As it stands the regex will match a minimum of 3 and maximum of 5 digits, but doesn't care if they are part of a large number of digits or are imbedded in text.

use strict;
use warnings;

while (<DATA>) {
    s|\b(\d{3,5})\b|<b><a href='lookup.cgi?id=$1</a></b>|g;
    print;
}

__DATA__
foo 300 bar bas.
foo300bar bas.
foo 123456 bar 1234 bas 56789.
foo bar bas.
1 foo 1 bar 2 bas bas.
[download]

Prints:

foo <b><a href='lookup.cgi?id=300</a></b> bar bas.
foo300bar bas.
foo 123456 bar <b><a href='lookup.cgi?id=1234</a></b> bas <b><a href='
+lookup.cgi?id=56789</a></b>.
foo bar bas.
1 foo 1 bar 2 bas bas.
[download]

Update: fixed bold tags and changed regex delimiters to avoid picket fence