IP / ASN Lookup
Look up an IP's owning org, ASN and allocation via RDAP.
IP ASN Lookup checks, in real time, which Autonomous System (AS) an IPv4 address belongs to and which IP prefix (CIDR block) it is advertised under on the internet. It shows the ASN, the owning organization (holder) and the prefix at a glance, so you can quickly tell which ISP, cloud or hosting provider's network an address sits in.
Lookups are based on public routing data published by the RIPE NCC (RIPEstat), and results are briefly cached for speed. It is handy for tracing the origin of an IP in your server logs, identifying the source network of abusive traffic, or verifying that your own ranges are advertised under the correct ASN. For the IP's rough location, pair it with IP Geolocation; to find a domain's IP first, use Website IP Lookup.
What is an ASN?
An Autonomous System Number is a unique identifier assigned to a group of IP networks operated under a single routing policy (an autonomous system). ISPs, cloud providers and large enterprises each hold one or more ASNs and exchange routes with each other over BGP. Looking up an IP's ASN and holder tells you which organization's network the address belongs to.
What is an IP prefix (CIDR)?
A prefix is the contiguous block of IP addresses that an ASN advertises on the internet, written in CIDR notation such as 203.0.113.0/24. It shows which range a single input IP is actually routed as part of.
How to read the results
- ASN: the autonomous system number advertising the IP
- Holder: the organization registered for that ASN
- Prefix: the advertised CIDR range containing the input IP
If more than one ASN is shown for a single IP, it may be advertised from multiple origins (MOAS) or reflect a difference in the data snapshot.
Common ASNs and their holders
You don't need to memorize ASNs, but the big clouds and CDNs show up constantly in logs, so recognizing them lets you identify a source instantly. Below are ASNs you'll frequently meet in global traffic (the number is fixed; the holder name may be spelled slightly differently in the registry).
| ASN | Holder | What it is |
|---|---|---|
AS15169 | Google LLC | Search, some cloud, crawlers |
AS16509 | Amazon.com (AWS) | AWS EC2 / cloud hosting |
AS13335 | Cloudflare, Inc. | CDN / proxy / DNS (1.1.1.1) |
AS8075 | Microsoft Corporation | Azure / Bing / Office |
AS4766 | Korea Telecom (KT) | Korean residential / business |
AS9318 | SK Broadband / SK Telecom | Korean ISP |
AS3356 | Level 3 / Lumen | Global backbone (Tier 1) |
AS14061 | DigitalOcean, LLC | VPS hosting (common scanner origin) |
A worked example
Suppose 8.8.8.8 keeps appearing in your logs and you want to know where it's from. Looking it up returns roughly this:
- ASN:
AS15169 - Holder: Google LLC
- Prefix:
8.8.8.0/24
Two things matter here. First, the holder is Google, so this traffic comes from Google infrastructure (in this case the public DNS resolver at 8.8.8.8). Second, the prefix 8.8.8.0/24 means the 256 addresses from 8.8.8.0 to 8.8.8.255 are advertised as a single route — so any other IP in the 8.8.8.x range that caused the same event can be treated as belonging to the same organization. When building block or allow lists, working at the prefix level rather than per-IP is more robust. That said, a single org often advertises a much larger block (e.g. /16), so think carefully before turning the advertised prefix straight into a blocking unit.
Common pitfall
- Mistaking an ASN for a location. An ASN tells you who routes the address, not where it physically sits. Global operators like AS13335 (Cloudflare) or AS16509 (AWS) send traffic from hundreds of sites worldwide under the same ASN. For a physical location, use IP Geolocation separately.
- Assuming the holder is the operator. The registered ASN organization isn't necessarily the service actually using the IP. For an IP on a hosting/VPS ASN (e.g. AS14061 DigitalOcean), the real operator is likely a different customer running a server on top of it.