What Is an ASN? Autonomous System Number Lookup, Ranges, and API Guide

Introduction

Every time someone visits your site, signs up, or pays, their traffic arrives from a network that someone owns and runs. That network has a number. It's called an Autonomous System Number, or ASN, and it's one of the most useful pieces of context you can attach to an IP address. If you know the ASN, you know who operates the network, whether it's a home broadband provider or a cloud data center, and which IP ranges belong to it.

This guide explains what an ASN is in plain language, how the numbering works (including the private and reserved ranges that older articles often get wrong), how BGP uses ASNs, and how to run an ASN lookup or an IP to ASN lookup with an API. We'll finish with practical ways risk and security teams use ASN data to block bots and fraud without hurting real users.

According to Imperva's 2025 Bad Bot Report, automated traffic made up 51% of all web traffic in 2024, and bad bots alone accounted for 37% of all internet traffic, up from 32% in 2023.

Source: Imperva 2025 Bad Bot Report

Why ASNs Matter More Than Ever for Online Businesses

The internet is not one network. It's tens of thousands of independently run networks that agree to exchange traffic. Each of those networks is an Autonomous System, and the ASN is its public ID.

For a long time, ASNs were something only network engineers cared about. That changed as fraud and abuse moved to automation. Bots, fake signups, and credential stuffing runs usually come from rented infrastructure: cloud servers, hosting providers, and proxy networks. Those all sit behind specific ASNs. When you can see the network behind a request, you get a signal that's much harder to fake than a user agent or a form field.

What Is an ASN? A Simple Definition You Can Actually Use

An Autonomous System is a group of IP prefixes run by one operator under a single routing policy. An Autonomous System Number is the unique number that identifies that group on the public internet.

Here's how they get handed out:

• The Internet Assigned Numbers Authority (IANA) allocates blocks of ASNs to the five Regional Internet Registries (RIRs): AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC.
• The RIRs then assign individual ASNs to ISPs, hosting companies, universities, governments, and businesses that run their own networks.
• ASNs are usually written with an "AS" prefix, such as AS15169 (Google) or AS14061 (DigitalOcean).

The Problem: An IP Address Alone Doesn't Tell You Who You're Dealing With

An IP address on its own is just a number. It changes hands, gets reassigned, and sits behind NAT and proxies. Blocking single IPs is a game of whack-a-mole, because an attacker on a cloud provider can grab a fresh address in seconds.

The ASN answers the more useful question: whose network is this? Two signups from different IPs might look unrelated, but if both come from the same small hosting ASN that has no residential customers, that's a pattern worth acting on. ASN context turns isolated IPs into networks you can reason about.

How ASN Numbers Work: 16-bit, 32-bit, ASPLAIN, and ASDOT

16-bit (2-byte) ASNs

The original ASN format was a 16-bit number, which gives values from 0 to 65535. That pool has effectively run out. The IANA AS number registry shows every public 16-bit block already allocated to the RIRs, with the last block (64396 to 64495) going to RIPE NCC in 2016.

32-bit (4-byte) ASNs

To keep up with demand, ASNs were extended to 32 bits, giving values from 0 to 4294967295. Values from 65536 upward are 4-byte only. Modern routers and registries treat every ASN as a 32-bit number, and a 16-bit ASN is simply a 32-bit ASN with a small value.

ASPLAIN vs ASDOT notation

There are two common ways to write a 4-byte ASN:

• ASPLAIN writes the full decimal value, for example 4200000001. This is the standard format today.
• ASDOT splits the number into a high 16-bit part and a low 16-bit part, separated by a dot. The value equals high x 65536 + low.

So 4200000001 in ASDOT is 64086.59905, because 64086 x 65536 = 4199940096, and 4199940096 + 59905 = 4200000001. (Some older guides show this as "0x1000.1", which is not correct.)

Private ASN Ranges and Reserved Values You Should Know

Not every ASN is meant to appear on the public internet. These ranges come from the IANA registry and the RFCs it cites:

Private ASNs work a lot like private IP ranges. Companies use them inside their own networks, data centers, or between a customer and a single upstream provider. They should be stripped before routes reach the public internet. If you ever see a private or documentation ASN as the origin of public traffic, treat it as a misconfiguration or a data quality problem, not a real network owner.

How BGP Uses ASNs to Route Traffic

Border Gateway Protocol (BGP) is how autonomous systems tell each other which IP prefixes they can reach. Each route announcement carries an AS path, a list of ASNs the route has passed through. The last ASN in the path is the origin, the network that owns or announces the prefix.

Two networks that connect directly are called peers. They agree on routing policies that decide which prefixes each side announces and accepts. This is why ASN data is so useful for analysis: the origin ASN for an IP prefix tells you which organization is actually serving that address space today.

IP to ASN Lookup: Find the Network Behind Any Visitor

In fraud prevention, you rarely start with an ASN. You start with an IP address from a login, signup, or checkout. An IP to ASN lookup maps that address to the network that announces it.

With Greip's IP Lookup API, the response includes an asn object with the AS number, the matching cidr prefix, the network name and organization, contact details, and a type field. The type is one of isp, hosting, business, education, or government, which is often the single most useful field for risk decisions. If you just want to check a network by hand, the free ASN lookup tool lets you search by AS number in the browser.

How to Look Up an ASN with the Greip API (v2)

When you already have an AS number and want full details, use the ASN Lookup endpoint. It's a GET request to https://v2.greipapi.com/lookup/asn/{asn}, where {asn} can be written as AS6167 or 6167. API v2 accepts your key only in the Authorization header as a Bearer token, never in the query string. The endpoint is available on the Premium plan and above.

curl "https://v2.greipapi.com/lookup/asn/AS9112" \
  -H "Authorization: Bearer YOUR_API_KEY"

A successful response looks like this:

{
  "success": true,
  "data": {
    "name": "POZMAN",
    "org": "Institute of Bioorganic Chemistry Polish Academy of Science, Poznan Supercomputing and Networking Center",
    "phone": "+48 61 8582010",
    "email": null,
    "domain": "poznan.pl",
    "status": "ASSIGNED",
    "created": "2004-04-17T11:47:57Z",
    "type": "education",
    "registry": "RIPE",
    "prefixes": {
      "ipv4": [
        "150.254.0.0/16",
        "62.3.160.0/19"
      ],
      "ipv6": [
        "2001:808::/35"
      ],
      "total": 3
    },
    "number": "AS9112",
    "country_code": "PL"
  },
  "execution_ms": 0
}

The prefixes object lists the IPv4 and IPv6 ranges tied to the ASN, and total gives the prefix count. If the key is missing or invalid, you get success: false with code 101 and type invalid_key.

Optional query parameters include format (JSON, XML, CSV, or Newline), mode (live or test), source, and user_id.

Here's the same call from a Node.js server, with the API key read from a server-side environment variable (defined at the top of the snippet) so it never reaches the browser:

// Node.js 18+ (built-in fetch)
const GREIP_API_KEY = process.env.GREIP_API_KEY;
async function lookupAsn(asn) {
  const response = await fetch(
    `https://v2.greipapi.com/lookup/asn/${encodeURIComponent(asn)}`,
    { headers: { Authorization: `Bearer ${GREIP_API_KEY}` } }
  );
  const result = await response.json();
  if (!result.success) {
    throw new Error(`Greip error ${result.code}: ${result.description}`);
  }
  return result.data; // number, name, org, type, registry, prefixes, ...
}
lookupAsn('AS9112').then((asn) => {
  console.log(asn.number, asn.type, asn.prefixes.total);
});

Using ASN Data to Stop Fraud and Bot Traffic

ASN context shines in a few common scenarios:

• Signup and trial abuse. Real customers usually sign up from consumer ISPs or mobile carriers. A burst of new accounts from a hosting ASN is a strong hint of scripted signups.
• Credential stuffing and account takeover. Login attempts spread across many IPs often still cluster in a handful of cloud ASNs. Grouping failures by ASN exposes attacks that per-IP rate limits miss.
• Payment fraud. A checkout from a data center network, paired with a billing country that doesn't match, deserves a step-up check.
• Ad and click fraud. Click farms and bot traffic tend to come from a small set of networks. ASN reporting makes those sources visible quickly.

For a deeper look at scoring networks over time, read our practical guide to using ASN reputation for proactive threat intelligence.

Challenges and Limits of ASN-Based Decisions

ASN data is powerful, but it's not a verdict on its own:

• Shared networks. Large ISPs and mobile carriers carry millions of legitimate users and some bad actors. Blocking a whole consumer ASN is almost always a mistake.
• Legitimate cloud traffic. Corporate VPNs, privacy tools, and B2B integrations often run from cloud providers. A hosting ASN is a risk signal, not proof of fraud.
• Residential proxies. Some attackers route traffic through real home connections to look like normal users. Imperva's 2025 report found that 21% of bot attacks that used ISPs ran through residential proxies, so ASN checks need to work alongside other signals.
• Changing data. Prefixes move between networks and registries update records. Stale ASN data leads to bad decisions.

Best Practices for ASN Lookup in Production

1. Score, don't just block. Feed the ASN type and history into a risk score, then decide between accept, review, and reject.
2. Treat hosting ASNs differently by flow. Be stricter on signups and payments, more relaxed on reading public content.
3. Combine signals. Pair ASN data with VPN and proxy detection, email and phone checks, and device data.
4. Flag private and reserved ASNs. Any origin in the private or documentation ranges should be logged as a data issue.
5. Store ASNs as integers. It makes range checks and joins simple, whatever notation your sources use.
6. Keep the API key on the server. Never call the API with your key from browser code.

Trends Shaping ASN Intelligence

A few shifts are making ASN data more important. Routing security is getting stronger as more networks adopt RPKI and route origin validation, which makes the origin ASN for a prefix more trustworthy. The 16-bit pool is exhausted, so new networks receive 32-bit ASNs, and any system that still stores ASNs as 16-bit values will break. And as AI tools make bots cheaper to build, defenders are shifting from blocking single IPs to judging whole networks, which is exactly where ASN context helps.

Frequently Asked Questions

What is an ASN?

An Autonomous System Number (ASN) is the unique number that identifies a network, or Autonomous System, on the public internet. IANA allocates ASNs to the five Regional Internet Registries, which assign them to ISPs, hosting providers, universities, and businesses that run their own networks.

What is the private ASN range?

Per RFC 6996, the private 16-bit ASN range is 64512 to 65534 and the private 32-bit range is 4200000000 to 4294967294. ASN 0, 23456 (AS_TRANS), 65535, and 4294967295 are reserved, and 64496 to 64511 and 65536 to 65551 are set aside for documentation.

What is the difference between ASPLAIN and ASDOT?

ASPLAIN writes a 4-byte ASN as one decimal number, such as 4200000001. ASDOT splits it into a high and low 16-bit part, where the value equals high x 65536 + low, so 4200000001 becomes 64086.59905.

How do I find the ASN for an IP address?

Run an IP to ASN lookup. Greip's v2 IP Lookup API returns an asn object with the AS number, the matching CIDR prefix, the network name and organization, and a type such as isp or hosting. You can also check networks by hand with the free ASN lookup tool at https://greip.io/tools/asn-lookup.

How do I look up an ASN with the Greip API?

Send a GET request to https://v2.greipapi.com/lookup/asn/{asn} with your key in the Authorization header as a Bearer token. The response includes the ASN name, organization, country code, registry, type, status, creation date, and its IPv4 and IPv6 prefixes. The endpoint is available on the Premium plan and above.

Can ASN data help prevent fraud and bots?

Yes. Bots and scripted signups often come from hosting and cloud networks, so the ASN type is a strong risk signal for signups, logins, and payments. It works best combined with VPN and proxy detection, email and phone checks, and device data rather than as a standalone block rule.

Conclusion

An ASN tells you who runs the network behind an IP address. Once you understand the numbering (including the real private ranges 64512 to 65534 and 4200000000 to 4294967294), how BGP uses ASNs, and how to map any IP to its network, you have a durable signal for spotting bots, fake accounts, and risky payments. Start with the free ASN lookup tool, then add real-time network context to your product with Greip's ASN intelligence service.