What an Autonomous System is
The internet is not a single network — it is tens of thousands of independently operated networks that agree to exchange routing information with each other. Each of these networks is called an Autonomous System (AS): a collection of IP prefixes under the control of a single administrative entity with a unified routing policy.
An AS might be an internet service provider (ISP), a content delivery network (CDN), a cloud provider, a large enterprise with its own IP address space, a university, or a government agency. What they have in common is that they control a set of IP prefixes and are responsible for how traffic routes into and out of their network.
The protocol that connects autonomous systems is BGP (Border Gateway Protocol). BGP is the internet's routing protocol: each AS announces its IP prefixes to its BGP peers, and those peers propagate the announcements further. Every router on the internet's backbone maintains a table of which AS to route each prefix through. The internet is, at a high level, a directed graph where the nodes are autonomous systems and the edges are BGP peering relationships.
ASNs are assigned by the Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) from the pool allocated by IANA. Originally 16-bit (AS1 through AS65535), ASN space was extended to 32-bit to accommodate growth.
How to read an ASN
ASNs are written as AS followed by the number: AS15169, AS13335, AS16509. Given an IP address, you can determine its ASN via a WHOIS query to the appropriate RIR or via a BGP-aware lookup service.
A WHOIS result for an IP includes:
- ASN: the number identifying the autonomous system
- AS name / handle: a short identifier (e.g.,
GOOGLE,AMAZON-02) - Organization: the legal entity or registered name
- Route/prefix: the IP range announced by that AS covering this IP
- Country: the country of registration (not necessarily where the server is located)
The AS name and org field are the most informative for quickly classifying an IP. "CLOUDFLARENET" or "AMAZON-02" tells you immediately that the IP belongs to a major cloud or CDN provider — more useful than just a country code.
ASNs and IP reputation
Security tools and threat intelligence feeds lean heavily on ASN data to classify IP addresses, because the AS an IP belongs to predicts its likely purpose more reliably than geography alone.
Consider: an IP in Frankfurt might belong to a residential ISP, a datacenter hosting legitimate services, an AWS EC2 instance, a Tor exit node, or a VPN provider. All would show the same country. The ASN disambiguates this entirely.
Classification approaches based on ASN:
- Cloud / hosting detection: IP prefixes belonging to major cloud providers (AWS, GCP, Azure, Cloudflare, DigitalOcean, Linode) are well-known and can be matched by ASN even before checking cloud-provider CIDR lists.
- VPN and proxy detection: Many commercial VPN providers operate their own ASNs or purchase IP space that security researchers have catalogued.
- ISP vs datacenter: Residential ISPs have specific ASNs. IPs from those ASNs are unlikely to be servers. IPs from datacenter ASNs are unlikely to be end users.
- Known-bad ASNs: Some ASNs have historical association with spam, botnets, or bullet-proof hosting. Threat intelligence feeds include ASN-level block recommendations alongside IP-level listings.
Cloud provider ASNs
The major cloud and CDN providers operate well-known ASNs that appear frequently in security tooling and firewall rules:
- AWS: AS16509 (primary compute), AS14618 (Amazon.com corporate), plus several others for specific regions
- Google Cloud / GCP: AS15169
- Microsoft Azure: AS8075
- Cloudflare: AS13335
- DigitalOcean: AS14061
- Akamai / Linode: AS63949 (Linode), AS16625 (Akamai CDN)
These ASNs are also used by cloud provider IP range feeds. When a service publishes its IP ranges (AWS ip-ranges.json, GCP cloud.json, Azure ServiceTags), those ranges map back to these ASNs. Cross-referencing ASN data with cloud provider CIDR lists gives higher-confidence classification.
ASN-based access control
Network operators and application security teams use ASNs as a coarse-grained firewall primitive:
- Blocking cloud ASNs: Some security teams block inbound traffic from cloud provider ASNs on administrative interfaces, reasoning that legitimate users do not access admin panels from AWS IP ranges. This is effective at blocking automated credential-stuffing attacks that rent cloud instances.
- Blocking entire countries vs blocking ASNs: Country-based blocking relies on geolocation databases that can be wrong. ASN-based blocking is more precise — an IP's ASN is verifiable from public BGP tables, while geolocation is an estimate. Blocking residential AS traffic from certain countries is a different policy than blocking cloud AS traffic globally.
- Allowlisting: Conversely, if a legitimate partner always connects from a known corporate ASN, allowlisting by ASN is more stable than by IP (corporate IPs can change within an ASN).
BGP routing also means IP-to-ASN mapping can change. An IP transferred between providers changes ASN. ASN-based rules need periodic review against current BGP tables.
BGP routing and security
BGP was designed for trust between cooperating networks, not for adversarial environments. Two well-known attack classes exploit this:
- BGP route hijacking: An AS announces a more-specific prefix than the legitimate owner, attracting traffic to its own network. This can be used for traffic interception or cryptocurrency theft.
- BGP route leaks: An AS accidentally re-announces routes it received from one peer to another peer, causing traffic to route through unexpected paths.
RPKI (Resource Public Key Infrastructure) is the mitigation: it cryptographically links IP prefixes to their authorized origin ASN via Route Origin Authorizations (ROAs). Routers performing RPKI validation will reject BGP announcements that do not match a valid ROA. RPKI adoption has grown significantly but is not universal.
How to look up an ASN
Given an IP address, the enrichment API returns the ASN, AS name, organization, network type, and additional classification signals in a single JSON response. You can query any public IP to see its full enrichment including ASN data, prefix, geolocation, and whether the IP is classified as cloud, VPN, datacenter, or residential.