ASN lookup

How this tool works

Enter an IPv4 or IPv6 address and the tool finds the autonomous system that announces it. Enter an AS number, with or without the AS prefix, and it shows the network itself: name, country, how many prefixes it announces and how many addresses those prefixes contain. The lookup is free, needs no account, and the data behind it is refreshed by a scheduled job rather than fetched from a paid API.

An ASN is the unit of internet routing. Every public address belongs to a prefix, and every prefix is announced to the rest of the internet by one autonomous system through BGP. The tool keeps a snapshot of those announcements in a local database: each row is a range of addresses, the AS number that announces it, the registered name of the network and its country. Your address is matched against the ranges to find the most specific one that contains it, which is also how routers decide where to send a packet.

When an address is missing from the routing snapshot, which happens for prefixes that were announced after the last refresh, the tool falls back to a second, independently maintained ASN database. Results from the fallback carry the AS number, organization and prefix but no country code, and the source is labeled so you know which one answered.

The network type shown with the result is a classification derived from the registered name of the network. Names containing words such as hosting, cloud, server, VPS, datacenter or the names of well-known cloud providers are classed as hosting; names with mobile, wireless, cellular or well-known carrier names as mobile; universities and research networks as education; ministries and public bodies as government; and telecom, broadband, cable, fiber and similar words as ISP. Anything the rules do not recognize is reported as unknown rather than guessed.

Every AS has its own page at /asn/AS followed by the number, listing the announced IPv4 and IPv6 prefixes and the registration details from the regional registry. The result links there.

How to read the result

AS number and name. The number is the stable identifier; the name is what the holder registered and can be anything from a company name to an internal code. Two networks operated by one company often have different numbers, for example one for the consumer ISP business and one for the hosting arm.

Country. The country recorded in the routing data for the announcing network. It is where the network is registered, not necessarily where the specific address is used; large networks announce addresses in many countries under one AS. For location, use the IP lookup.

Announced prefix. The CIDR block containing the address, as announced by the network. A small prefix such as a /24 inside a larger allocation often means the block was assigned to a specific customer or purpose, which is why two addresses from the same provider can look very different in reputation terms.

Type. ISP or mobile usually means a subscriber connection. Hosting means the address sits in a datacenter: a server, a VPN endpoint or a proxy. Education and government are self-explanatory. Unknown means the name gave no clue, not that the network is suspicious.

Prefix and address counts. On an AS page, the number of IPv4 prefixes and the total number of IPv4 addresses say how big the network is. A consumer ISP in a mid-sized country announces millions of addresses; a small hosting company might announce a few thousand. A network that announces a handful of /24 blocks from different parents is often a reseller or a proxy operation.

For checking a connection before using it, the type is the field that matters most. Anti-fraud systems consult the same kind of data, and an address whose AS is classed as hosting will be treated as a datacenter IP by almost every service, no matter how clean its history. A mobile IP or an ordinary ISP address is what a real customer normally has.

What to do next

You looked up your own connection

1. The AS name should be your ISP or mobile carrier. If it is a hosting or cloud company, your traffic is leaving through a VPN, proxy or corporate gateway, whether or not you intended that.
2. If the country is not where you are, the same applies, or your ISP routes traffic through a parent network registered elsewhere, which is common for small ISPs.
3. For the full picture of what websites can see, run the proxy checker; it combines the ASN type with browser-side signals.

You are checking a proxy or VPN before logging in to an account

1. Look up the proxy's exit address, not the address you were given to connect to. The exit is what the target site sees, and the two can differ.
2. Confirm the type matches what you were sold. A residential proxy should land on an ISP or mobile network; a datacenter proxy will show hosting.
3. Check the country of the announcing network and of the address itself. A mismatch is not fatal on its own but is one more signal a site can use.
4. Finish with the IP checker for blacklist and reputation flags on the same address.

You are investigating traffic in your logs

1. Group addresses by AS. A burst from one hosting network is a bot or scanner; traffic spread across many ISP networks is more likely genuine.
2. Open the AS page to see the full prefix list, then block or rate-limit the prefixes rather than individual addresses, which attackers rotate freely.
3. Use the WHOIS lookup on the AS number to find the holder's abuse contact.

What an ASN says about an IP, and what it does not

The AS identifies the network, and the network's business model is a strong predictor of what the address is used for. ISPs hand addresses to subscribers; mobile carriers share a few addresses among many phones through carrier-grade NAT; hosting providers rent servers; universities connect campuses.

What the AS cannot tell you is who is using a specific address right now. A residential address can be a home user, a compromised device that is part of a residential proxy pool, or a family of 5 behind one router. A hosting address can be a company's web server or a VPN exit. The ASN narrows the possibilities; the other tools on this site, from reverse DNS to blacklists to browser signals, narrow them further.

The classification here is deliberately simple and transparent: it reads the network name, nothing else. A hosting provider that registered its network under a neutral name will be shown as unknown or even ISP. A commercial IP intelligence feed that tracks actual usage will catch cases this heuristic misses.

Limits of this tool

• The routing snapshot is refreshed on a schedule, not in real time. A prefix that moved to a new network since the last refresh may show the old announcer until the next import.
• The network type is a keyword heuristic over the registered name. It is explained rather than hidden, but it will misclassify some networks, especially ones named after a holding company.
• The country is that of the announcing network, which can differ from where the address is used.
• An address announced by more than one network, or covered by overlapping prefixes, is attributed to the most specific prefix in the snapshot. Other announcers are not listed.
• Fallback results lack a country code and may describe a larger or smaller prefix than the one actually announced.
• Address and prefix counts are computed from the snapshot and exclude prefixes that were withdrawn or filtered at the collector.
• The lookup does not show the upstream providers, peers or route path of a network. The traceroute tool shows the actual path packets take from our probe to an address.