Every IP address on the internet exists inside a network. That network is an Autonomous System — a collection of IP ranges under the administrative control of a single organization, announcing a consistent routing policy to the rest of the internet. The number that identifies it is the ASN.
How ASNs Work on the Internet
The internet is not one network. It is tens of thousands of independent networks — ISPs, universities, companies, cloud providers, government agencies — each controlling their own IP ranges. These networks communicate through BGP (Border Gateway Protocol), the routing protocol that tells each network how to reach every other network.
When a network wants to announce its IP ranges to the internet — "traffic for these addresses should come to us" — it does so using its ASN. The ASN is the identifier in those BGP announcements. Without it, there would be no way to track which organization is responsible for which IP ranges.
ASNs are issued by Regional Internet Registries:
- ARIN — North America
- RIPE NCC — Europe, Middle East, Central Asia
- APNIC — Asia-Pacific
- LACNIC — Latin America and Caribbean
- AFRINIC — Africa
Each RIR maintains a public database of ASN assignments. That is why ASN data is freely available — the registries publish it, and it is necessary for the internet to function.
Reading an ASN Lookup
Here is what an ASN lookup returns through GeoIPHub:
curl "https://api.geoiphub.com/v1/lookup?ip=8.8.8.8" \
-H "Authorization: Bearer YOUR_API_KEY"
{
"ip": "8.8.8.8",
"asn": 15169,
"asn_org": "Google LLC",
"asn_type": "tech_company",
"ip_range": "8.8.8.0/24",
"country": "US",
"is_datacenter": true,
"is_residential": false
}
A residential ISP:
curl "https://api.geoiphub.com/v1/lookup?ip=98.114.205.102" \
-H "Authorization: Bearer YOUR_API_KEY"
{
"ip": "98.114.205.102",
"asn": 7922,
"asn_org": "Comcast Cable Communications, LLC",
"asn_type": "isp",
"ip_range": "98.112.0.0/13",
"country": "US",
"is_datacenter": false,
"is_residential": true
}
A cloud provider:
curl "https://api.geoiphub.com/v1/lookup?ip=54.239.28.85" \
-H "Authorization: Bearer YOUR_API_KEY"
{
"ip": "54.239.28.85",
"asn": 16509,
"asn_org": "Amazon.com, Inc.",
"asn_type": "cloud",
"ip_range": "54.239.24.0/21",
"country": "US",
"datacenter_name": "Amazon Web Services",
"datacenter_region": "us-east-1",
"is_datacenter": true,
"is_residential": false
}
The asn_type field is the most useful: it classifies the ASN by what kind of network it represents. Common types:
| ASN type | What it means | Typical traffic |
|---|---|---|
isp | Consumer internet provider | Real users at home |
mobile | Cellular carrier | Phones behind CGNAT |
cloud | Public cloud provider (AWS, GCP, Azure) | Servers and automated workloads |
hosting | Dedicated server / colo providers | Servers, VPN infrastructure |
cdn | Content delivery network (Cloudflare, Fastly) | CDN edge, not end users |
edu | University or research network | Students and researchers |
gov | Government network | Government employees |
tech_company | Large tech org (Google, Apple) | Internal infrastructure |
vpn | Known VPN provider network | Anonymized user traffic |
Why ASN Is Central to IP Intelligence
The ASN type answers the single most useful initial question: is a real person likely to be behind this IP, or is it infrastructure?
Real consumers on consumer products almost always connect from isp or mobile ASNs. When a request arrives from a cloud or hosting ASN, it structurally requires explanation — because cloud providers do not assign IPs to people's laptops.
This makes ASN type the cheapest and most reliable first filter in fraud and abuse prevention:
- Login from AWS ASN → almost certainly automated; no real user logs in from a cloud server
- Checkout from a known VPN ASN → elevated risk; real customer or fraud, but not a default pattern
- API call from Cloudflare ASN → likely your own edge infra or a developer; check context
- Signup from residential ISP ASN → baseline legitimacy; apply other signals to refine
No single filter is enough, but ASN type gives you a strong prior that makes all subsequent signals more interpretable.
ASNs and VPN Detection
VPN providers operate their own ASNs or rent infrastructure from hosting ASNs. Detection systems use ASN history to flag ranges known to host VPN servers:
- A hosting ASN with a documented history of VPN exit nodes raises the probability that any given IP in that range is a VPN — even before active probing
- A residential ISP ASN that suddenly shows VPN protocol responses on active probing is a VPN exit point running on compromised or residential infrastructure (sometimes used for residential proxies)
The combination of ASN type and active protocol probing is more reliable than either alone: hosting ASN + OpenVPN handshake is high-confidence VPN; residential ISP ASN + no protocol response is high-confidence clean residential.
Common ASNs and What They Signal
Some ASNs appear frequently enough in fraud and security contexts that their identities are worth knowing:
| ASN | Organization | Context |
|---|---|---|
| AS16509 | Amazon Web Services | Most common source of automated traffic and scanning |
| AS15169 | Google LLC | Google services and cloud; also includes Google bots |
| AS8075 | Microsoft | Azure and Microsoft services |
| AS13335 | Cloudflare | CDN edge and security products |
| AS7922 | Comcast | Large US residential ISP |
| AS20473 | Choopa / Vultr | VPS hosting frequently used for VPNs |
| AS60068 | CDN77 | CDN and hosting with VPN/proxy history |
| AS396982 | Google Cloud | Distinct from Google LLC; specifically GCP |
| AS14061 | DigitalOcean | Popular developer hosting; common in automated traffic |
Seeing high volumes of AS16509 or AS14061 traffic on a consumer product is a strong signal of scripted or automated activity — not because those ASNs are malicious, but because real users do not connect to consumer products from cloud servers.
Looking Up ASNs Directly
For investigation and manual lookups, several methods work:
Command line (Linux/Mac):
# Using whois
whois 8.8.8.8
# Using the Team Cymru IP-to-ASN mapping
dig +short 8.8.8.8.origin.asn.cymru.com TXT
Programmatic (for your application):
curl "https://api.geoiphub.com/v1/lookup?ip=103.21.244.0&fields=asn,asn_org,asn_type" \
-H "Authorization: Bearer YOUR_API_KEY"
For production use, direct registry queries are slow and rate-limited. An IP intelligence API returns ASN data with structured typing alongside all other fields in a single low-latency request.
ASN vs ISP vs Organization
These three terms sometimes get used interchangeably in documentation. The distinctions:
- ASN: the network identifier — a number
- ISP (asn_org): the organization that operates the ASN — a name
- Organization: can be the same as ISP, or can be the end customer renting the IP range (a company that has its own IP space announced by a transit provider)
When you look up an IP and the asn_org shows "Amazon.com Inc." but the IP is actually used by a company hosting their servers on AWS, the ASN org reflects the network announcer, not the end tenant. For cloud IPs, the distinction between the cloud provider and the customer running on it matters for context — but ASN type (cloud) still tells you what you need for infrastructure classification.
Related Reading
- What Is IP Intelligence? Beyond Basic Geolocation — the full data surface an ASN feeds into
- What Is a Datacenter IP Address — how datacenter ASNs differ from residential
- How VPN and Proxy Detection Actually Works — how ASN analysis feeds into anonymizer detection
Start Scoring Every IP in Real Time
GeoIPHub gives fraud, security, and engineering teams a single API for IP geolocation, VPN & proxy detection, threat intelligence, and an explainable 0–100 risk score.
Get Your Free API Key
Sign up in minutes — no credit card required. Upgrade only when you need more volume.
Frequently Asked Questions
What does ASN stand for?
ASN stands for Autonomous System Number. It is a unique number assigned to an Autonomous System (AS) — a network or group of networks under a single administrative domain that presents a consistent routing policy to the internet. ASNs are issued by Regional Internet Registries (RIRs) like ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC.
What is the difference between an ASN and an IP address?
An IP address identifies a specific device or interface on the network. An ASN identifies the network that controls and announces a range of IP addresses. Every IP belongs to exactly one ASN. The ASN tells you who operates the network the IP is in — the ISP, cloud provider, company, or hosting facility that manages that IP range.
How do I find the ASN for an IP address?
You can look up an ASN via IP intelligence APIs (like GeoIPHub), Whois databases, or command-line tools. In a terminal: 'whois <IP>' returns ASN data from the registry. For production use, an API returns the ASN along with the organization name, announced IP ranges, and ASN type (ISP, datacenter, CDN, etc.) in structured form.
Why does the ASN matter for fraud detection?
The ASN tells you who owns the network — and who owns the network determines what kind of traffic you should expect. A request from AS7922 (Comcast residential) probably comes from a real person at home. A request from AS16509 (Amazon AWS) almost certainly comes from a server. Real consumers almost never originate transactions from cloud provider ASNs, so a checkout or login from an AWS ASN is structurally suspicious without any other signals.
Can two different companies share an ASN?
Generally no. An ASN represents a single administrative domain with a consistent routing policy. However, large organizations may use multiple ASNs — Google operates dozens. And some smaller networks may be announced under a parent ISP's ASN rather than their own. The ASN always maps to an organization, but one organization can have many ASNs.
What is the difference between ASN 4-byte and 2-byte?
The original ASN specification used 2-byte numbers (1–65535). As the internet grew, the address space was exhausted, and 4-byte ASNs (defined in RFC 4893) extended the range to over 4 billion numbers. Modern ASNs like AS396982 (Google Cloud) use 4-byte format. Older infrastructure and many large ISPs still use 2-byte ASNs. The distinction matters only if you're implementing BGP routing; for IP intelligence lookups, the API handles both transparently.
