ASN Lookup: Whose Network Is This Address On?

Look up an address and read its autonomous system, the organisation that announces it, and what the ownership actually tells you about a website or a mail server.

Jump to the tool

By Net Insight Published 2026-09-17 Updated 2026-09-17

LOOK BEYOND THE IP ADDRESS

The queried address is sent to ipapi.is and proxycheck.io. Your location is approximate; it does not identify your home address. Reputation fields without provider data remain unknown.

What an autonomous system is

The internet routes between networks, not between individual machines. Each of those networks is an autonomous system, identified by a number, and a number is assigned to an organisation that is responsible for announcing the address ranges it holds. When a lookup reports an ASN and a holder name, it is reporting where the address sits in that structure.

The form below shows the autonomous system for an address, the organisation registered for it, and the approximate location the same database associates with the range. Leave the field empty to check the address this connection is using.

What the holder name does and does not mean

The field answers one question precisely: who is responsible for the address range. Everything else has to be inferred, and the inference is easy to get wrong.

A website on a large cloud platform resolves to that platform. The name in the result is the platform, not the business running the site, and that is the correct answer to the question being asked. Since a single provider can host hundreds of thousands of unrelated services behind one ASN, the ASN says nothing about which one you are looking at.

The same applies in the other direction with anycast. Several of the largest DNS resolvers and content networks announce the same address from many locations. The announcing organisation is identified correctly, and the physical place that answered a given request is not, which is also why the location field on this site is described as an estimate everywhere it appears.

For a business with its own address space, the holder name is the business, and the registration record behind it is public. The lookup shows the routing-level name; the registry entry, which includes the allocation date and the country of the allocation, is a separate document. The WHOIS page explains what the public registries publish and why so much of it is withheld.

Networks you are likely to meet

The table lists autonomous systems that appear constantly in hosting and mail logs. It is a starting point for reading a result rather than a directory, and the authoritative record for any number is the regional registry that allocated it. Numbers and holders change when networks merge or reorganise, so a value seen in an old log may no longer be current.

ASN	Holder	Why it appears in logs
AS15169	Google	Search, cloud, and one of the largest anycast networks
AS16509 / AS14618	Amazon	Amazon’s own services and its cloud platform
AS8075	Microsoft	Microsoft services, including hosted mail
AS13335	Cloudflare	The reverse proxy in front of a large share of websites
AS14061	DigitalOcean	Small and mid-size virtual servers
AS24940	Hetzner	European hosting, frequently seen as an exit for scanning
AS16276	OVH	European hosting and infrastructure
AS20473	Vultr	Virtual servers, widely used for both legitimate and automated traffic
AS63949	Akamai (Linode)	Virtual servers and edge delivery
AS396982	Google Cloud	Cloud regions and customer workloads

The pattern worth noticing is how few organisations cover most of the traffic in a typical log. A handful of hosting providers and a few large consumer access networks account for the great majority of connections, which is exactly why flagging by ASN tends to be too blunt to be useful on its own.

Using the ASN in practice

For abuse handling, the ASN is the practical unit. Registries publish an abuse contact for each allocation, and the network operator can act on a range far faster than an individual tenant can. That is the context in which a listing mentioned on the blacklist page becomes actionable: the operator of the range is the party who can remove the cause.

For analysis, the ASN is a coarser signal than the address itself. Two addresses in different countries can share an ASN, and a single consumer network can cover an entire region, so an ASN-based rule will group together things that have nothing else in common.

For mail, the ASN is close to useless as a filter and useful as context. A message from a hosting ASN claiming to be a residential sender is worth a second look; a message from a consumer ASN in a different country from its claimed origin is worth a third. Each of those observations comes from combining the purity signals with routing data, not from the ASN alone.

What this lookup does not provide

It does not list the address ranges the ASN announces, and it does not show routing paths. Those come from routing data collection projects, which publish the prefix-to-ASN mapping that this page does not query. It also does not identify tenants, and it does not tell you whether the network is trustworthy: large hosting providers are used by both legitimate services and abuse, and the ASN covers both.

Related checks live on the IP purity page for the nature of the address and the reputation page for recorded behaviour. The network diagnostics guide puts these in the order worth running when something is failing rather than merely interesting.

Keep this setup

Save the settings to your Sitefarm account. Uploaded files and generated results are not stored.

Questions worth asking

Does the organisation field name the website owner?

Usually not. It names whoever the address is allocated to, which for a hosted site is the hosting provider or cloud platform. The company running the website is a customer of that network, which is why a site on a large cloud shows the cloud's name rather than its own.

Why does an address have both an ASN and a company name?

The ASN is the routing unit: the number that appears in internet routing announcements. The company name is the holder registered for that number. One organisation can hold several ASNs, so the same company name can appear against different numbers.

Is the ASN reliable for blocking or allowing traffic?

It is a coarse control. Blocking a whole ASN also blocks every unrelated service hosted on it, and allowing one permits everything there. It is useful for understanding where traffic comes from and for finding the operator to contact about abuse.

What is an anycast address?

One address announced from many locations at once, with routing sending each visitor to the nearest one. Large DNS resolvers and content networks use it. The ASN still identifies the announcing network, but it says nothing about which physical location served a particular request.