Datasets / Cyber Threat

circl.lu/

CIRCL hashlookup and BGP Ranking

Freeauth: noneCustom#cyber-threat#threat-intel#network-data#historical-data#risk✓ verified Nov 1, 2026

CIRCL hashlookup and BGP Ranking

CIRCL operates keyless JSON APIs for matching MD5, SHA-1 and SHA-256 values against known-file databases and for querying autonomous-system security rankings over time. hashlookup responses can include file names, sizes, products, sources and trust context, while BGP Ranking returns AS descriptions, ranks, positions and history.

Required Attribution:

Credit CIRCL and retain the response's source/provenance fields when redistributing data.

Coverage

hashlookup combines the NSRL Reference Data Set with operating-system and package-repository sources; its status response reported 6,532,066,294 keys and NSRL version 2023.09.2 when checked. BGP Ranking covers autonomous systems observed through CIRCL's external security data and exposes current and historical ranking endpoints. hashlookup has no service-level commitment; neither service states a rate limit or promised refresh schedule, although the optional hashlookup Bloom filter updates monthly.

Verdict

This is defensive data for adding known-file provenance to hashes and network-reputation context to autonomous systems. A hashlookup match means a file is known in a source database, not that it is malicious, and the trust field is source-confidence context rather than a malware score. BGP ranks reflect CIRCL's observed external security data, so missing or zero-valued ranks can reflect coverage rather than a clean network. Neither service has a stated service-level commitment, and upstream datasets, rankings and source coverage can change.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

Quick facts

Provider: circl.lu
Type: Dataset
Category: Cyber Threat
Domain: Cyber Threat
Auth: none
Free tier: Public, keyless REST APIs. No availability commitment, quota or BGP query cap is stated.
Rate limit: Not stated
License: Custom (see note)
License note: CIRCL licenses the open data described on its open-data page under CC-BY-4.0 unless a resource says otherwise, and the hashlookup OpenAPI metadata labels that API CC-BY without a version. hashlookup responses incorporate named upstream datasets, so preserve source and provenance fields and check upstream terms for redistribution.
Verified: Nov 1, 2026

🤖 Ask your agent

Fetch https://signal-lab-jet.vercel.app/catalog.json, find slug "circl-hashlookup-bgp-ranking", and write a Python loader that pulls data from CIRCL hashlookup and BGP Ranking into a pandas DataFrame.  Respect rate limits and follow provider terms.

Links

catalog.json↗Provider website↗

Use in your agent

Query CIRCL hashlookup and BGP Ranking into Parquet. Checked against the provider's documentation on Nov 1, 2026.

Raw skill file (/skills/circl-hashlookup-bgp-ranking.md)Also in our MCP server: call get_ingestion_skill with {"slug": "circl-hashlookup-bgp-ranking"}.

Access

No account or key. Both checked JSON API endpoints are public.
Use hashlookup /info for database status and POST a JSON object containing an asn string to BGP Ranking /json/asn.

Request

bash

curl 'https://hashlookup.circl.lu/info'
curl -X POST -H 'Content-Type: application/json' -d '{"asn":"13335"}' 'https://bgpranking.circl.lu/json/asn'

Format

JSON objects. hashlookup /info returns dataset version and key-count fields; BGP /json/asn returns meta.asn plus response fields for AS description and current ranking.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

python

"""CIRCL hashlookup status and one BGP Ranking query -> pandas -> Parquet."""
import requests
import pandas as pd

HASH_INFO = "https://hashlookup.circl.lu/info"
BGP_ASN = "https://bgpranking.circl.lu/json/asn"
h = requests.get(HASH_INFO, timeout=60)
h.raise_for_status()
b = requests.post(BGP_ASN, json={"asn": "13335"}, timeout=60)
b.raise_for_status()
hash_info = pd.DataFrame([h.json()])
bgp = pd.json_normalize(b.json())
hash_info.to_parquet("circl_hashlookup_info.parquet", index=False)
bgp.to_parquet("circl_bgp_asn_13335.parquet", index=False)
print("hashlookup keys", len(hash_info.columns),
      "BGP rows", len(bgp), "BGP columns", len(bgp.columns))

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: hashlookup keys 2 BGP rows 1 BGP columns 5

Limits

Rate limit: Not stated.
hashlookup has no stated service-level commitment.
The optional local SHA-1 Bloom filter is about 700 MB, omits metadata and updates monthly.

Quirks

A hash match indicates a known file, not a malicious-file verdict; inspect source and hashlookup:trust context.
BGP responses are nested; pandas.json_normalize produces dotted column names.
A null position or zero rank may reflect unavailable ranking coverage and should not be converted into a clean-network label.

Terms and attribution

CIRCL's open-data page applies CC-BY-4.0 unless a resource states otherwise.
The hashlookup OpenAPI metadata says CC-BY and responses retain upstream source fields; preserve attribution and provenance.

Sources

https://www.circl.lu/services/hashlookup/: “CIRCL hashlookup is a public API for looking up file hashes in known-file databases.”
https://www.circl.lu/services/hashlookup/: “It is free to use and provided on a best-effort basis.”
https://www.circl.lu/services/bgp-ranking/: “analysts identify malicious activity associated with an autonomous system (AS)”
https://www.circl.lu/opendata/: “Creative Commons Attribution 4.0 International licence”

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

CIRCL hashlookup and BGP Ranking