Skip to content
ProbeDNS

ASN Lookup

An Autonomous System is a network under one routing policy, identified by an AS number and visible in the global BGP table. This lookup returns the AS currently originating the route that covers an IP address, the AS holder's name, and the exact prefix being announced — read from RIPEstat routing data.

What an AS number actually is

The internet is not one network; it is roughly 75,000 independently operated networks that agree to exchange traffic. Each is an Autonomous System, allocated an ASN by a regional internet registry (ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC). ASNs were originally 16-bit — that is why the famous ones are small numbers like AS15169 (Google) or AS13335 (Cloudflare) — and the space was extended to 32 bits in 2007, so newer allocations look like AS396982.

Autonomous systems announce their address blocks to each other with BGP, the Border Gateway Protocol. When AS15169 announces 8.8.8.0/24, every other network on the internet learns that traffic for those addresses should be handed toward Google. That announcement is what this tool reads. It is the operational truth about where packets go — distinct from, and occasionally at odds with, what the registry paperwork says.

Why the prefix matters more than the address

Routing works on prefixes, never on single addresses. The result panel shows the most specific block containing your address that the origin AS is announcing — often a /24 for IPv4 or a /48 for IPv6, because those are the longest prefixes most networks will accept from a peer.

This is the number that matters when you take action. If an address in 198.51.100.0/24 is attacking you, the operator behind it very likely controls the whole /24, and abuse from one address usually means the neighbours deserve scrutiny too. Equally, if you are allow-listing a partner's egress, allow-list the prefix they announce rather than the one address you happened to see — cloud egress rotates within the block constantly.

Read the full explanation of asn lookup results ↓
The answer here reflects BGP as collected by RIPE's route collectors, not WHOIS registration. A block can be registered to one organisation and announced by another entirely — that is normal for leased address space, and it is also what a BGP hijack looks like. When the holder and the announcing AS surprise you, the announcement is the operationally relevant fact.

Reading the result

  • Origin AS — the autonomous system announcing the route. This is the network your packets are handed to.
  • AS holder — the organisation name registered for that ASN. Useful, but it is free-form text supplied by the registrant; a hosting reseller may appear under a name you have never heard of.
  • Announced prefix — the specific block covering the address. Use this for firewall rules, not the single IP.
  • Currently announced — whether the AS is originating any routes right now. An AS that exists on paper but announces nothing is dormant.
  • All origin ASNs — normally one. Two or more means the prefix is announced by multiple ASes (multi-origin AS, or MOAS). That is sometimes a legitimate anycast or migration arrangement and sometimes a hijack; either way it is worth a closer look.
  • No origin AS — nothing is announcing a route covering this address. It is a bogon, a reserved or documentation range, or a prefix whose route has been withdrawn. Traffic to it has nowhere to go.

What ASN lookups are good for

This is the tool you reach for when you need to know *who* rather than *where*:

  • Abuse handling. Identify the network responsible for traffic hitting your server, then find its abuse contact. The AS holder is who you escalate to when the immediate host will not act.
  • Firewall and allow-list design. Block or allow at prefix granularity. Blocking a single address from a cloud provider accomplishes almost nothing, because the next attempt comes from a different address in the same block.
  • Understanding a traceroute. Run the hop addresses from a traceroute through this lookup to see exactly where traffic leaves one operator and enters another — that boundary is usually where a latency jump belongs.
  • Mail forensics. Combine with reverse DNS and a blacklist check to build a picture of a sending IP. An AS with a poor reputation is a meaningful signal about a sender.
  • Vendor due diligence. Confirm whether a provider runs its own network or resells someone else's. The origin AS answers that in one query.

The command-line equivalent

Team Cymru's DNS-based service is the classic terminal method; the RIPEstat API is the same data this page uses, and needs no key:

# Team Cymru IP-to-ASN mapping, over plain DNS (reverse the octets, add the zone)
dig +short 8.8.8.8.origin.asn.cymru.com TXT
# "15169 | 8.8.8.0/24 | US | arin | 1992-12-01"

# Look up who an ASN belongs to
dig +short AS15169.asn.cymru.com TXT
# "15169 | US | arin | 2000-03-30 | GOOGLE, US"

# The same data this page uses, straight from RIPEstat
curl -s "https://stat.ripe.net/data/network-info/data.json?resource=8.8.8.8"
curl -s "https://stat.ripe.net/data/as-overview/data.json?resource=AS15169"

# Registry view (ownership on paper, not routing)
whois -h whois.arin.net 8.8.8.8
ASN lookups from a shell

Comparing the last command with the first two is instructive: whois tells you who the registry says holds the block, while the Cymru and RIPEstat answers tell you who is actually announcing it. Most of the time they agree. When they do not, that discrepancy is itself the finding.

A note on accuracy

BGP data is collected from route collectors peering with hundreds of networks, so it is a very good approximation of the global table — but it is still a view from particular vantage points. A prefix announced only regionally may not be visible to every collector, and the table changes continuously as routes are announced and withdrawn. Results here are cached briefly; for anything time-sensitive, such as investigating a hijack in progress, query RIPEstat or a looking glass directly.

Reverse DNS (PTR) Lookup
Hostname behind an IP — required for mail servers

Frequently asked questions

What is the difference between an ASN lookup and a WHOIS lookup?
WHOIS tells you who the address block is registered to in the regional registry's records. An ASN lookup tells you which network is announcing a route to it in BGP right now. Registration is paperwork; the announcement is where your packets actually go. They usually match, and when they do not — leased address space, a recent transfer, or a hijack — the routing view is the operationally relevant one.
Why does the result show a prefix instead of just my IP?
Because routers do not route individual addresses. The prefix is the block the origin AS advertises, and it is the correct unit for firewall rules, allow-lists, and abuse reports. Acting on one address from a large provider is rarely effective; the next connection comes from a neighbouring address in the same block.
What does it mean if two ASNs are listed for one prefix?
That is a multi-origin AS (MOAS) announcement. It can be legitimate — anycast deployments, a network migration in progress, or an organisation using two ASNs — but it is also the signature of a BGP hijack, where someone announces a prefix they do not hold. If the second AS is unrelated to the block's registered holder, it is worth investigating.
Can I look up an ASN to find all the prefixes it announces?
Not from this page, which starts from an address. RIPEstat's announced-prefixes endpoint does exactly that: curl "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS15169". Expect large networks to announce hundreds or thousands of prefixes.
Why is no AS found for my address?
No autonomous system is currently announcing a route covering it. That is expected for private ranges, documentation ranges like 203.0.113.0/24, and other reserved space. For an address that should be live, it means the route has been withdrawn — the block is unreachable from the public internet until it is announced again.
Is the AS holder name the company that actually runs the server?
Not necessarily. It is the organisation that holds the ASN, which for a virtual server is typically the hosting provider rather than their customer. The PTR record from a reverse DNS lookup is often a better hint about the tenant, and the abuse contact in WHOIS is the right place to send a report.
Does this data cost anything or need an API key?
No. RIPEstat is a free public service operated by the RIPE NCC, and Team Cymru's DNS interface is free as well. Neither requires registration, which is why this tool can return real routing data rather than an estimate.