Kavra LabHow ASNs work
The internet is made of tens of thousands of independent networks, called autonomous systems, that agree to carry each other's traffic. Each one gets a number from one of the five regional internet registries, which receive blocks of numbers from IANA. A network then tells its neighbors, through the Border Gateway Protocol (BGP), which IP address ranges it can deliver traffic to. That announcement is how the rest of the internet knows where to send packets.
Because of this, any public IP address can be mapped to the ASN announcing it and to the organization behind that ASN. Registry records add the organization's name and country. That lookup is fast, free and available on the very first request a visitor makes.
Types of networks behind an ASN
The type of network says a lot about who is likely on the other end.
| Network type | Examples of who is behind it | What it means for a consumer site |
|---|---|---|
| Home internet provider | Cable, fiber and DSL households | Expected for real customers |
| Mobile carrier | Phones and tablets on cellular data | Expected, but IPs are shared by many users |
| Hosting or cloud | Servers, VPN nodes, bots, crawlers | Unusual for a shopper, worth a closer look |
| Business or education | Offices, universities, public institutions | Normal, often many users behind one IP |
| Content delivery and security | Corporate gateways, privacy relays | Legitimate users routed through a provider |
How ASNs show up in fraud and real traffic
For fraud teams, the ASN is the quickest way to answer "is this a person at home or a machine in a data center?" A signup form filled in from a cloud provider's network is a classic bot signal, and many credential stuffing and web scraping campaigns first appear as spikes from a handful of hosting ASNs. The ASN also helps check good bots: a visitor claiming to be a well-known search crawler should connect from its operator's own network.
The limits are just as clear. Residential proxies and mobile proxies exit through home and carrier ASNs, so their traffic looks normal at the ASN level. Some legitimate users sit behind hosting networks too, including corporate security gateways, privacy relays and remote desktops. A hosting ASN is a reason to look closer, not proof of fraud.
- Match the network type to the device: a phone browser on a hosting ASN is a contradiction.
- Watch for bursts of new accounts or logins from one ASN in a short window.
- Verify declared crawlers against their operators' published networks and IP ranges.
- Compare a login's ASN with the networks the account owner normally uses.
ASN vs IP address
An IP address points to a single connection at a moment in time. An ASN describes the whole network that address belongs to, which may hold millions of addresses. That makes the ASN more stable and better for spotting patterns, like a campaign spread across many addresses in one cloud provider, while the IP is better for spotting a single repeat visitor. IP reputation scores often lean on both.
How Kavra uses ASN data
Kavra classifies the network behind every visit, from home and mobile carriers to hosting providers and anonymizers, and shows it as network context in each explained decision. Its own edge network sees the real connection, and its proxy intelligence recognizes residential and mobile proxy exits that ASN data alone would pass. Read more in VPN and Tor detection and residential and mobile proxy detection.