ASN Lookup: Understanding Autonomous System Numbers

An Autonomous System Number (ASN) is a globally unique identifier assigned to a collection of IP networks operated under a single administrative policy. ASNs are the building blocks of the internet's routing infrastructure — they're how routers decide where to send your packets when you cross from one network operator to another.

Every time your data travels from your ISP to a cloud provider, passes through a content delivery network, or hops between continents, it crosses AS boundaries. Border Gateway Protocol (BGP) uses ASNs to exchange routing information between these autonomous systems, building the giant distributed map that makes global internet routing possible.

Who Gets an ASN?

ASNs are allocated by Regional Internet Registries (RIRs) — the same organisations that distribute IP addresses. You need an ASN if you:

• Connect to multiple upstream ISPs (multi-homed connectivity)
• Run a transit network that carries other organisations' traffic
• Operate an internet exchange point or peering facility
• Need to announce your own IP space independently of an upstream ISP

Small businesses with a single ISP generally don't need their own ASN — they operate within their ISP's autonomous system. Large enterprises, universities, CDN providers, cloud platforms, and ISPs all have their own ASNs.

ASN Format: 16-Bit and 32-Bit

The original ASN space used 16-bit numbers, allowing values from 1 to 65535. This was sufficient for the early internet but eventually ran short as the number of independent networks grew. A 32-bit extension was standardised in RFC 4893, expanding the space to approximately 4.2 billion values. 32-bit ASNs are written in dotted notation (e.g., 131072 or 2.0) or as a plain decimal number. Both formats are in use today.

Certain ASN ranges are reserved: 64512–65534 are designated for private use (similar to private IP ranges) and are used for internal routing without being announced to the global internet. ASN 23456 is used as a placeholder when older 16-bit BGP implementations need to carry 32-bit ASN information.

What an ASN Lookup Returns

A lookup against WHOIS databases or the IPQS API returns several pieces of information:

• ASN number — The numeric identifier, e.g., AS15169 (Google), AS32934 (Meta), AS16509 (Amazon)
• Organisation name — The registered operator of the ASN
• Country — The country of registration
• IP ranges announced — The CIDR blocks this AS currently announces to the internet via BGP
• Upstream providers — Which AS peers this AS uses for transit (available from BGP looking glasses)
• Registry — Which RIR allocated this ASN (ARIN, RIPE, APNIC, etc.)

ASNs in Security and Fraud Detection

ASN data is one of the most reliable signals in IP threat intelligence:

Hosting vs residential classification is the most valuable security use. Cloud providers (AWS, Google Cloud, Azure, DigitalOcean, Vultr, Linode) operate well-known ASNs. Residential ISPs (Comcast, BT, Verizon, Deutsche Telekom) operate entirely separate ASNs. This distinction immediately tells you whether traffic is coming from a data centre or a home connection — a critical data point for fraud scoring, since most residential proxies and consumer VPNs route through hosting ASNs.

AS reputation tracks the history of an autonomous system rather than a single IP. If AS12345 has a history of hosting malware C2 infrastructure, spam operations, or botnet controllers, any IP within that AS carries elevated risk regardless of its individual history. Some ASNs are so consistently abusive that they're blocked wholesale by major security vendors.

Geographic verification uses AS-level routing to cross-check IP geolocation claims. If an IP is registered in the US but the AS that announces it is based in Eastern Europe, that discrepancy warrants scrutiny.

ISP identification allows services to tailor their experience — recognising that a Comcast IP is a residential US connection, for example, vs an AT&T fixed-line business connection.

Looking Up ASN Information

ASN lookups can be performed several ways:

• WHOIS queries — whois -h whois.radb.net AS15169 returns routing registry data. Each RIR also runs its own WHOIS server.
• Team Cymru's IP-to-ASN mapping — A DNS-based lookup service that maps any IP to its originating ASN in real time.
• BGP looking glasses — Network operators run looking glass servers that let you query their routing tables directly to see which AS is originating a given prefix.
• Commercial APIs — Services like IPQS return ASN data as part of a comprehensive IP intelligence lookup, saving the need to query multiple sources.

ASN Data in Practice

Consider two IPs arriving at your web application: one from AS7922 (Comcast Cable Communications) and one from AS396982 (Google Cloud). Even without any individual IP history, the ASN alone tells you the first is almost certainly a residential user while the second is running in Google's cloud. For a consumer-facing service, this distinction might be relevant to fraud scoring; for an API that's supposed to be accessed only by your servers, it might be the primary access control signal.

ASN data changes regularly as organisations acquire IP space, merge, restructure, and hand back allocations. A good ASN database is continuously updated from live BGP feeds rather than being a static snapshot.