What is an ASN, and how do I find who owns a network?
The internet isn't one network. It's tens of thousands of separate ones, run by providers, clouds, universities and companies, agreeing to carry each other's traffic. Each of them has a number. Learn to read that number and an unknown IP address stops being anonymous noise.
What an autonomous system is
An autonomous system is a network with its own routing policy: it owns or is responsible for blocks of addresses and tells its neighbours, using a protocol called BGP, “send traffic for these blocks to me”. Its number, the ASN, is how the rest of the internet refers to it. Google's main network is AS15169. Cloudflare's is AS13335. Your home provider has one too.
ASNs are handed out by the same five regional registries that hand out addresses (ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America and AFRINIC for Africa), under IANA. Old ones are small numbers; since numbers up to 65,535 ran short, they've been 32 bits long, so you'll also see numbers in the hundreds of thousands.
A worked example: one address, two answers
Put 1.1.1.1 into iplover's IP lookup and look at two rows of the result. This is what it showed on 9 November 2026:
| Registered owner (RDAP) | APNIC Research and Development, network APNIC-LABS, block 1.1.1.0/24, registry APNIC |
|---|---|
| Network (ASN) | AS13335, Cloudflare, Inc. |
| Reverse DNS | one.one.one.one, confirmed forward |
So who “owns” 1.1.1.1? Both answers are true. APNIC, the registry for Asia-Pacific, holds the block and runs research on it; Cloudflare operates the public DNS service on it and announces the block from its own network. If traffic from 1.1.1.1 reached you, it came out of Cloudflare's network, and Cloudflare is who you'd talk to.
That split is common. A company can register addresses and have a hosting provider route them; a cloud can route blocks registered to its customers. The registration says who's responsible on paper. The ASN says whose network the packets actually crossed.
A second example shows the opposite case. For 8.8.8.8 the lookup reports owner Google LLC (network GOGL, registry ARIN) and network AS15169, Google LLC. Same organisation, no ambiguity.
Find the ASN yourself
The quickest public source is Team Cymru's free mapping service, which answers over DNS. Write the address backwards and ask for a TXT record:
dig +short TXT 1.66.249.66.origin.asn.cymru.com
nslookup -type=TXT 1.66.249.66.origin.asn.cymru.com # WindowsFor 66.249.66.1 (a Googlebot address) the answer came back as two lines:
"15169 | 66.249.64.0/20 | US | arin | 2004-03-05"
"15169 | 66.249.64.0/19 | US | arin | 2004-03-05"The fields are: ASN, the announced block, the country it's registered in, the registry, and the date the block was allocated. Two lines means the network announces the address twice, as a big block and a more specific one inside it. That's normal; traffic follows the more specific one. To turn the number into a name, ask about the ASN itself:
dig +short TXT AS15169.asn.cymru.com
"15169 | US | arin | 2000-03-30 | GOOGLE - Google LLC, US"The same service also answers on whois: whois -h whois.cymru.com " -v 66.249.66.1". For a deeper look at one network (every block it announces, its neighbours, its history), RIPEstat and PeeringDB are free and maintained by the community and the registries.
What the ASN is good for
- Who to contact about abuse. The network that routes an address is the one that can act on it. iplover's lookup shows the abuse address from the official registry next to the ASN.
- What kind of network it is. An ASN named after a cloud or a hosting company means a server; one named after a mobile operator means phones; a home broadband provider means people at home. That's often enough to understand a log line.
- Filtering by network. Many firewalls and CDNs can match on ASN, which is how you'd rate-limit a whole cloud provider without listing thousands of addresses.
If you see this, do this
| What you find | What it usually means | What to do |
|---|---|---|
| The ASN belongs to a home or mobile provider | A person's connection, possibly shared (CGNAT) | Treat the address as one of many customers. Don't assume one person. |
| The ASN belongs to a cloud or hosting company | A server, usually automated traffic | Normal for APIs and crawlers; unusual on a login page. Report persistent abuse to the cloud. |
| The registered owner and the ASN differ | Someone else routes the block | For abuse or blocking, go by the ASN's operator. |
| No ASN at all | The address isn't announced on the internet (or it's private) | If it's in your log, check whether it's an internal address or a proxy's. |
| Bad traffic from many addresses in the same ASN | One network is the source | Rate-limit or challenge that ASN rather than chasing addresses. |
What an ASN can't tell you
An ASN identifies a network, never a person or a device on it. A large provider's ASN covers millions of customers. The country in the registry is where the network registered, not where a given address is used. And blocking an entire ASN is a blunt tool: block a big cloud and you block legitimate services, monitoring, and every other customer of that cloud along with the one that bothered you.
Sources
Official documents we used to check the facts in this guide.