IP to ASN Lookup
Enter any IPv4 or IPv6 address to find the Autonomous System Number that announces it. The lookup reads live BGP routing data and returns the AS number, the organization operating that network, and the regional internet registry that allocated it - ARIN, RIPE, APNIC, LACNIC, or AFRINIC.
Useful for threat investigation, network reconnaissance, email source identification, and routing analysis. Both IPv4 (e.g. 8.8.8.8) and IPv6 (e.g. 2001:4860:4860::8888) are supported.
What Does an IP to ASN Lookup Return?
An IP to ASN lookup returns the AS number of the network announcing that address, the organization operating it, and the registry details behind the allocation. It reads the global BGP routing table - the database every internet router consults to forward traffic - so the answer is who carries the address now, not who was assigned it. In full:
- ASN: The identifier of the network announcing the address, which is the answer to the question - AS15169 for Google, AS13335 for Cloudflare, AS7922 for Comcast.
- Operator: The organization running that network, with its domain. Named an Internet Service Provider where the network sells internet access, and a hosting provider or network operator where it does not.
- ASN type and registry: How the operator classifies the network, which of the five regional registries allocated the number, the country it was registered in, and when it was allocated.
- Network route: The block of addresses the AS announces this one as part of, in CIDR notation.
- Connection type: How a home connection reaches the internet - cable, DSL or mobile. Broadband and mobile providers report it; hosting and corporate networks usually do not, which is itself a signal about the kind of address you are looking at.
- Anycast: Whether the address is announced from several locations at once, as public DNS and CDNs do - and a reason to distrust any geolocation of it.
- IP registered to: The organization the address block is registered to - often the same provider under a different corporate name, occasionally a separate organization.
A field with nothing behind it is left out rather than filled in with N/A, so a short result is a normal one and not a failed lookup. An address in a block that is allocated but never announced - large government and military ranges, most often - has no AS number at all, and the result says so.
Common Use Cases
Threat Intelligence and Incident Response
When investigating a suspicious IP in server logs or a SIEM alert, IP to ASN lookup is the first step. Identifying the owning network - whether it's a known cloud provider, a residential ISP, a VPN exit node, or a hosting company with a poor reputation - immediately contextualises the risk.
Email Source Verification
Spam and phishing analysis routinely involves checking whether the sending IP's ASN matches the claimed sender domain. A message claiming to be from a Fortune 500 company but originating from an ASN registered to a residential ISP is a strong indicator of spoofing.
Network Reconnaissance and OSINT
Security researchers and penetration testers use IP to ASN lookups to map an organization's IP infrastructure - identifying the owning AS is the first step toward understanding the scope of an organization's internet presence.
CDN and Hosting Identification
Determining whether an IP is served by AWS (AS16509), Cloudflare (AS13335), Google Cloud (AS15169), or Azure (AS8075) is essential for routing decisions, WAF configuration, and infrastructure fingerprinting.
IPv4 vs IPv6 in ASN Lookups
Both IPv4 and IPv6 addresses map to ASNs through the same BGP mechanism, but there are practical differences.
IPv4 addresses (e.g. 203.0.113.47) are 32-bit numbers. IPv4 space is fully allocated - every public IPv4 address belongs to a registered ASN.
IPv6 addresses (e.g. 2001:4860:4860::8888) use 128-bit addressing. IPv6 deployment is uneven - major cloud providers and modern ISPs announce IPv6 prefixes aggressively, while others have not yet adopted it. If an IPv6 lookup returns no result, the address may be in an unannounced block.
An ASN can control both IPv4 and IPv6 prefixes simultaneously, and both are searchable with this tool.
How an IP address connects to an AS number
Every publicly routable IP address belongs to exactly one Autonomous System at a time - the network that announces it to the rest of the internet over BGP. That announcement is what a lookup reads, which is why the answer reflects who is carrying the address right now rather than who bought it years ago.
Addresses are not announced one at a time. A network receives blocks, called prefixes, and announces whole blocks: an address inside 203.0.113.0/24 is reached by way of that /24, not on its own. So a lookup on any address in a block returns the same AS number, and the route shown is the block, not the address.
An AS number is the identifier for that network - AS15169 is Google, AS7922 is Comcast, AS13335 is Cloudflare. If you want the full picture of one AS rather than the one address you started from, that is the other direction of the same data.
For what an Autonomous System is, how AS numbers are structured, the role BGP plays and the types of AS, see the ASN Lookup tool, which starts from an AS number and lists every prefix, upstream, downstream and peer it has.
Which AS numbers do well-known addresses belong to?
Useful for checking the tool against something you already know, and for recognizing these networks when they turn up in your own logs:
| Address | AS number | Operator |
|---|---|---|
| 8.8.8.8 | AS15169 | Google LLC |
| 1.1.1.1 | AS13335 | Cloudflare, Inc. |
| 9.9.9.9 | AS19281 | Quad9 |
| 208.67.222.222 | AS36692 | Cisco OpenDNS, LLC |
| 140.82.121.4 | AS36459 | GitHub, Inc. |
| 128.140.89.153 | AS24940 | Hetzner Online GmbH |
FAQs
An IP to ASN lookup starts with an IP address and returns the ASN that controls it - useful when you have an IP and need to identify the network owner. An ASN lookup works in the opposite direction: you provide the AS number and retrieve everything registered under it - all IP prefixes, BGP peering relationships, WHOIS contact details, and upstream/downstream routing data. If you already have an ASN (e.g. AS13335), use the ASN Lookup tool for the full network picture. If you have an IP and need to find its ASN first, start here.
Bogon addresses are IP ranges that are not part of the public internet routing table. These include:
- Private ranges:
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 - Loopback:
127.0.0.0/8 - Link-local:
169.254.0.0/16 - Reserved and unallocated blocks defined by IANA
Because bogon addresses are never announced via BGP, they have no ASN assignment. Querying one will return no result - this is expected behavior, not an error.
This tool processes one IP address per query. For bulk lookups - resolving ASN and geolocation data for thousands of IPs in a single request - use the Bulk IP Lookup API. It accepts up to 50,000 IPs per request and returns structured ASN, ISP, country, and city data for each. No scraping, no per-IP rate limits on paid plans.
Because the AS number belongs to whoever announces the address, and for a site behind a CDN or hosted in the cloud that is the provider. An address serving a retailer's website commonly returns Amazon, Cloudflare or Akamai rather than the retailer - the network carrying the traffic, not the company whose name is on the site.
That is the correct answer to the question the lookup asks. An AS number identifies infrastructure, not ownership of a brand, so treat the result as "who routes this address" rather than "whose address is this".
Enter the IP address in the field above and press "Find ASN". The tool reads live BGP routing data and returns the AS number within seconds. No account required.
For programmatic lookups the IP Geolocation API answers the same question:
curl -H "X-apiKey: YOUR_KEY" \
"https://api.apifreaks.com/v2.0/geolocation/lookup?ip=1.1.1.1"The response carries the AS number, the operating organization and its domain, the network type, the registry and allocation date, the route containing the address, and the organization the block is registered to. For every prefix an AS announces, rather than the one containing your address, pass the AS number to the ASN Lookup API.
Yes. The IP Geolocation API returns the AS number, operating organization, network type and registry for any IPv4 or IPv6 address. For high-volume use cases, the Bulk IP Lookup API processes up to 50,000 IPs per request with the same response structure.
For the actual IP block and address range an IP belongs to, plus full organization and abuse contact details, use the IP WHOIS API. For the complete list of route prefixes and BGP upstreams, peers, and downstreams for an ASN, use the ASN Lookup API.
Both APIs are available on a free tier (10,000 credits, no credit card required) with paid plans for higher volumes.