ASN Lookup

ASN lookup by IP or domain: how to read the result

This ASN lookup tool tells you which autonomous system (AS) an IP address belongs to. Enter an IPv4 address, an IPv6 address or a domain name. A domain is first resolved to IPv4 — the tool takes the first address from the A record — so for a site with several addresses, or one that is IPv6-only, look up the specific IP instead. Searching by the AS number itself (for example AS13335) is not supported here; the whois commands further down cover that case.

The result combines two sources. IP and network details come from the ip-api.com database; the BGP prefix, registry and allocation date come from Team Cymru's IP-to-ASN DNS service. Because they are separate datasets, fields can disagree slightly. Here is what each one means:

Example: looking up 1.1.1.1 returns AS13335 Cloudflare, Inc., prefix 1.1.1.0/24 and registry APNIC — while the location says Australia. The resolver is anycast and answers from hundreds of cities; Australia is simply where the block is registered.

What an autonomous system number is

An autonomous system is a set of IP networks run by one operator with a single routing policy; the ASN is how other networks identify it in BGP. ASNs are issued by five regional internet registries:

• ARIN — North America;
• RIPE NCC — Europe, the Middle East and Central Asia;
• APNIC — Asia-Pacific;
• LACNIC — Latin America and the Caribbean;
• AFRINIC — Africa.

Originally AS numbers were 16-bit (up to 65535); 32-bit numbers up to 4,294,967,295 are now issued as well. The ranges 64512–65534 and 4200000000–4294967294 are reserved for private use and should never appear on the public internet. AS23456 is a placeholder older routers display in place of a 32-bit number.

A few numbers are worth recognising on sight: AS13335 Cloudflare, AS16509 Amazon (AWS), AS15169 Google, AS8075 Microsoft, AS20940 Akamai, AS54113 Fastly, AS24940 Hetzner, AS16276 OVH, AS14061 DigitalOcean. If a domain lookup returns one of these, the site is either hosted in that cloud or sits behind that CDN, and the origin server is hidden.

Site behind a CDN: finding the origin's ASN

If a domain resolves to Cloudflare, Fastly or another CDN, the lookup describes the proxy network, not your hosting. For your own site, the origin address is in your hosting panel or in the CDN's DNS settings. For someone else's site, records that are usually not proxied give hints: MX records and subdomains such as mail., ftp. or cpanel.. Pull their IPs with DNS lookup and check each one here. It is not proof — mail is often hosted by Google or Microsoft, and then the mail server's ASN tells you nothing about where the website runs.

When the ASN is not what you expected

• The site moved recently, but the A record still points to the old server or is cached by resolvers for the TTL — compare against your DNS zone.
• The CDN proxy is on (the orange cloud in Cloudflare), so only its address is visible.
• Your host rents address space from a larger operator: the ASN belongs to the data centre or transit provider, and your host's name shows up in the Organization field.

ASN search and whois ASN lookup from the command line

For an AS number lookup, a bulk check or a full prefix list, use whois and dig. These work on Linux and macOS:

# ASN, prefix, country, registry and AS name for an IP
whois -h whois.cymru.com " -v 8.8.8.8"

# Same data over DNS (IP octets reversed)
dig +short TXT 4.4.8.8.origin.asn.cymru.com

# Describe an AS by its number
dig +short TXT AS15169.asn.cymru.com
whois -h whois.arin.net AS15169
whois -h whois.ripe.net AS3333

# Routes registered for an AS in IRR databases
whois -h whois.radb.net -- '-i origin AS15169'

Query the RIR that issued the number: an ARIN number returns little from the RIPE server and vice versa. Note also that IRR route objects are created by operators themselves and do not always match what is actually announced in BGP. For live announcements, peers and the prefix count of an AS, public BGP looking glasses such as bgp.he.net or RIPEstat are more reliable.

"What is my ASN?" is answered the same way: find your public IP with My IP, then run it through the lookup above.

Where an AS number lookup is useful

Hosting and infrastructure audit

The ASN shows who actually carries traffic for your site or a competitor's: a shared host, a cloud provider or a CDN. To see what else lives on the same address, run a reverse IP lookup; for the provider and hosting type, use the hosting checker.

Network footprint of link sources

If dozens of sites linking to you sit in one small AS, or even one subnet, that is a visible footprint of a site network. Large clouds are a different story — millions of unrelated sites share AWS or Cloudflare. Why the pattern matters is explained in our article on network footprint.

Bots, fraud and blocking by ASN

Traffic from data-centre ASNs rarely belongs to real visitors. If logs or analytics show a burst of hits from one cloud AS, you can restrict it. With nginx, the GeoIP2 module and an ASN database:

geoip2 /etc/nginx/GeoLite2-ASN.mmdb {
    $client_asn autonomous_system_number;
}
map $client_asn $block_asn {
    default 0;
    14061   1;   # example: DigitalOcean
}
# inside server { }:
if ($block_asn) { return 403; }

In Cloudflare the equivalent is a WAF custom rule with the expression ip.src.asnum eq 14061, or a managed challenge instead of a hard block. Be selective: VPNs and corporate proxies run in the same networks, and real customers use them.

Do not verify search engine crawlers by ASN alone. Google recommends a reverse DNS lookup followed by a forward lookup, or matching against its published IP ranges (Google's guide). Our reverse DNS tool handles the first step.

Limitations

• One address per lookup; domains resolve to IPv4 only.
• Geolocation describes the database record, not the physical machine, and is almost always "wrong" for anycast networks.
• Routing data lags behind reality: a block that changed hands recently may still show the previous holder.
• If the Prefix and Registry rows are empty, Team Cymru's DNS service did not answer — retry, or use the whois commands above.