# What is an ASN?

Source: https://kavralab.com/glossary/asn/

An **ASN** (autonomous system number) is a unique number assigned to a network that controls its own routing on the internet, such as an internet provider, a mobile carrier, a cloud host or a large company. Every public IP address is announced by some ASN, so looking up the ASN tells you which organization's network a visitor is connecting from.

## How ASNs work

The internet is made of tens of thousands of independent networks, called autonomous systems, that agree to carry each other's traffic. Each one gets a number from one of the five regional internet registries, which receive blocks of numbers from IANA. A network then tells its neighbors, through the Border Gateway Protocol (BGP), which IP address ranges it can deliver traffic to. That announcement is how the rest of the internet knows where to send packets.

Because of this, any public IP address can be mapped to the ASN announcing it and to the organization behind that ASN. Registry records add the organization's name and country. That lookup is fast, free and available on the very first request a visitor makes.

## Types of networks behind an ASN

The type of network says a lot about who is likely on the other end.

| Network type | Examples of who is behind it | What it means for a consumer site |
|---|---|---|
| Home internet provider | Cable, fiber and DSL households | Expected for real customers |
| Mobile carrier | Phones and tablets on cellular data | Expected, but IPs are shared by many users |
| Hosting or cloud | Servers, VPN nodes, bots, crawlers | Unusual for a shopper, worth a closer look |
| Business or education | Offices, universities, public institutions | Normal, often many users behind one IP |
| Content delivery and security | Corporate gateways, privacy relays | Legitimate users routed through a provider |

## How ASNs show up in fraud and real traffic

For fraud teams, the ASN is the quickest way to answer "is this a person at home or a machine in a data center?" A signup form filled in from a cloud provider's network is a classic bot signal, and many [credential stuffing](https://kavralab.com/solutions/credential-stuffing/) and [web scraping](https://kavralab.com/solutions/web-scraping/) campaigns first appear as spikes from a handful of hosting ASNs. The ASN also helps check good bots: a visitor claiming to be a well-known search crawler should connect from its operator's own network.

The limits are just as clear. [Residential proxies](https://kavralab.com/glossary/residential-proxy/) and mobile proxies exit through home and carrier ASNs, so their traffic looks normal at the ASN level. Some legitimate users sit behind hosting networks too, including corporate security gateways, privacy relays and remote desktops. A hosting ASN is a reason to look closer, not proof of fraud.

- Match the network type to the device: a phone browser on a hosting ASN is a contradiction.
- Watch for bursts of new accounts or logins from one ASN in a short window.
- Verify declared crawlers against their operators' published networks and IP ranges.
- Compare a login's ASN with the networks the account owner normally uses.

## ASN vs IP address

An IP address points to a single connection at a moment in time. An ASN describes the whole network that address belongs to, which may hold millions of addresses. That makes the ASN more stable and better for spotting patterns, like a campaign spread across many addresses in one cloud provider, while the IP is better for spotting a single repeat visitor. [IP reputation](https://kavralab.com/glossary/ip-reputation/) scores often lean on both.

## How Kavra uses ASN data

Kavra classifies the network behind every visit, from home and mobile carriers to hosting providers and anonymizers, and shows it as network context in each explained decision. Its own edge network sees the real connection, and its proxy intelligence recognizes residential and mobile proxy exits that ASN data alone would pass. Read more in [VPN and Tor detection](https://kavralab.com/detect/vpn-and-tor/) and [residential and mobile proxy detection](https://kavralab.com/detect/residential-proxies/).

## FAQ

### How do I find the ASN of an IP address?

Use a WHOIS or IP lookup tool, or the lookup services offered by regional internet registries and routing projects. Enter the IP address and the result shows the ASN announcing it, the organization's name and often its country. Many fraud and analytics tools add the ASN to every request automatically.

### Should I block traffic from hosting ASNs?

Not across the board. Blocking hosting networks stops a lot of simple bot traffic, but it also blocks verified crawlers, partner integrations, corporate gateways and some privacy tools used by real customers. A safer approach is to add risk for hosting networks on consumer actions like signup and login, and to allow expected server traffic on APIs.

### Can one company have more than one ASN?

Yes. Large internet providers, carriers and cloud companies often run several ASNs, for different regions, acquired businesses or separate services. That is why fraud analysis usually groups ASNs by organization and network type rather than treating each number on its own.

---
Kavra Lab: bot and fraud detection that explains every decision. Book a demo: https://kavralab.com/contact/