IP to ASN Lookup |
IP to ASN lookup maps any IPv4 or IPv6 address to its Autonomous System Number (ASN) and the network operator registered to that address block. An Autonomous System (AS), defined in RFC 1930, is a collection of IP prefixes managed by a single organization under a unified routing policy. ASNs — 16-bit (0–65,535) or extended to 32-bit (0–4,294,967,295) per RFC 6793 — are assigned by IANA and delegated through the five Regional Internet Registries: ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. Every public IP address belongs to exactly one AS, identified by the ASN that originates the containing prefix in the global BGP routing table.
| Property | Detail |
|---|---|
| 16-bit ASN range | 0–65,535 (original allocation, RFC 1930) |
| 32-bit ASN range | 0–4,294,967,295 (extended 2007, RFC 6793) |
| Private ASNs (16-bit) | 64,512–65,534 (RFC 6996) |
| Private ASNs (32-bit) | 4,200,000,000–4,294,967,294 (RFC 6996) |
| Active ASNs globally | ~85,000 (2026) |
| Data source | MaxMind GeoLite2-ASN database, updated monthly |
Identify the Autonomous System Number and network operator for any public IP address in seconds.
| Field | Meaning | Example |
|---|---|---|
| ASN | The Autonomous System Number in standard AS##### format. Identifies which AS announces the IP prefix containing the queried address in global BGP routing tables. The same ASN applies to all IPs within the prefix (e.g. all of 8.8.8.0/24 maps to AS15169). | AS15169 |
| Organization | The name registered by the network operator for this autonomous system at the Regional Internet Registry. Reflects the AS operator, not the end customer or hosted tenant. Cloud provider ASNs (AWS, Azure, GCP) will show the provider name regardless of which customer hosts the workload. |
To view the full registration record for the AS — including all announced prefixes, organization handle, and abuse contact — run an ASN WHOIS Lookup with the returned AS number. To view the IP block registration and network range for the address itself, run an IP WHOIS Lookup.
Every public IP address belongs to an IP prefix — a CIDR block such as 8.8.8.0/24 — that is announced into the global BGP routing table by exactly one Autonomous System. IP to ASN lookup resolves this relationship by querying the MaxMind GeoLite2-ASN database, which is built from BGP routing table snapshots and Regional Internet Registry delegation records. The database maps each IP prefix to the ASN that originates it in BGP and the registered organization name for that AS.
Coverage includes all globally routed IPv4 and IPv6 address space. Private IPv4 addresses defined in RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and documentation prefixes defined in RFC 5737 (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) do not appear in BGP routing tables and return no result. The GeoLite2-ASN database is updated monthly; for real-time BGP state, tools such as RIPE NCC's RIS Live provide live route visibility.
Do it yourself
The Team Cymru WHOIS service (whois.cymru.com) and its companion DNS
service (origin.asn.cymru.com) provide structured ASN-by-IP lookups
from the command line. Replace 8.8.8.8 with the target IP in the
examples below. For the DNS-based approach, non-palindromic IPs require octets
reversed: for 203.0.113.1, query 1.113.0.203.origin.asn.cymru.com.
nslookup -type=TXT 8.8.8.8.origin.asn.cymru.comResolve-DnsName -Name "8.8.8.8.origin.asn.cymru.com" -Type TXT | Select-Object -ExpandProperty Stringswhois -h whois.cymru.com " -v 8.8.8.8"dig 8.8.8.8.origin.asn.cymru.com TXT +shortThe Team Cymru response returns the ASN, BGP prefix (CIDR), country code, originating RIR, allocation date, and AS name — more detail than the GeoLite2-ASN database alone. Results may differ from the online tool during active BGP routing changes, as the Cymru service reflects near-real-time routing state.
Security incident response. A SOC analyst investigating a brute-force attack traces the source IPs to AS9002, a European transit provider. The ASN identifies the correct RIR abuse contact for the block — a targeted report to RIPE NCC rather than a generic upstream ISP complaint, which reaches the responsible network operator directly.
CDN and routing verification. A DevOps engineer configuring egress firewall rules for a multi-cloud deployment uses IP-to-ASN lookup to confirm that inbound traffic from 104.18.x.x belongs to AS13335 (Cloudflare), verifying that anycast CDN routing is active before a production cutover. The ASN check takes seconds and requires no access to cloud console dashboards.
Traffic pattern analysis. A network researcher aggregating web server access logs classifies request origins by autonomous system to identify concentration risk: a disproportionate share of API traffic from three cloud provider ASNs is a common signal of automated traffic or credential stuffing, distinct from organic user distribution.