ASN lookup
Find the network behind an IP address, IP range or AS number: who runs it, where it’s registered, which prefixes it announces, whether the route is RPKI valid and where to report abuse.
By using these tools you accept the Terms and the Privacy page.
How the ASN lookup works
The ASN lookup tells you which network an IP address or AS number belongs to, which prefixes that network announces and whether the route to an address is RPKI valid. It’s for admins tracing where traffic or abuse comes from, and for anyone checking the network behind a mail server or website.
What an IP lookup and an AS lookup return
For an IP address, the lookup finds the announced prefix that covers it, the AS or ASes that originate that prefix, and the RPKI state for up to three of those origins. It adds the address’s allocation (country, registry and date), its reverse DNS and the abuse contact its regional registry publishes. It also loads the full profile of the first origin AS.
For an AS number, with or without AS or ASN in front, or in asdot such as 3.10, you get the holder’s name and handle, country, registry and allocation date, whether it’s announced in BGP and the IANA number block it comes from. Reserved numbers such as AS0 and AS23456 (AS_TRANS, a placeholder old routers use for 4-byte AS numbers) are refused with the reason.
A range such as 104.16.0.0/13 is looked up by its first address. An IPv4-mapped (::ffff:) or NAT64 (64:ff9b::) IPv6 address is looked up as the IPv4 address it carries. Each lookup stops after 12 seconds: a data source that hasn’t answered by then is marked couldn’t check, and that result isn’t cached.
How the prefix list is built
The list holds the prefixes the AS originates as seen by the RIPE route collectors, with routes that very few collectors see left out. It’s sorted largest first and keeps up to 500 prefixes per address family, which you can copy or download as a text file. Address totals count overlapping announcements once, and IPv6 space is counted in /48 networks.
Reading the result
- Announced by more than one AS: the prefix has several origins, and each of the first three gets its own RPKI check.
- RPKI invalid or not found: the page names the fix, a ROA from the prefix holder at their regional registry, or for an invalid route, withdrawing the announcement.
- Isn’t announced in BGP: no network announces a prefix covering the address right now. It may be unallocated, held in reserve by its registry, or allocated but unused.
- Probably unassigned: the AS number has no holder on record and announces nothing.
- Couldn’t check: a data source didn’t answer, so the details it supplies are marked. Try again in a minute.
What to check next
Use the abuse contact to report spam or attacks coming from the address. If the address sends mail, run the blacklist check and the reverse DNS check on it. To see the network your own connection comes from, open What’s my IP.
Updated · Maintained by Liviu Tanase
Questions
What is an ASN?
An autonomous system number identifies a network on the internet, such as an ISP, a hosting company or a large company’s own network. Every public IP address is part of a prefix that some AS announces in BGP, the protocol networks use to tell each other which addresses they can reach.
How do I find the ASN of an IP address?
Enter the IP address above. The lookup finds the announced BGP prefix that covers it and the AS that originates it, then shows that network’s name, country, registry and prefixes. A range such as 1.1.1.0/24 is looked up by its first address, and an IPv4-mapped IPv6 address such as ::ffff:8.8.8.8 by the IPv4 address inside it. For your own connection, open What’s my IP.
Can I enter a 4-byte AS number in asdot?
Yes. A 4-byte AS number can be written as one number, such as AS196618, or in asdot as two 16-bit halves, such as 3.10 (3 × 65,536 + 10). Both, with or without AS or ASN in front, give the same lookup, and the result shows the asdot form next to the number.
Where does the data come from?
Announced prefixes, the covering prefix of an IP, origin ASes, RPKI validation, BGP neighbour counts and abuse contacts come from RIPEstat, which is built on the RIPE NCC’s RIS route collectors. Country, registry and allocation dates come from Team Cymru’s IP-to-ASN DNS service. The other names, website and network type come from PeeringDB, when the network keeps a PeeringDB record. Reverse DNS is looked up live through Cloudflare’s resolver.
What does RPKI valid, invalid or not found mean?
RPKI lets the holder of an address block publish a signed record (a ROA) saying which AS may announce it and how specific the announcement may be. Valid means a ROA matches the announcement. Invalid means a ROA exists but names a different AS or a shorter maximum length, and many networks drop invalid routes, so the prefix may be unreachable from parts of the internet. Not found means no ROA covers the prefix: the route works, but anyone could hijack it without being filtered.
Why are only 20 reverse DNS samples shown?
Large networks announce thousands of prefixes, and resolving every address would take a long time. The samples are the first usable address of the largest IPv4 ranges and a few IPv6 ranges. A sample that shows no PTR record isn’t a problem in itself; it matters for mail servers, which you can test with the FCrDNS check.
What do the neighbour counts mean?
They count the networks seen next to this AS in BGP paths at the RIPE route collectors. Upstream side means neighbours that appear between this AS and the collectors, which are usually its transit providers and peers. Downstream side means neighbours behind it, which are usually its customers. They are an indication of how connected a network is, not a full list of its business relationships.
Can I look up private IPs like 192.168.1.1 or private AS numbers?
No. Private, loopback, CGNAT, link-local and documentation addresses, scoped IPv6 addresses with a zone ID, 6to4 and Teredo space, and private-use or reserved AS numbers such as AS64512 are refused, because they aren’t routed on the public internet as themselves and have no public owner.
Is my lookup stored?
The lookup runs on this site’s server, so your browser never contacts the data sources directly. Cloudflare’s request logs record the request, including the address or AS number, as the privacy page explains. Results are cached at the edge for up to 3 hours for AS numbers and 15 minutes for IP addresses, and an IP lookup reuses its network’s profile for up to 3 hours. Check again fetches fresh data, except PeeringDB’s, which is reused for up to an hour because PeeringDB limits repeated queries.