:846e
-2408:846f
-2408:8470
-2408:8471
-2408:8474
-2408:8475
-2408:8476
-2408:8477
-2408:8478
-2408:8479
-2408:847a
-2408:84e3
-2408:84e4
-2408:84e5
-2408:84e6
-2408:84e7
-2408:84e9
-2408:84eb
-2408:84ec
-2408:84ed
-2408:84ee
-2408:84ef
-2408:84f0
-2408:84f1
-2408:84f2
-2408:84f4
-2408:84f5
-2408:84f6
-2408:84f7
-2408:84f8
-2408:84f9
-2408:84fa
-2408:84fb
-2408:84fc
-2408:84fd
-2408:84fe
-2408:84ff
-2408:856c
-2408:856d
-2408:8610
-2408:8611
-2408:8612
-2408:8613
-2408:8614
-2408:8614:e20
-2408:8615
-2408:861a
-2408:861b
-2408:861c
-2408:8620
-2408:8621
-2408:8624
-2408:8625
-2408:8626
-2408:862a
-2408:862b
-2408:862d
-2408:862e
-2408:862f
-2408:8630
-2408:8631
-2408:8632
-2408:8633
-2408:8634
-2408:8635
-2408:8636
-2408:8637
-2408:8638
-2408:8639
-2408:863c
-2408:863d
-2408:8640
-2408:8642
-2408:8648
-2408:8649
-2408:8649:5a00
-2408:864c
-2408:864e
-2408:864f
-2408:8650
-2408:8651
-2408:8652
-2408:8653
-2408:865c
-2408:865d
-2408:865f
-2408:8660
-2408:8662
-2408:8663
-2408:8664
-2408:8665
-2408:8666
-2408:866a
-2408:866b
-2408:866c
-2408:866d
-2408:866e
-2408:866f
-2408:8670
-2408:8674
-2408:8675
-2408:8676
-2408:8677
-2408:8678
-2408:8679
-2408:867a
-2408:8710
-2408:8711
-2408:8712
-2408:8713
-2408:8719
-2408:871a
-2408:871b
-2408:8720
-2408:8721
-2408:8722
-2408:8723
-2408:8726
-2408:872b
-2408:872f
-2408:8730
-2408:8731
-2408:8732
-2408:8733
-2408:8734
-2408:8735
-2408:8736
-2408:8738
-2408:873c
-2408:873d
-2408:8740
-2408:8742
-2408:8748
-2408:8749
-2408:874a
-2408:874b
-2408:874c
-2408:874d
-2408:874e
-2408:874f
-2408:8752
-2408:875c
-2408:8760
-2408:8762
-2408:8763
-2408:8764
-2408:8765
-2408:8766
-2408:8768
-2408:876a
-2408:876c
-2408:876d
-2408:876e
-2408:876f
-2408:8770
-2408:8772
-2408:8773
-2408:8774
-2408:8776
-2408:8777
-2408:8778
-2408:8779
-2408:877a
-2408:8812
-2408:8813
-2408:8814
-2408:8815
-2408:8818
-2408:8819
-2408:882c
-2408:883a
-2408:8862
-2408:8863
-2408:8864
-2408:8865
-2408:8866
-2408:886e
-2408:886f
-2408:8872
-2408:8878
-2408:8879
-2408:887e
-2408:8912
-2408:8913
-2408:8914
-2408:8915
-2408:8916
-2408:8917
-2408:891c
-2408:8920
-2408:8924
-2408:892c
-2408:8936
-2408:893a
-2408:8940
-2408:8948
-2408:894c
-2408:894e
-2408:8956
-2408:8957
-2408:8962
-2408:8963
-2408:8964
-2408:8965
-2408:8966
-2408:896c
-2408:896e
-2408:896f
-2408:8972
-2408:8978
-2408:8979
-2408:897a
-2408:897b
-2408:897e
-2408:8a21
-2408:8a22
-2408:8a23
-2408:8a24
-2408:8a26
-2408:8a27
+2001:4510:1480::/41
+2001:4511:1480::/41
+2402:18a0::/32
+2402:f140:ff13::/48
+2402:f140:ff14::/48
+2404:6500:dcb3::/48
+2405:1480:3000::/47
+2406:1e40:f012::/47
+2406:cac0:200::/40
+2406:cac0::/40
+2407:6c40:1500::/48
+2407:6c40:1600::/40
+2408:8000:10fe::/48
+2408:8000:10ff::/48
+2408:8000:2000::/36
+2408:8000:2::/48
+2408:8000:3000::/36
+2408:8000:3::/48
+2408:8000:4000::/36
+2408:8000:5000::/36
+2408:8000:6000::/36
+2408:8000:7000::/36
+2408:8000:8000::/36
+2408:8000:8010::/47
+2408:8000::/48
+2408:8000:a000::/36
+2408:8000:b000::/36
+2408:8000:c000::/36
+2408:8000:d000::/36
+2408:8000:e000::/36
+2408:8000:f000::/36
+2408:8001:1000::/36
+2408:8001:2000::/36
+2408:8001:4000::/36
+2408:8001:5000::/36
+2408:8001:6000::/36
+2408:8001:7000::/36
+2408:8001:8000::/36
+2408:8001:9000::/36
+2408:8001::/36
+2408:8001:a000::/36
+2408:8001:b000::/36
+2408:8001:c000::/36
+2408:8001:d000::/36
+2408:8001:e000::/36
+2408:8001:f000::/36
+2408:802a:8000::/33
+2408:802c::/32
+2408:803e::/32
+2408:8056::/32
+2408:80c2::/33
+2408:80c5::/33
+2408:80e2::/33
+2408:80e9:4000::/34
+2408:80f5:4000::/34
+2408:80f9:4000::/34
+2408:815f:e000::/35
+2408:8181:6000::/40
+2408:8181:8000::/40
+2408:8181::/40
+2408:8181:a000::/40
+2408:8181:a220::/44
+2408:8181:e000::/40
+2408:8182:c000::/40
+2408:8183:4000::/40
+2408:8183:8000::/40
+2408:81a2:2000::/35
+2408:81a2:4000::/35
+2408:81a3:6000::/35
+2408:8210::/32
+2408:8211::/32
+2408:8212::/32
+2408:8213::/32
+2408:8214::/32
+2408:8215::/32
+2408:821a::/32
+2408:821b::/32
+2408:8220::/32
+2408:8221::/32
+2408:8226::/32
+2408:822a::/32
+2408:822b::/32
+2408:822e::/32
+2408:822f::/32
+2408:8230::/32
+2408:8231::/32
+2408:8232::/32
+2408:8233::/32
+2408:8234::/32
+2408:8235::/32
+2408:8236::/32
+2408:8237::/32
+2408:8238::/32
+2408:8239::/32
+2408:823c::/32
+2408:823d::/32
+2408:8240::/32
+2408:8244::/30
+2408:8248::/32
+2408:8249::/32
+2408:824a::/32
+2408:824b::/32
+2408:824c::/32
+2408:824e::/32
+2408:824f::/32
+2408:8250::/32
+2408:8251::/32
+2408:8252::/32
+2408:8253::/32
+2408:8254::/32
+2408:825c::/32
+2408:825d::/32
+2408:825f::/32
+2408:8260::/32
+2408:8262::/32
+2408:8263::/32
+2408:8264::/32
+2408:8265::/32
+2408:8266::/32
+2408:826a::/32
+2408:826c::/32
+2408:826d::/32
+2408:826e::/32
+2408:826f::/32
+2408:8270::/32
+2408:8274::/32
+2408:8275::/32
+2408:8276::/32
+2408:8277::/32
+2408:8278::/32
+2408:8279::/32
+2408:827a::/32
+2408:8310::/32
+2408:8311::/32
+2408:8312::/32
+2408:8313::/32
+2408:832a::/32
+2408:832e::/32
+2408:832f::/32
+2408:8330::/32
+2408:8331::/32
+2408:8332::/32
+2408:8333::/32
+2408:8338::/32
+2408:8340::/32
+2408:8344::/30
+2408:8348::/32
+2408:8349::/32
+2408:834a::/32
+2408:834b::/32
+2408:834e::/32
+2408:834f::/32
+2408:8350::/32
+2408:8351::/32
+2408:8352::/32
+2408:8353::/32
+2408:8354::/32
+2408:8360::/32
+2408:8361::/32
+2408:8362::/32
+2408:8363::/32
+2408:8364::/32
+2408:8365::/32
+2408:836c::/32
+2408:836d::/32
+2408:836e::/32
+2408:836f::/32
+2408:8374::/32
+2408:8375::/32
+2408:8376::/32
+2408:8377::/32
+2408:8378::/32
+2408:8379::/32
+2408:837a::/32
+2408:8410::/32
+2408:8411::/32
+2408:8412::/32
+2408:8413::/32
+2408:8414::/32
+2408:8415::/32
+2408:8417::/32
+2408:8418::/32
+2408:841a::/32
+2408:841b::/32
+2408:841c::/32
+2408:841d::/32
+2408:841e::/32
+2408:8420::/32
+2408:8421::/32
+2408:8422::/32
+2408:8426::/32
+2408:8427::/32
+2408:842a::/32
+2408:842b::/32
+2408:842c::/32
+2408:842e::/32
+2408:8430::/32
+2408:8431::/32
+2408:8434::/32
+2408:8435::/32
+2408:8436::/32
+2408:8437::/32
+2408:8438::/32
+2408:8439::/32
+2408:843c::/32
+2408:843d::/32
+2408:843e::/32
+2408:843f::/32
+2408:8440::/32
+2408:8441::/32
+2408:8444::/30
+2408:8448::/32
+2408:844b::/32
+2408:844c::/32
+2408:844d::/32
+2408:844e::/32
+2408:844f::/32
+2408:8452::/32
+2408:8453::/32
+2408:8454::/32
+2408:845c::/32
+2408:845d::/32
+2408:8460::/32
+2408:8461::/32
+2408:8462::/32
+2408:8463::/32
+2408:8464::/32
+2408:8465::/32
+2408:8466::/32
+2408:8469::/32
+2408:846a::/32
+2408:846b::/32
+2408:846c::/32
+2408:846d::/32
+2408:846e::/32
+2408:846f::/32
+2408:8470::/32
+2408:8471::/32
+2408:8474::/32
+2408:8475::/32
+2408:8476::/32
+2408:8477::/32
+2408:8478::/32
+2408:8479::/32
+2408:847a::/32
+2408:84e3::/32
+2408:84e4::/32
+2408:84e5::/32
+2408:84e6::/32
+2408:84e7::/32
+2408:84e9::/32
+2408:84eb::/32
+2408:84ec::/32
+2408:84ed::/32
+2408:84ee::/32
+2408:84ef::/32
+2408:84f0::/32
+2408:84f1::/32
+2408:84f2::/32
+2408:84f4::/32
+2408:84f5::/32
+2408:84f6::/32
+2408:84f7::/32
+2408:84f8::/32
+2408:84f9::/32
+2408:84fa::/32
+2408:84fb::/32
+2408:84fc::/32
+2408:84fd::/32
+2408:84fe::/32
+2408:84ff::/32
+2408:856c::/32
+2408:856d::/32
+2408:8610::/32
+2408:8611::/32
+2408:8612::/32
+2408:8613::/32
+2408:8614::/32
+2408:8614:e20::/48
+2408:8615::/32
+2408:861a::/32
+2408:861b::/32
+2408:861c::/32
+2408:8620::/32
+2408:8621::/32
+2408:8624::/32
+2408:8625::/32
+2408:8626::/32
+2408:862a::/32
+2408:862b::/32
+2408:862d::/32
+2408:862e::/32
+2408:862f::/32
+2408:8630::/32
+2408:8631::/32
+2408:8632::/32
+2408:8633::/32
+2408:8634::/32
+2408:8635::/32
+2408:8636::/32
+2408:8637::/32
+2408:8638::/32
+2408:8639::/32
+2408:863c::/32
+2408:863d::/32
+2408:8640::/32
+2408:8642::/32
+2408:8644::/30
+2408:8648::/32
+2408:8649::/32
+2408:864c::/32
+2408:864e::/32
+2408:864f::/32
+2408:8650::/32
+2408:8651::/32
+2408:8652::/32
+2408:8653::/32
+2408:865c::/32
+2408:865d::/32
+2408:865f::/32
+2408:8660::/32
+2408:8662::/32
+2408:8663::/32
+2408:8664::/32
+2408:8665::/32
+2408:8666::/32
+2408:866a::/32
+2408:866b::/32
+2408:866c:200::/42
+2408:866c::/32
+2408:866d::/32
+2408:866e::/32
+2408:866f::/32
+2408:8670::/32
+2408:8674::/32
+2408:8675::/32
+2408:8676::/32
+2408:8677::/32
+2408:8678::/32
+2408:8679::/32
+2408:867a::/32
+2408:8710::/32
+2408:8711::/32
+2408:8712::/32
+2408:8713::/32
+2408:8719::/32
+2408:871a::/32
+2408:871b::/32
+2408:8720::/32
+2408:8721::/32
+2408:8722::/32
+2408:8723::/32
+2408:8726::/32
+2408:872b::/32
+2408:872b:e00::/47
+2408:872f::/32
+2408:8730::/32
+2408:8731::/32
+2408:8732::/32
+2408:8733::/32
+2408:8734::/32
+2408:8735::/32
+2408:8736::/32
+2408:8738::/32
+2408:873c::/32
+2408:873d::/32
+2408:8740::/32
+2408:8742::/32
+2408:8744::/30
+2408:8748::/32
+2408:8749::/32
+2408:874a::/32
+2408:874b::/32
+2408:874c::/32
+2408:874d::/32
+2408:874e::/32
+2408:874f::/32
+2408:8752::/32
+2408:875c::/32
+2408:8760::/32
+2408:8762::/32
+2408:8763::/32
+2408:8764::/32
+2408:8765::/32
+2408:8766::/32
+2408:8768::/32
+2408:876a::/32
+2408:876c:1700::/44
+2408:876c:1740::/44
+2408:876c:17c0::/44
+2408:876c::/32
+2408:876d::/32
+2408:876e::/32
+2408:876f::/32
+2408:8770::/32
+2408:8772::/32
+2408:8773::/32
+2408:8774::/32
+2408:8776::/32
+2408:8777::/32
+2408:8778::/32
+2408:8779::/32
+2408:877a::/32
+2408:8812::/32
+2408:8813::/32
+2408:8814::/32
+2408:8815::/32
+2408:8818::/32
+2408:8819::/32
+2408:882c::/32
+2408:883a::/32
+2408:8862::/32
+2408:8863::/32
+2408:8864::/32
+2408:8865::/32
+2408:8866::/32
+2408:886e::/32
+2408:886f::/32
+2408:8872::/32
+2408:8878::/32
+2408:8879::/32
+2408:887e::/32
+2408:8912::/32
+2408:8913::/32
+2408:8914::/32
+2408:8915::/32
+2408:8916::/32
+2408:8917::/32
+2408:891c::/32
+2408:8920::/32
+2408:8924::/32
+2408:892c::/32
+2408:8936::/32
+2408:893a::/32
+2408:8940::/32
+2408:8948::/32
+2408:894c::/32
+2408:894e::/32
+2408:8962::/32
+2408:8963::/32
+2408:8964::/32
+2408:8965::/32
+2408:8966::/32
+2408:896c::/32
+2408:896e::/32
+2408:896f::/32
+2408:8972::/32
+2408:8978::/32
+2408:8979::/32
+2408:897a::/32
+2408:897b::/32
+2408:897e::/32
+2408:8a21:4000::/36
+2408:8a21:5000::/36
+2408:8a22:1000::/36
+2408:8a22::/36
+2408:8a23:4000::/36
+2408:8a23:5000::/36
+2408:8a23:6000::/36
+2408:8a23:7000::/36
+2408:8a24:4000::/36
+2408:8a24:5000::/36
+2408:8a24:6000::/36
+2408:8a24:7000::/36
+2408:8a26:c000::/36
+2408:8a26:d000::/36
+2408:8a26:e000::/36
+2408:8a26:f000::/36
+2408:8a27:4000::/36
+2408:8a27:5000::/36

bk/prefix/as4837.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as4837.txt",
+  "count": 470,
+  "sha256": "d109b070f48e97a39e94dc831aab2923b6c440de80621a58319b1ba5926fd60c",
+  "generated_at": "2026-07-20T19:12:53Z"
+}

bk/prefix/as58453.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as58453.txt",
+  "count": 17,
+  "sha256": "e7e579da764e9dedf84145b5c4cdc51c4b2841517adbc6edb206896b40710119",
+  "generated_at": "2026-07-20T19:12:53Z"
+}

bk/prefix/as58807.txt

@@ -1,2 +1,2 @@
-2402:4f00
-2402:4f00:f000
+2402:4f00:f000::/36
+2402:4f00:f000::/48

bk/prefix/as58807.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as58807.txt",
+  "count": 2,
+  "sha256": "0765c7eefa122984fe69678b60ba99aa605d52601ef4ebf988c4e691e91c5361",
+  "generated_at": "2026-07-20T19:12:53Z"
+}

bk/prefix/as9808.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as9808.txt",
+  "count": 7170,
+  "sha256": "7532e5bba93ed6b7d5cf010b22d9f5c87606392673fd9877ce28417f2baadd5d",
+  "generated_at": "2026-07-23T02:56:31Z"
+}

bk/prefix/as9929.txt

@@ -1,88 +1,144 @@
-2408:8120
-2408:8120:1
-2408:8120:2
-2408:8256:226d
-2408:8256:228b
-2408:827a:8ff
-2408:8411:c0c0
-2408:8411:c0c1
-2408:8411:c0c2
-2408:8411:c0c3
-2408:8411:c0c4
-2408:8411:c0c5
-2408:8417
-2408:8418
-2408:8435
-2408:843e:e010
-2408:843e:e011
-2408:843e:e012
-2408:843e:e080
-2408:843e:e081
-2408:843e:e082
-2408:8441
-2408:8444
-2408:844c:cb09
-2408:844c:cb0a
-2408:844c:cb0b
-2408:844d:cb09
-2408:844d:cb0a
-2408:844d:cb0b
-2408:844f
-2408:8462
-2408:8463
-2408:8469:fc00
-2408:8471:fa00
-2408:8471:fa01
-2408:8471:fa02
-2408:8471:fb00
-2408:8471:fb01
-2408:8471:fb02
-2408:8474
-2408:8478
-2408:847a:ff20
-2408:847a:ff21
-2408:847a:ff22
-2408:847a:ff40
-2408:847a:ff41
-2408:847a:ff42
-2408:8610:3bff
-2408:8614:1f0
-2408:8614:af0
-2408:861c:1fff
-2408:8625:10fb
-2408:8625:fe
-2408:8626:f200
-2408:862b
-2408:862e:2ff
-2408:8634:1015
-2408:8638:116
-2408:8640
-2408:8649:1a00
-2408:8649:2a00
-2408:864c:10ff
-2408:8651:ff00
-2408:8652:ff00
-2408:8656:a52
-2408:865c
-2408:8660:100
-2408:8660:a100
-2408:8660:ab00
-2408:8660:b500
-2408:8660:bf00
-2408:8666:ff00
-2408:866c:ff00
-2408:8670:800
-2408:8678:1400
-2408:8756:3efd
-2408:8a00
-2408:8a01
-2408:8a02
-2408:8a04
-2408:8a06
-2408:8a06:1
-2408:8a06:100
-2408:8a06:101
-2408:8a07
-2408:8a26:ee10
-2408:8a26:f020
-2408:8a26:f950
+2408:8120:1::/48
+2408:8120:2::/48
+2408:8120:7000::/36
+2408:8256:226d::/48
+2408:8256:228b::/48
+2408:827a:8ff::/48
+2408:8411:c0c0::/48
+2408:8411:c0c1::/48
+2408:8411:c0c2::/48
+2408:8411:c0c3::/48
+2408:8411:c0c4::/48
+2408:8411:c0c5::/48
+2408:8417:f000::/44
+2408:8417:f010::/44
+2408:8417:f020::/44
+2408:8418:f000::/44
+2408:8418:f010::/44
+2408:8418:f020::/44
+2408:841d:ef20::/44
+2408:841d:ef30::/44
+2408:841e:ef10::/44
+2408:841e:ef20::/44
+2408:841e:ef30::/44
+2408:8435:b490::/47
+2408:8435:b492::/47
+2408:8435:b494::/47
+2408:8435:b496::/47
+2408:8435:b498::/47
+2408:8435:b49a::/47
+2408:843e:e010::/48
+2408:843e:e011::/48
+2408:843e:e012::/48
+2408:843e:e080::/48
+2408:843e:e081::/48
+2408:843e:e082::/48
+2408:8441:fe00::/44
+2408:8441:fe10::/44
+2408:8441:fe20::/44
+2408:8441:ff00::/44
+2408:8441:ff10::/44
+2408:8441:ff20::/44
+2408:8444:d500::/44
+2408:8444:d580::/44
+2408:8444:d700::/44
+2408:8444:d780::/44
+2408:8444:d900::/44
+2408:8444:d980::/44
+2408:844c:cb09::/48
+2408:844c:cb0a::/48
+2408:844c:cb0b::/48
+2408:844d:cb09::/48
+2408:844d:cb0a::/48
+2408:844d:cb0b::/48
+2408:844f:d408::/47
+2408:844f:d40a::/47
+2408:844f:d40c::/47
+2408:844f:d500::/47
+2408:844f:d502::/47
+2408:844f:d504::/47
+2408:8462:ff00::/44
+2408:8462:ff10::/44
+2408:8462:ff20::/44
+2408:8463:ff00::/44
+2408:8463:ff10::/44
+2408:8463:ff20::/44
+2408:8469:fc00::/48
+2408:846a:b600::/44
+2408:846a:b610::/44
+2408:846a:b620::/44
+2408:846b:b600::/44
+2408:846b:b610::/44
+2408:846b:b620::/44
+2408:8471:fa00::/48
+2408:8471:fa01::/48
+2408:8471:fa02::/48
+2408:8471:fb00::/48
+2408:8471:fb01::/48
+2408:8471:fb02::/48
+2408:8474:fb10::/44
+2408:8474:fb20::/44
+2408:8474:fb30::/44
+2408:8474:fc10::/44
+2408:8474:fc20::/44
+2408:8474:fc30::/44
+2408:8478:fb10::/44
+2408:8478:fb20::/44
+2408:8478:fb30::/44
+2408:8478:fc10::/44
+2408:8478:fc20::/44
+2408:8478:fc30::/44
+2408:847a:ff20::/48
+2408:847a:ff21::/48
+2408:847a:ff22::/48
+2408:847a:ff40::/48
+2408:847a:ff41::/48
+2408:847a:ff42::/48
+2408:8610:3bff::/48
+2408:8614:1f0::/48
+2408:8614:af0::/48
+2408:861c:1fff::/48
+2408:8625:10fb::/48
+2408:8625:fe::/48
+2408:8626:f200::/48
+2408:862b::/48
+2408:862e:2ff::/48
+2408:8634:1015::/48
+2408:8638:116::/48
+2408:8640:f100::/40
+2408:8649:1a00::/48
+2408:8649:2a00::/48
+2408:864c:10ff::/48
+2408:8651:ff00::/48
+2408:8652:ff00::/48
+2408:8656:a52::/48
+2408:865c:f0::/44
+2408:8660:100::/48
+2408:8660:a100::/48
+2408:8660:ab00::/48
+2408:8660:b500::/48
+2408:8660:bf00::/48
+2408:8666:ff00::/48
+2408:866a:a05::/48
+2408:866c:ff00::/48
+2408:8670:800::/48
+2408:8678:1400::/48
+2408:8756:3efd::/48
+2408:8a00:c000::/36
+2408:8a00:d000::/38
+2408:8a00:d400::/38
+2408:8a00:e000::/36
+2408:8a00:f000::/36
+2408:8a01::/36
+2408:8a02:b110::/44
+2408:8a02:b120::/44
+2408:8a04:8000::/36
+2408:8a04:e000::/40
+2408:8a06:100::/48
+2408:8a06:101::/48
+2408:8a06:1::/48
+2408:8a06::/48
+2408:8a07::/40
+2408:8a26:ee10::/48
+2408:8a26:f020::/48
+2408:8a26:f950::/48

bk/prefix/as9929.txt.manifest.json

@@ -0,0 +1,7 @@
+{
+  "schema": "backtrace.asn-prefixes/v1",
+  "file": "as9929.txt",
+  "count": 144,
+  "sha256": "a5f65f08a447982cd2c8611005261deab3400f1232ae594fb98f6bfb3fe09084",
+  "generated_at": "2026-07-20T19:12:54Z"
+}

bk/prefix_registry.go

@@ -0,0 +1,294 @@
+package backtrace
+
+import (
+	"context"
+	"crypto/sha256"
+	"embed"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+const (
+	ASNPrefixRegistrySchema     = "backtrace.asn-prefixes/v1"
+	ASNPrefixRegistryRawBaseURL = "https://raw.githubusercontent.com/oneclickvirt/backtrace/main/bk/prefix"
+	ASNPrefixRegistryCDNBaseURL = "https://cdn.spiritlhl.net/" + ASNPrefixRegistryRawBaseURL
+)
+
+var knownPrefixASNs = []string{"AS23764", "AS4134", "AS4809", "AS4837", "AS58453", "AS58807", "AS9808", "AS9929"}
+var prefixFragmentPattern = regexp.MustCompile(`^[0-9a-fA-F:]+$`)
+
+type ASNPrefixRegistrySource struct {
+	Name             string
+	Base             string
+	ValidateManifest bool
+}
+
+type ASNPrefixRegistryLoadResult struct {
+	Prefixes map[string][]string
+	Source   string
+	Fallback bool
+}
+
+var activeASNPrefixes atomic.Value // stores map[string][]string; maps are immutable after publication
+var refreshASNPrefixesOnce sync.Once
+
+//go:embed prefix/*.txt.manifest.json
+var embeddedPrefixManifestFS embed.FS
+
+func init() {
+	activeASNPrefixes.Store(cloneASNPrefixes(asnPrefixes))
+}
+
+func DefaultASNPrefixRegistrySources() []ASNPrefixRegistrySource {
+	return []ASNPrefixRegistrySource{
+		{Name: "cdn", Base: ASNPrefixRegistryCDNBaseURL, ValidateManifest: true},
+		{Name: "raw", Base: ASNPrefixRegistryRawBaseURL, ValidateManifest: true},
+	}
+}
+
+func LoadASNPrefixRegistry(ctx context.Context, client *http.Client, sources []ASNPrefixRegistrySource) (ASNPrefixRegistryLoadResult, error) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	if client == nil {
+		client = &http.Client{Timeout: 6 * time.Second}
+	}
+	var lastErr error
+	for index, source := range sources {
+		prefixes, err := fetchASNPrefixSource(ctx, client, source)
+		if err != nil {
+			lastErr = fmt.Errorf("load %s ASN prefixes: %w", source.Name, err)
+			continue
+		}
+		return ASNPrefixRegistryLoadResult{Prefixes: prefixes, Source: source.Name, Fallback: index > 0}, nil
+	}
+	embedded := cloneASNPrefixes(asnPrefixes)
+	if len(embedded) > 0 {
+		if err := validateEmbeddedPrefixManifests(); err != nil {
+			return ASNPrefixRegistryLoadResult{}, fmt.Errorf("validate embedded ASN prefix manifests: %w", err)
+		}
+		return ASNPrefixRegistryLoadResult{Prefixes: embedded, Source: "embedded", Fallback: true}, nil
+	}
+	if lastErr == nil {
+		lastErr = errors.New("no ASN prefix registry sources configured")
+	}
+	return ASNPrefixRegistryLoadResult{}, lastErr
+}
+
+func RefreshASNPrefixRegistry(ctx context.Context, client *http.Client, sources []ASNPrefixRegistrySource) (ASNPrefixRegistryLoadResult, error) {
+	loaded, err := LoadASNPrefixRegistry(ctx, client, sources)
+	if err != nil {
+		return ASNPrefixRegistryLoadResult{}, err
+	}
+	activeASNPrefixes.Store(cloneASNPrefixes(loaded.Prefixes))
+	return loaded, nil
+}
+
+// StartASNPrefixRefresh performs one bounded background refresh. It never
+// delays legacy tracing and the embedded map remains active on any error.
+func StartASNPrefixRefresh() {
+	refreshASNPrefixesOnce.Do(func() {
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancel()
+			_, _ = RefreshASNPrefixRegistry(ctx, nil, DefaultASNPrefixRegistrySources())
+		}()
+	})
+}
+
+type prefixManifest struct {
+	Schema      string `json:"schema"`
+	File        string `json:"file"`
+	Count       int    `json:"count"`
+	SHA256      string `json:"sha256"`
+	GeneratedAt string `json:"generated_at"`
+}
+
+func fetchASNPrefixSource(ctx context.Context, client *http.Client, source ASNPrefixRegistrySource) (map[string][]string, error) {
+	base := source.Base
+	parsed, err := url.Parse(strings.TrimRight(base, "/"))
+	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Hostname() == "" {
+		return nil, errors.New("invalid ASN prefix source")
+	}
+	type prefixResult struct {
+		asn    string
+		values []string
+		err    error
+	}
+	results := make(chan prefixResult, len(knownPrefixASNs))
+	for _, asn := range knownPrefixASNs {
+		go func(asn string) {
+			endpoint := strings.TrimRight(base, "/") + "/" + strings.ToLower(asn) + ".txt"
+			var manifestData []byte
+			if source.ValidateManifest {
+				fetchedManifest, fetchErr := fetchPrefixResource(ctx, client, endpoint+".manifest.json")
+				if fetchErr != nil {
+					results <- prefixResult{asn: asn, err: fmt.Errorf("manifest: %w", fetchErr)}
+					return
+				}
+				manifestData = fetchedManifest
+			}
+			data, err := fetchPrefixResource(ctx, client, endpoint)
+			if err != nil {
+				results <- prefixResult{asn: asn, err: err}
+				return
+			}
+			if source.ValidateManifest {
+				if err := validatePrefixManifest(manifestData, data, strings.ToLower(asn)+".txt"); err != nil {
+					results <- prefixResult{asn: asn, err: err}
+					return
+				}
+			}
+			values, parseErr := parseASNPrefixLines(data)
+			results <- prefixResult{asn: asn, values: values, err: parseErr}
+		}(asn)
+	}
+	result := make(map[string][]string, len(knownPrefixASNs))
+	for range knownPrefixASNs {
+		loaded := <-results
+		if loaded.err != nil {
+			return nil, fmt.Errorf("%s: %w", loaded.asn, loaded.err)
+		}
+		result[loaded.asn] = loaded.values
+	}
+	return result, nil
+}
+
+func fetchPrefixResource(ctx context.Context, client *http.Client, endpoint string) ([]byte, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+	request.Header.Set("Accept", "text/plain, application/json")
+	request.Header.Set("User-Agent", "oneclickvirt-backtrace/asn-prefix-registry-v1")
+	response, err := client.Do(request)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d", response.StatusCode)
+	}
+	return io.ReadAll(io.LimitReader(response.Body, 4<<20))
+}
+
+func validatePrefixManifest(data, snapshot []byte, expectedFile string) error {
+	var manifest prefixManifest
+	decoder := json.NewDecoder(strings.NewReader(string(data)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&manifest); err != nil {
+		return fmt.Errorf("decode manifest: %w", err)
+	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		return errors.New("manifest contains trailing JSON")
+	}
+	if manifest.Schema != ASNPrefixRegistrySchema || manifest.File != expectedFile || manifest.Count < 1 {
+		return errors.New("manifest schema, file, or count is invalid")
+	}
+	if _, err := time.Parse(time.RFC3339, manifest.GeneratedAt); err != nil {
+		return fmt.Errorf("manifest generated_at is invalid: %w", err)
+	}
+	hash := sha256.Sum256(snapshot)
+	if !strings.EqualFold(manifest.SHA256, hex.EncodeToString(hash[:])) {
+		return errors.New("manifest SHA-256 does not match snapshot")
+	}
+	values, err := parseASNPrefixLines(snapshot)
+	if err != nil {
+		return err
+	}
+	if len(values) != manifest.Count {
+		return fmt.Errorf("manifest count %d does not match snapshot count %d", manifest.Count, len(values))
+	}
+	return nil
+}
+
+func validateEmbeddedPrefixManifests() error {
+	for _, asn := range knownPrefixASNs {
+		name := strings.ToLower(asn) + ".txt"
+		manifest, err := embeddedPrefixManifestFS.ReadFile("prefix/" + name + ".manifest.json")
+		if err != nil {
+			return err
+		}
+		var snapshot []byte
+		switch asn {
+		case "AS23764":
+			snapshot = []byte(as23764Data)
+		case "AS4134":
+			snapshot = []byte(as4134Data)
+		case "AS4809":
+			snapshot = []byte(as4809Data)
+		case "AS4837":
+			snapshot = []byte(as4837Data)
+		case "AS58453":
+			snapshot = []byte(as58453Data)
+		case "AS58807":
+			snapshot = []byte(as58807Data)
+		case "AS9808":
+			snapshot = []byte(as9808Data)
+		case "AS9929":
+			snapshot = []byte(as9929Data)
+		}
+		if err := validatePrefixManifest(manifest, snapshot, name); err != nil {
+			return fmt.Errorf("%s: %w", asn, err)
+		}
+	}
+	return nil
+}
+
+func parseASNPrefixLines(data []byte) ([]string, error) {
+	seen := make(map[string]struct{})
+	values := make([]string, 0)
+	for _, raw := range strings.Split(string(data), "\n") {
+		value := strings.TrimSpace(raw)
+		if value == "" {
+			continue
+		}
+		if strings.Contains(value, "/") {
+			prefix, err := netip.ParsePrefix(value)
+			if err != nil || !prefix.Addr().Is6() {
+				return nil, fmt.Errorf("invalid IPv6 prefix %q", value)
+			}
+		} else if !prefixFragmentPattern.MatchString(value) {
+			return nil, fmt.Errorf("invalid prefix fragment %q", value)
+		}
+		value = strings.ToLower(value)
+		if _, exists := seen[value]; exists {
+			continue
+		}
+		seen[value] = struct{}{}
+		values = append(values, value)
+	}
+	if len(values) == 0 {
+		return nil, errors.New("prefix file is empty")
+	}
+	sort.Strings(values)
+	return values, nil
+}
+
+func cloneASNPrefixes(input map[string][]string) map[string][]string {
+	result := make(map[string][]string, len(input))
+	for asn, values := range input {
+		result[asn] = append([]string(nil), values...)
+	}
+	return result
+}
+
+func currentASNPrefixes() map[string][]string {
+	if value := activeASNPrefixes.Load(); value != nil {
+		return value.(map[string][]string)
+	}
+	return asnPrefixes
+}

bk/prefix_registry_test.go

@@ -0,0 +1,84 @@
+package backtrace
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestParseASNPrefixLinesNormalizesAndDeduplicates(t *testing.T) {
+	values, err := parseASNPrefixLines([]byte("2409:8000\n2409:8000\n2401:db8::/32\n"))
+	if err != nil || len(values) != 2 || values[0] != "2401:db8::/32" {
+		t.Fatalf("unexpected prefixes: %#v, %v", values, err)
+	}
+}
+
+func TestLoadASNPrefixRegistryUsesRawAfterCDNFailure(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		path := strings.TrimPrefix(request.URL.Path, "/")
+		parts := strings.Split(path, "/")
+		if len(parts) != 2 {
+			http.NotFound(writer, request)
+			return
+		}
+		base, file := parts[0], parts[1]
+		snapshot := []byte("2409:8000\n")
+		if base == "bad" && file == "as23764.txt.manifest.json" {
+			_, _ = writer.Write([]byte(`{}`))
+			return
+		}
+		if strings.HasSuffix(file, ".manifest.json") {
+			hash := sha256.Sum256(snapshot)
+			manifest, _ := json.Marshal(prefixManifest{Schema: ASNPrefixRegistrySchema, File: strings.TrimSuffix(file, ".manifest.json"), Count: 1, SHA256: hex.EncodeToString(hash[:]), GeneratedAt: "2026-01-01T00:00:00Z"})
+			_, _ = writer.Write(manifest)
+			return
+		}
+		_, _ = writer.Write(snapshot)
+	}))
+	defer server.Close()
+	sources := []ASNPrefixRegistrySource{{Name: "cdn", Base: server.URL + "/bad", ValidateManifest: true}, {Name: "raw", Base: server.URL + "/good", ValidateManifest: true}}
+	loaded, err := LoadASNPrefixRegistry(context.Background(), server.Client(), sources)
+	if err != nil || loaded.Source != "raw" || !loaded.Fallback || len(loaded.Prefixes) != len(knownPrefixASNs) {
+		t.Fatalf("unexpected load: %+v, %v", loaded, err)
+	}
+}
+
+func TestValidatePrefixManifestRejectsHashAndCountMismatch(t *testing.T) {
+	snapshot := []byte("2409:8000\n")
+	manifest := prefixManifest{Schema: ASNPrefixRegistrySchema, File: "as23764.txt", Count: 2, SHA256: strings.Repeat("0", 64), GeneratedAt: "2026-01-01T00:00:00Z"}
+	data, err := json.Marshal(manifest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := validatePrefixManifest(data, snapshot, "as23764.txt"); err == nil {
+		t.Fatal("invalid manifest unexpectedly accepted")
+	}
+}
+
+func TestValidateEmbeddedPrefixManifests(t *testing.T) {
+	if err := validateEmbeddedPrefixManifests(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestEmbeddedManifestFilesArePresent(t *testing.T) {
+	for _, asn := range knownPrefixASNs {
+		name := strings.ToLower(asn) + ".txt.manifest.json"
+		if _, err := embeddedPrefixManifestFS.ReadFile(filepath.Join("prefix", name)); err != nil {
+			t.Fatalf("missing embedded manifest %s: %v", name, err)
+		}
+	}
+}
+
+func TestLoadASNPrefixRegistryEmbeddedFallback(t *testing.T) {
+	loaded, err := LoadASNPrefixRegistry(context.Background(), nil, nil)
+	if err != nil || loaded.Source != "embedded" || !loaded.Fallback || len(loaded.Prefixes) == 0 {
+		t.Fatalf("unexpected embedded load: %+v, %v", loaded, err)
+	}
+}

bk/utils.go

@@ -80,11 +80,11 @@ func getData(endpoint string) string {
 		InitLogger()
 		defer Logger.Sync()
 	}
-	
+
 	// 先测试CDN可用性
 	testUrl := "https://raw.githubusercontent.com/spiritLHLS/ecs/main/back/test"
 	cdnUrl := checkCdn(testUrl)
-	
+
 	// 如果有可用的CDN，使用CDN获取数据
 	if cdnUrl != "" {
 		url := cdnUrl + endpoint
@@ -106,7 +106,7 @@ func getData(endpoint string) string {
 			Logger.Info(fmt.Sprintf("CDN request failed: %v", err))
 		}
 	}
-	
+
 	// CDN不可用，尝试直连
 	if model.EnableLoger {
 		Logger.Info(fmt.Sprintf("Trying direct connection: %s", endpoint))

cmd/main.go

@@ -1,9 +1,11 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"flag"
 	"fmt"
+	"io"
 	"net/http"
 	"os"
 	"runtime"
@@ -32,6 +34,32 @@ type ConcurrentResults struct {
 	// backtraceError  error
 }
 
+type cliOptions struct {
+	showVersion bool
+	showIPInfo  bool
+	help        bool
+	ipv6        bool
+	jsonOutput  bool
+	deep        bool
+	specifiedIP string
+	timeout     time.Duration
+}
+
+func newBacktraceFlagSet(options *cliOptions) *flag.FlagSet {
+	set := flag.NewFlagSet("backtrace", flag.ContinueOnError)
+	set.BoolVar(&options.help, "h", false, "Show help information")
+	set.BoolVar(&options.showVersion, "v", false, "Show version")
+	set.BoolVar(&options.showIPInfo, "s", true, "Disabe show ip info")
+	set.BoolVar(&model.EnableLoger, "log", false, "Enable logging")
+	set.BoolVar(&options.ipv6, "ipv6", false, "Enable ipv6 testing")
+	set.StringVar(&options.specifiedIP, "ip", "", "Specify IP address for bgptools")
+	set.BoolVar(&options.jsonOutput, "json", false, "Output structured RDAP/BGP report as JSON")
+	set.BoolVar(&options.jsonOutput, "structured", false, "Alias for -json")
+	set.BoolVar(&options.deep, "deep", false, "Fetch geofeed and enable WHOIS fallback")
+	set.DurationVar(&options.timeout, "timeout", 15*time.Second, "Structured report timeout")
+	return set
+}
+
 func safeGo(wg *sync.WaitGroup, fn func()) {
 	go func() {
 		defer wg.Done()
@@ -50,36 +78,52 @@ func main() {
 			resp.Body.Close()
 		}
 	}()
-	fmt.Println(Green("Repo:"), Yellow("https://github.com/oneclickvirt/backtrace"))
-	var showVersion, showIpInfo, help, ipv6 bool
-	var specifiedIP string
-	backtraceFlag := flag.NewFlagSet("backtrace", flag.ContinueOnError)
-	backtraceFlag.BoolVar(&help, "h", false, "Show help information")
-	backtraceFlag.BoolVar(&showVersion, "v", false, "Show version")
-	backtraceFlag.BoolVar(&showIpInfo, "s", true, "Disabe show ip info")
-	backtraceFlag.BoolVar(&model.EnableLoger, "log", false, "Enable logging")
-	backtraceFlag.BoolVar(&ipv6, "ipv6", false, "Enable ipv6 testing")
-	backtraceFlag.StringVar(&specifiedIP, "ip", "", "Specify IP address for bgptools")
-	backtraceFlag.Parse(os.Args[1:])
-	if help {
+	var options cliOptions
+	backtraceFlag := newBacktraceFlagSet(&options)
+	if err := backtraceFlag.Parse(os.Args[1:]); err != nil {
+		os.Exit(2)
+	}
+	if !options.jsonOutput {
+		fmt.Println(Green("Repo:"), Yellow("https://github.com/oneclickvirt/backtrace"))
+	}
+	if options.help {
 		fmt.Printf("Usage: %s [options]\n", os.Args[0])
 		backtraceFlag.PrintDefaults()
 		return
 	}
-	if showVersion {
+	if options.showVersion {
 		fmt.Println(model.BackTraceVersion)
 		return
 	}
+	if err := validateStructuredOptions(options); err != nil {
+		fmt.Fprintln(os.Stderr, sanitizeErrorText(err.Error()))
+		os.Exit(2)
+	}
+	if options.jsonOutput {
+		config := bgptools.IPBGPReportConfig{
+			Timeout:             options.timeout,
+			FetchGeofeed:        options.deep,
+			EnableWHOISFallback: options.deep,
+			ResolveASN: func(ctx context.Context, ip string) (string, error) {
+				return bgptools.ResolveOriginASNWithConfig(ctx, ip, bgptools.OriginASNConfig{Timeout: options.timeout})
+			},
+		}
+		if err := writeStructuredReport(context.Background(), os.Stdout, options.specifiedIP, config, bgptools.QueryIPBGPReport); err != nil {
+			fmt.Fprintf(os.Stderr, "structured report failed: %s\n", sanitizeErrorText(err.Error()))
+			os.Exit(1)
+		}
+		return
+	}
 	info := IpInfo{}
-	if showIpInfo {
+	if options.showIPInfo {
 		rsp, err := http.Get("http://ipinfo.io")
 		if err != nil {
-			fmt.Printf("get ip info err %v \n", err.Error())
+			fmt.Printf("get ip info err %s \n", sanitizeErrorText(err.Error()))
 		} else {
 			defer rsp.Body.Close()
 			err = json.NewDecoder(rsp.Body).Decode(&info)
 			if err != nil {
-				fmt.Printf("json decode err %v \n", err.Error())
+				fmt.Printf("json decode err %s \n", sanitizeErrorText(err.Error()))
 			} else {
 				fmt.Println(Green("国家: ") + White(info.Country) + Green(" 城市: ") + White(info.City) +
 					Green(" 服务商: ") + Blue(info.Org))
@@ -98,7 +142,7 @@ func main() {
 	var useIPv6 bool
 	switch preCheck.StackType {
 	case "DualStack":
-		useIPv6 = ipv6
+		useIPv6 = options.ipv6
 	case "IPv4":
 		useIPv6 = false
 	case "IPv6":
@@ -114,8 +158,8 @@ func main() {
 	results := ConcurrentResults{}
 	var wg sync.WaitGroup
 	var targetIP string
-	if specifiedIP != "" {
-		targetIP = specifiedIP
+	if options.specifiedIP != "" {
+		targetIP = options.specifiedIP
 	} else if info.Ip != "" {
 		targetIP = info.Ip
 	}
@@ -142,10 +186,10 @@ func main() {
 	})
 	wg.Wait()
 	if results.bgpResult != "" {
-		fmt.Print(results.bgpResult)
+		fmt.Print(indentLegacyOutput(results.bgpResult))
 	}
 	if results.backtraceResult != "" {
-		fmt.Printf("%s\n", results.backtraceResult)
+		fmt.Printf("%s\n", indentLegacyOutput(results.backtraceResult))
 	}
 	fmt.Println(Yellow("准确线路自行查看详细路由，本测试结果仅作参考"))
 	fmt.Println(Yellow("同一目标地址多个线路时，检测可能已越过汇聚层，除第一个线路外，后续信息可能无效"))
@@ -154,3 +198,29 @@ func main() {
 		fmt.Scanln()
 	}
 }
+
+func validateStructuredOptions(options cliOptions) error {
+	if options.deep && !options.jsonOutput {
+		return fmt.Errorf("-deep requires -json or -structured")
+	}
+	if !options.jsonOutput {
+		return nil
+	}
+	if options.specifiedIP == "" {
+		return fmt.Errorf("structured report requires -ip")
+	}
+	if options.timeout <= 0 {
+		return fmt.Errorf("structured report timeout must be positive")
+	}
+	return nil
+}
+
+func writeStructuredReport(ctx context.Context, output io.Writer, ip string, config bgptools.IPBGPReportConfig, query func(context.Context, string, bgptools.IPBGPReportConfig) (*bgptools.IPBGPReport, error)) error {
+	report, err := query(ctx, ip, config)
+	if err != nil {
+		return err
+	}
+	encoder := json.NewEncoder(output)
+	encoder.SetIndent("", "  ")
+	return encoder.Encode(report)
+}

cmd/main_test.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/oneclickvirt/backtrace/bgptools"
+)
+
+func TestBacktraceStructuredFlagParsing(t *testing.T) {
+	var options cliOptions
+	set := newBacktraceFlagSet(&options)
+	if err := set.Parse([]string{"-structured", "-deep", "-ip", "192.0.2.1", "-timeout", "900ms"}); err != nil {
+		t.Fatal(err)
+	}
+	if !options.jsonOutput || !options.deep || options.specifiedIP != "192.0.2.1" || options.timeout != 900*time.Millisecond {
+		t.Fatalf("unexpected options: %+v", options)
+	}
+}
+
+func TestBacktraceDefaultsPreserveLegacyMode(t *testing.T) {
+	var options cliOptions
+	if err := newBacktraceFlagSet(&options).Parse(nil); err != nil {
+		t.Fatal(err)
+	}
+	if !options.showIPInfo || options.jsonOutput || options.deep || options.ipv6 || options.specifiedIP != "" || options.timeout != 15*time.Second {
+		t.Fatalf("legacy defaults changed: %+v", options)
+	}
+}
+
+func TestValidateStructuredOptionsRequiresExplicitModeAndTarget(t *testing.T) {
+	tests := []cliOptions{
+		{deep: true, timeout: time.Second},
+		{jsonOutput: true, timeout: time.Second},
+		{jsonOutput: true, specifiedIP: "192.0.2.1"},
+	}
+	for _, options := range tests {
+		if err := validateStructuredOptions(options); err == nil {
+			t.Fatalf("expected invalid structured options: %+v", options)
+		}
+	}
+	if err := validateStructuredOptions(cliOptions{jsonOutput: true, deep: true, specifiedIP: "192.0.2.1", timeout: time.Second}); err != nil {
+		t.Fatalf("valid structured options rejected: %v", err)
+	}
+}
+
+func TestWriteStructuredReportKeepsStdoutJSONOnly(t *testing.T) {
+	var output bytes.Buffer
+	err := writeStructuredReport(context.Background(), &output, "192.0.2.1", bgptools.IPBGPReportConfig{Timeout: time.Second}, func(_ context.Context, ip string, _ bgptools.IPBGPReportConfig) (*bgptools.IPBGPReport, error) {
+		return &bgptools.IPBGPReport{IP: ip, Status: bgptools.ReportAvailable, Sources: []bgptools.IPBGPSourceStatus{}}, nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var report bgptools.IPBGPReport
+	if err := json.Unmarshal(output.Bytes(), &report); err != nil {
+		t.Fatalf("stdout is not JSON: %v (%q)", err, output.String())
+	}
+	if report.IP != "192.0.2.1" {
+		t.Fatalf("unexpected report: %+v", report)
+	}
+}

cmd/output.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"regexp"
+	"strings"
+)
+
+var privateErrorPattern = regexp.MustCompile("(?i)(https?://)[^\\s]+")
+var privateTokenPattern = regexp.MustCompile("(?i)(^|[?&\\s])(token|api[_-]?key|secret|authorization|password|key)=([^&\\s]+)")
+var privatePathPattern = regexp.MustCompile("(?:[A-Za-z]:\\\\|/)[^\\s]+")
+
+func indentLegacyOutput(value string) string {
+	lines := strings.Split(value, "\n")
+	for index, line := range lines {
+		if line != "" && line[0] != ' ' && line[0] != '\t' {
+			lines[index] = " " + line
+		}
+	}
+	return strings.Join(lines, "\n")
+}
+
+// sanitizeErrorText keeps remote-source and credential details out of user-visible errors.
+func sanitizeErrorText(value string) string {
+	value = privateErrorPattern.ReplaceAllString(value, "<remote>")
+	value = privateTokenPattern.ReplaceAllString(value, "$1$2=<redacted>")
+	return privatePathPattern.ReplaceAllString(value, "<path>")
+}

cmd/output_test.go

@@ -0,0 +1,24 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestIndentLegacyOutputLeavesOneLeadingCell(t *testing.T) {
+	got := indentLegacyOutput("alpha\n beta\n\tgamma\n")
+	want := " alpha\n beta\n\tgamma\n"
+	if got != want {
+		t.Fatalf("indentLegacyOutput() = %q, want %q", got, want)
+	}
+}
+
+func TestSanitizeErrorTextRedactsRemoteSecretsAndPaths(t *testing.T) {
+	input := "load https://private.example/repo/data?token=secret from /private/cache failed: api_key=hidden"
+	got := sanitizeErrorText(input)
+	for _, forbidden := range []string{"private.example", "secret", "hidden", "/private/cache"} {
+		if strings.Contains(got, forbidden) {
+			t.Fatalf("sanitizeErrorText() leaked %q in %q", forbidden, got)
+		}
+	}
+}

cmd/update-asn-metadata/main.go

@@ -0,0 +1,207 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/oneclickvirt/backtrace/bgptools"
+)
+
+const defaultSource = "https://raw.githubusercontent.com/xykt/NetQuality/main/ref/AS_Mapping.txt"
+
+type document struct {
+	Schema      string                 `json:"schema"`
+	GeneratedAt time.Time              `json:"generated_at"`
+	Entries     []bgptools.ASNMetadata `json:"entries"`
+}
+
+type manifest struct {
+	Schema      string    `json:"schema"`
+	File        string    `json:"file"`
+	Count       int       `json:"count"`
+	SHA256      string    `json:"sha256"`
+	GeneratedAt time.Time `json:"generated_at"`
+}
+
+func main() {
+	source := flag.String("source", defaultSource, "ASN name registry URL")
+	output := flag.String("output", "bgptools/data/bgp-asn-map.json", "snapshot output path")
+	minimum := flag.Int("min-count", bgptools.ASNMetadataMinimum, "minimum accepted ASN count")
+	timeout := flag.Duration("timeout", 30*time.Second, "fetch timeout")
+	flag.Parse()
+	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
+	defer cancel()
+	entries, err := fetchEntries(ctx, http.DefaultClient, *source)
+	if err != nil {
+		fatal(err)
+	}
+	if err := updateSnapshot(*output, entries, *minimum); err != nil {
+		fatal(err)
+	}
+}
+
+func fetchEntries(ctx context.Context, client *http.Client, source string) ([]bgptools.ASNMetadata, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, source, nil)
+	if err != nil {
+		return nil, err
+	}
+	request.Header.Set("User-Agent", "oneclickvirt-backtrace-asn-sync/1")
+	response, err := client.Do(request)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("ASN registry returned HTTP %d", response.StatusCode)
+	}
+	return parseEntries(io.LimitReader(response.Body, 4<<20))
+}
+
+func parseEntries(reader io.Reader) ([]bgptools.ASNMetadata, error) {
+	seen := make(map[uint32]string)
+	scanner := bufio.NewScanner(reader)
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) < 2 || !strings.HasPrefix(strings.ToUpper(fields[0]), "AS") {
+			continue
+		}
+		number, err := strconv.ParseUint(strings.TrimPrefix(strings.ToUpper(fields[0]), "AS"), 10, 32)
+		if err != nil || number == 0 {
+			continue
+		}
+		if _, exists := seen[uint32(number)]; !exists {
+			seen[uint32(number)] = strings.Join(fields[1:], " ")
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, err
+	}
+	entries := make([]bgptools.ASNMetadata, 0, len(seen))
+	for asn, name := range seen {
+		entries = append(entries, bgptools.ASNMetadata{ASN: asn, Name: name})
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].ASN < entries[j].ASN })
+	if len(entries) == 0 {
+		return nil, fmt.Errorf("ASN registry contains no valid entries")
+	}
+	return entries, nil
+}
+
+func updateSnapshot(path string, entries []bgptools.ASNMetadata, minimum int) error {
+	if len(entries) < minimum {
+		return fmt.Errorf("ASN count %d is below minimum %d", len(entries), minimum)
+	}
+	currentData, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	var current document
+	if err := json.Unmarshal(currentData, &current); err != nil || current.Schema != bgptools.ASNMetadataSchema {
+		return fmt.Errorf("current ASN metadata schema is invalid")
+	}
+	if len(current.Entries) >= minimum && len(entries)*100 < len(current.Entries)*65 {
+		return fmt.Errorf("ASN count dropped from %d to %d", len(current.Entries), len(entries))
+	}
+	if sameEntries(current.Entries, entries) && !current.GeneratedAt.IsZero() {
+		return writeManifest(path, currentData, len(current.Entries))
+	}
+	next, err := json.MarshalIndent(document{Schema: bgptools.ASNMetadataSchema, GeneratedAt: time.Now().UTC(), Entries: entries}, "", "  ")
+	if err != nil {
+		return err
+	}
+	next = append(next, '\n')
+	temporary, err := os.CreateTemp(filepath.Dir(path), ".asn-metadata-*.json")
+	if err != nil {
+		return err
+	}
+	name := temporary.Name()
+	defer os.Remove(name)
+	if _, err := temporary.Write(next); err != nil {
+		temporary.Close()
+		return err
+	}
+	if err := temporary.Chmod(0o644); err != nil {
+		temporary.Close()
+		return err
+	}
+	if err := temporary.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(name, path); err != nil {
+		return err
+	}
+	return writeManifest(path, next, len(entries))
+}
+
+func writeManifest(snapshotPath string, snapshot []byte, count int) error {
+	var snapshotDocument document
+	if err := json.Unmarshal(snapshot, &snapshotDocument); err != nil {
+		return err
+	}
+	hash := sha256.Sum256(snapshot)
+	value := manifest{
+		Schema: bgptools.ASNMetadataManifestSchema, File: filepath.Base(snapshotPath), Count: count,
+		SHA256: hex.EncodeToString(hash[:]), GeneratedAt: snapshotDocument.GeneratedAt,
+	}
+	data, err := json.MarshalIndent(value, "", "  ")
+	if err != nil {
+		return err
+	}
+	data = append(data, '\n')
+	manifestPath := strings.TrimSuffix(snapshotPath, ".json") + ".manifest.json"
+	if current, readErr := os.ReadFile(manifestPath); readErr == nil && string(current) == string(data) {
+		return nil
+	}
+	return writeAtomic(manifestPath, data)
+}
+
+func writeAtomic(path string, data []byte) error {
+	temporary, err := os.CreateTemp(filepath.Dir(path), ".asn-metadata-manifest-*.json")
+	if err != nil {
+		return err
+	}
+	name := temporary.Name()
+	defer os.Remove(name)
+	if _, err := temporary.Write(data); err != nil {
+		temporary.Close()
+		return err
+	}
+	if err := temporary.Chmod(0o644); err != nil {
+		temporary.Close()
+		return err
+	}
+	if err := temporary.Close(); err != nil {
+		return err
+	}
+	return os.Rename(name, path)
+}
+
+func sameEntries(left, right []bgptools.ASNMetadata) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func fatal(err error) {
+	fmt.Fprintln(os.Stderr, err)
+	os.Exit(1)
+}

cmd/update-asn-metadata/main_test.go

@@ -0,0 +1,62 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/oneclickvirt/backtrace/bgptools"
+)
+
+func TestParseEntriesDeduplicatesAndSorts(t *testing.T) {
+	entries, err := parseEntries(strings.NewReader("AS3356 Lumen\nAS174 Cogent\nAS3356 Level3\ninvalid\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 2 || entries[0] != (bgptools.ASNMetadata{ASN: 174, Name: "Cogent"}) || entries[1].Name != "Lumen" {
+		t.Fatalf("unexpected entries: %#v", entries)
+	}
+}
+
+func TestUpdateSnapshotWritesMatchingManifestWithoutRewritingSnapshot(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "asn.json")
+	current := []byte(`{"schema":"backtrace.asn-metadata/v1","generated_at":"2026-07-20T00:00:00Z","entries":[{"asn":1,"name":"One"},{"asn":2,"name":"Two"}]}`)
+	if err := os.WriteFile(path, current, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	entries := []bgptools.ASNMetadata{{ASN: 1, Name: "One"}, {ASN: 2, Name: "Two"}}
+	if err := updateSnapshot(path, entries, 1); err != nil {
+		t.Fatal(err)
+	}
+	after, _ := os.ReadFile(path)
+	if string(after) != string(current) {
+		t.Fatal("semantic no-op rewrote snapshot")
+	}
+	data, err := os.ReadFile(filepath.Join(filepath.Dir(path), "asn.manifest.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var value manifest
+	if err := json.Unmarshal(data, &value); err != nil {
+		t.Fatal(err)
+	}
+	hash := sha256.Sum256(current)
+	if value.Schema != bgptools.ASNMetadataManifestSchema || value.File != "asn.json" || value.Count != 2 || value.SHA256 != hex.EncodeToString(hash[:]) {
+		t.Fatalf("manifest mismatch: %#v", value)
+	}
+}
+
+func TestUpdateSnapshotRejectsCountDrop(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "asn.json")
+	current := `{"schema":"backtrace.asn-metadata/v1","generated_at":"2026-07-20T00:00:00Z","entries":[{"asn":1,"name":"One"},{"asn":2,"name":"Two"}]}`
+	if err := os.WriteFile(path, []byte(current), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := updateSnapshot(path, []bgptools.ASNMetadata{{ASN: 1, Name: "One"}}, 1); err == nil {
+		t.Fatal("count drop unexpectedly accepted")
+	}
+}

cmd/update-prefixes/main.go

@@ -0,0 +1,280 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+)
+
+var knownASNs = []string{"AS23764", "AS4134", "AS4809", "AS4837", "AS58453", "AS58807", "AS9808", "AS9929"}
+var errPrefixCountDrop = errors.New("prefix count dropped beyond protection threshold")
+
+type updateConfig struct {
+	SourceBase string
+	OutputDir  string
+	Timeout    time.Duration
+}
+
+func main() {
+	config := updateConfig{}
+	flag.StringVar(&config.SourceBase, "source-base", "https://stat.ripe.net/data/announced-prefixes/data.json", "upstream announced-prefixes API")
+	flag.StringVar(&config.OutputDir, "output-dir", "bk/prefix", "prefix snapshot directory")
+	flag.DurationVar(&config.Timeout, "timeout", 30*time.Second, "upstream request timeout")
+	flag.Parse()
+	if err := updatePrefixes(context.Background(), http.DefaultClient, config); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func updatePrefixes(ctx context.Context, client *http.Client, config updateConfig) error {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	if client == nil {
+		client = http.DefaultClient
+	}
+	if config.SourceBase == "" || config.OutputDir == "" || config.Timeout <= 0 {
+		return errors.New("source-base, output-dir, and timeout must be valid")
+	}
+	valuesByASN := make(map[string][]string, len(knownASNs))
+	for _, asn := range knownASNs {
+		requestCtx, cancel := context.WithTimeout(ctx, config.Timeout)
+		endpoint, err := url.Parse(config.SourceBase)
+		if err != nil {
+			cancel()
+			return fmt.Errorf("parse source URL: %w", err)
+		}
+		query := endpoint.Query()
+		query.Set("resource", asn)
+		endpoint.RawQuery = query.Encode()
+		request, err := http.NewRequestWithContext(requestCtx, http.MethodGet, endpoint.String(), nil)
+		if err != nil {
+			cancel()
+			return err
+		}
+		request.Header.Set("User-Agent", "oneclickvirt-backtrace-prefix-sync/1")
+		response, err := client.Do(request)
+		if err != nil {
+			cancel()
+			return fmt.Errorf("fetch %s: %w", asn, err)
+		}
+		body, readErr := io.ReadAll(io.LimitReader(response.Body, 8<<20))
+		response.Body.Close()
+		cancel()
+		if readErr != nil {
+			return readErr
+		}
+		if response.StatusCode != http.StatusOK {
+			return fmt.Errorf("fetch %s: HTTP %d", asn, response.StatusCode)
+		}
+		values, err := extractIPv6Prefixes(body)
+		if err != nil {
+			return fmt.Errorf("parse %s: %w", asn, err)
+		}
+		valuesByASN[asn] = values
+	}
+	for _, asn := range knownASNs {
+		path := filepath.Join(config.OutputDir, strings.ToLower(asn)+".txt")
+		if err := writePrefixFile(path, valuesByASN[asn]); err != nil {
+			if errors.Is(err, errPrefixCountDrop) {
+				fmt.Fprintf(os.Stderr, "skip %s: %v\n", asn, err)
+				current, readErr := os.ReadFile(path)
+				if readErr != nil {
+					return readErr
+				}
+				valuesByASN[asn] = prefixValuesFromFile(current)
+			} else {
+				return err
+			}
+		}
+		if err := writePrefixManifest(path); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type prefixManifest struct {
+	Schema      string `json:"schema"`
+	File        string `json:"file"`
+	Count       int    `json:"count"`
+	SHA256      string `json:"sha256"`
+	GeneratedAt string `json:"generated_at"`
+}
+
+func prefixValuesFromFile(data []byte) []string {
+	values := make([]string, 0)
+	for _, line := range strings.Split(string(data), "\n") {
+		if value := strings.TrimSpace(line); value != "" {
+			values = append(values, value)
+		}
+	}
+	return values
+}
+
+func writePrefixManifest(snapshotPath string) error {
+	snapshot, err := os.ReadFile(snapshotPath)
+	if err != nil {
+		return err
+	}
+	values := prefixValuesFromFile(snapshot)
+	if len(values) == 0 {
+		return errors.New("prefix snapshot is empty")
+	}
+	hash := sha256.Sum256(snapshot)
+	fileName := filepath.Base(snapshotPath)
+	sha256Value := hex.EncodeToString(hash[:])
+	manifestPath := snapshotPath + ".manifest.json"
+	if current, readErr := os.ReadFile(manifestPath); readErr == nil {
+		var existing prefixManifest
+		decoder := json.NewDecoder(bytes.NewReader(current))
+		decoder.DisallowUnknownFields()
+		var extra any
+		if decoder.Decode(&existing) == nil && decoder.Decode(&extra) == io.EOF &&
+			existing.Schema == "backtrace.asn-prefixes/v1" && existing.File == fileName &&
+			existing.Count == len(values) && strings.EqualFold(existing.SHA256, sha256Value) {
+			if _, timeErr := time.Parse(time.RFC3339, existing.GeneratedAt); timeErr == nil {
+				return nil
+			}
+		}
+	} else if !errors.Is(readErr, os.ErrNotExist) {
+		return readErr
+	}
+	manifest := prefixManifest{Schema: "backtrace.asn-prefixes/v1", File: fileName, Count: len(values), SHA256: sha256Value, GeneratedAt: time.Now().UTC().Format(time.RFC3339)}
+	data, err := json.MarshalIndent(manifest, "", "  ")
+	if err != nil {
+		return err
+	}
+	data = append(data, '\n')
+	return writeAtomicFile(manifestPath, data)
+}
+
+func writeAtomicFile(output string, data []byte) error {
+	if err := os.MkdirAll(filepath.Dir(output), 0o755); err != nil {
+		return err
+	}
+	temporary, err := os.CreateTemp(filepath.Dir(output), ".prefix-manifest-*")
+	if err != nil {
+		return err
+	}
+	temporaryName := temporary.Name()
+	defer os.Remove(temporaryName)
+	if err := temporary.Chmod(0o644); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if _, err := temporary.Write(data); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if err := temporary.Sync(); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if err := temporary.Close(); err != nil {
+		return err
+	}
+	return os.Rename(temporaryName, output)
+}
+
+func extractIPv6Prefixes(data []byte) ([]string, error) {
+	var response struct {
+		Status string `json:"status"`
+		Data   struct {
+			Resource string `json:"resource"`
+			Prefixes []struct {
+				Prefix string `json:"prefix"`
+			} `json:"prefixes"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(data, &response); err != nil {
+		return nil, fmt.Errorf("decode announced-prefixes response: %w", err)
+	}
+	if response.Status != "ok" || response.Data.Resource == "" || response.Data.Prefixes == nil {
+		return nil, errors.New("announced-prefixes response is missing required fields")
+	}
+	seen := make(map[string]struct{})
+	for _, record := range response.Data.Prefixes {
+		prefix, err := netip.ParsePrefix(strings.TrimSpace(record.Prefix))
+		if err != nil || !prefix.Addr().Is6() || prefix.Bits() < 16 || prefix.Bits() > 128 {
+			continue
+		}
+		seen[prefix.String()] = struct{}{}
+	}
+	values := make([]string, 0, len(seen))
+	for value := range seen {
+		values = append(values, value)
+	}
+	sort.Strings(values)
+	if len(values) == 0 {
+		return nil, errors.New("no IPv6 prefixes found")
+	}
+	return values, nil
+}
+
+func writePrefixFile(output string, values []string) error {
+	if err := os.MkdirAll(filepath.Dir(output), 0o755); err != nil {
+		return err
+	}
+	candidate := []byte(strings.Join(values, "\n") + "\n")
+	current, readErr := os.ReadFile(output)
+	if readErr == nil {
+		currentCount := countNonemptyLines(current)
+		if currentCount > 0 && len(values)*100 < currentCount*65 {
+			return fmt.Errorf("%w: prefix count dropped from %d to %d for %s", errPrefixCountDrop, currentCount, len(values), filepath.Base(output))
+		}
+		if bytes.Equal(current, candidate) {
+			return nil
+		}
+	}
+	if readErr != nil && !errors.Is(readErr, os.ErrNotExist) {
+		return readErr
+	}
+	temporary, err := os.CreateTemp(filepath.Dir(output), ".prefix-*")
+	if err != nil {
+		return err
+	}
+	temporaryName := temporary.Name()
+	defer os.Remove(temporaryName)
+	if err := temporary.Chmod(0o644); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if _, err := temporary.Write(candidate); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if err := temporary.Sync(); err != nil {
+		_ = temporary.Close()
+		return err
+	}
+	if err := temporary.Close(); err != nil {
+		return err
+	}
+	return os.Rename(temporaryName, output)
+}
+
+func countNonemptyLines(data []byte) int {
+	count := 0
+	for _, line := range strings.Split(string(data), "\n") {
+		if strings.TrimSpace(line) != "" {
+			count++
+		}
+	}
+	return count
+}

cmd/update-prefixes/main_test.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestExtractIPv6Prefixes(t *testing.T) {
+	values, err := extractIPv6Prefixes([]byte(`{"status":"ok","data":{"resource":"64500","prefixes":[{"prefix":"2409:8000::/32"},{"prefix":"2409:8000::/32"},{"prefix":"192.0.2.0/24"}]}}`))
+	if err != nil || len(values) != 1 || values[0] != "2409:8000::/32" {
+		t.Fatalf("unexpected prefixes: %#v, %v", values, err)
+	}
+}
+
+func TestExtractIPv6PrefixesRejectsSchemaDrift(t *testing.T) {
+	if _, err := extractIPv6Prefixes([]byte(`{"status":"ok","data":{"resource":"64500"}}`)); err == nil {
+		t.Fatal("missing prefixes unexpectedly accepted")
+	}
+}
+
+func TestWritePrefixFileProtectsLargeCountDrop(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "as64500.txt")
+	if err := os.WriteFile(path, []byte("2001:db8:1::/48\n2001:db8:2::/48\n2001:db8:3::/48\n2001:db8:4::/48\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	err := writePrefixFile(path, []string{"2001:db8:1::/48"})
+	if !errors.Is(err, errPrefixCountDrop) {
+		t.Fatalf("count drop error = %v", err)
+	}
+}
+
+func TestWritePrefixManifestPreservesGeneratedAtWhenSnapshotIsUnchanged(t *testing.T) {
+	directory := t.TempDir()
+	snapshotPath := filepath.Join(directory, "as64500.txt")
+	if err := os.WriteFile(snapshotPath, []byte("2001:db8::/48\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	manifestPath := snapshotPath + ".manifest.json"
+	old := prefixManifest{Schema: "backtrace.asn-prefixes/v1", File: "as64500.txt", Count: 1, SHA256: "", GeneratedAt: "2020-01-02T03:04:05Z"}
+	data, err := os.ReadFile(snapshotPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Seed a valid manifest with an old timestamp. The updater must retain it.
+	hash := sha256.Sum256(data)
+	old.SHA256 = hex.EncodeToString(hash[:])
+	encoded, err := json.Marshal(old)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(manifestPath, append(encoded, '\n'), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := writePrefixManifest(snapshotPath); err != nil {
+		t.Fatal(err)
+	}
+	actual, err := os.ReadFile(manifestPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Contains(actual, []byte(`"generated_at":"2020-01-02T03:04:05Z"`)) {
+		t.Fatalf("generated_at was not preserved: %s", actual)
+	}
+}

model/model.go

@@ -2,7 +2,7 @@ package model
 
 import "time"
 
-const BackTraceVersion = "v0.0.10"
+const BackTraceVersion = "v0.0.17"
 
 var EnableLoger = false