ASN Lookup

ASN Lookup

Type an AS number or an IP address into Enter IP Address or AS Number and click Lookup ASN Details, or press Enter. You’ll see who runs the network, where it’s registered, what kind of network it is, and the IP ranges it announces to the internet. If you enter an IP, the tool finds the network that address belongs to and shows where the address is located.

You don’t need to tidy up what you paste first. The tool picks out the address or number:

A domain name won’t work directly, because ASNs belong to IP addresses, not domains. If you enter one, the tool tells you to look up its IP first with Hostname to IP or DNS Lookup.

Clear empties the box and removes the previous result, ready for the next lookup.

What an ASN is

The internet is made up of tens of thousands of separate networks: ISPs, cloud providers, CDNs, large companies, universities. Each one that manages its own routing gets an Autonomous System Number (ASN) from a regional registry.

Networks use a protocol called BGP to tell each other which IP ranges they can deliver traffic to. The ASN is how the rest of the internet identifies who is making that announcement.

A website doesn’t have its own ASN; its hosting provider does. Your home connection sits inside your ISP’s ASN.

Reading the results: AS15169 (Google)

Name, domain and country. Google LLC, google.com, United States. The country is where the network is registered, not where its servers are. Google runs servers on every continent under this one number.

ASN type: Content / Hosting / CDN. For traffic analysis, this is the most useful field. Other networks show up as ISPs, businesses or education networks. Visitors coming from a hosting network are usually servers (bots, scrapers, VPN exits) rather than people browsing from home.

Registry: ARIN. There are five regional registries:

Registration date 2000-03-30, last updated 2012-02-24. These dates describe the registry record, not the network. Google’s routes change all the time; the registration paperwork just hasn’t needed an update since 2012.

About 2.6 million IPv4 addresses across 1,236 ranges. These are the addresses the network currently announces, each counted once. Many ranges sit inside bigger ones, as explained below. They count as ranges, but don’t add any addresses to the total.

871.8 octillion IPv6 addresses. That number is too big to mean anything. The useful figure next to it is 721,152 /48 networks. A /48 is a common allocation for a single site, so this tells you how many separate sites the space could hold.

Routing status: Announced on the internet. The network’s ranges are visible in the global routing table. An ASN can be registered without announcing anything: it might be unused, or used only inside a private network.

The announced ranges

Below the overview, the IPv4 and IPv6 ranges are listed largest first. Big networks have more than 50 ranges, so only the 50 largest are shown (“Showing the 50 largest of 1,236”). Each list has a Copy list button, so you can paste the ranges into a firewall rule or a spreadsheet instead of selecting them by hand.

Look closely and some ranges overlap. 34.112.0.0/14 and 34.112.0.0/16 both appear, for example. Networks often announce a big block plus smaller pieces inside it to steer traffic. Routers always prefer the most specific route, so the /16 handles its own addresses and the /14 covers the rest.

If the slash notation is unfamiliar: a /16 is 65,536 addresses and a /24 is 256. The IP Subnet Calculator works out any range for you.

Where the data comes from

The results combine three public sources. The last line of the result names them:

• RIPEstat (run by RIPE NCC): routing status, announced ranges and country.
• The regional registry’s RDAP service: the name, registry and dates.
• PeeringDB: ASN type, network scope and website.

PeeringDB is a database that networks fill in about themselves, so many small ISPs and companies aren’t in it. For those networks, the type, scope and website rows are left out. The same rows can also be missing briefly when PeeringDB is busy. The rest of the result is unaffected, and trying again later usually fills them in.

Results are kept for 12 hours. A route that was just announced, or a registry record that was just changed, can take up to that long to appear here.

What it’s useful for

Blocking or slowing down bots

When a scraper keeps switching IPs, it usually stays inside the same hosting provider. Blocking or challenging that provider’s ASN at your firewall or CDN stops the whole group at once. Cloudflare’s firewall rules, for example, can match on AS number. Very few real visitors browse from data-center networks, though people using VPNs do.

Be careful with search engines. Googlebot crawls from Google’s own networks, and so do scrapers running on Google Cloud. Block a Google ASN to stop a scraper and you can block Googlebot too, and your pages start dropping out of search results. Before blocking anything owned by Google or Microsoft, verify the crawler with a reverse DNS check using IP to Hostname.

Finding out where a site is hosted

1. Get the site’s IP with Hostname to IP.
2. Enter that IP here.

The ASN names the hosting company. If it comes back as Cloudflare (AS13335) or another CDN, the site is behind a proxy and the real host is hidden.

Allowlisting a service

Payment gateways, monitoring services or a partner’s office may need access to your server. Copy list gives you the organization’s ranges, but use the official IP list a service publishes when there is one. An ASN covers everything a company runs. Allowlisting all of AS15169 would open your server to every Google Cloud customer, not just the Google service you meant.

Tracking down abuse

When you’re dealing with spam, brute-force login attempts or attack traffic, the ASN tells you which network it’s coming from. That network’s record at its registry (ARIN, RIPE NCC and so on) lists an abuse contact for reports.

Checking your own routes

If you run your own network, enter one of your IPs here. If the result names an ASN that isn’t yours, find out why. Sometimes an upstream provider legitimately announces a customer’s range under its own number. Other times it’s a misconfiguration or a hijacked route.

FAQ

What’s the difference between an ASN and an ISP?

An ISP is a company; an ASN is a network identifier. Large companies often have several ASNs. Google, for instance, uses separate ones for parts of its cloud platform. A small hosting company may have no ASN of its own and sit inside its upstream provider’s.

How do I find the ASN for an IP address?

Enter the IP above. IP Information and What’s My IP show it too.

Why does my lookup return nothing?

The address or number may not be on the public internet at all:

• Private IP addresses (10.x.x.x, 172.16.x.x to 172.31.x.x, 192.168.x.x) are used inside homes and offices. No network announces them publicly.
• Carrier-grade NAT addresses (100.64.0.0 to 100.127.255.255) are what some ISPs give your router when many customers share one public IP. If your router shows one of these, look up the address from What’s My IP instead.
• Private and reserved AS numbers (64512–65534 and 4200000000–4294967294, plus documentation numbers like 64496–64511) are never used on the public internet.

Numbers above 65,535 are normal, though. They’re 32-bit ASNs, handed out since the original 16-bit pool started running low, and they work the same way.

Does this show the route traffic takes?

No. ASN Lookup tells you who owns a network and what it announces. To see the path packets take to reach a host, use Traceroute.