ASN Lookup: How to Find an IP Address’s ASN

An ASN lookup maps an IP address to its observed announcing autonomous system number and routed prefix. Start with this lookup for 8.8.8.8, then inspect the registration record separately.

That separation matters: the network announcing an address can differ from the organization named in its registration. Here is how to interpret both results, automate a small batch, and avoid treating an ASN as proof of location or residential usage.

What does ASN lookup tell you?

An ASN lookup identifies the autonomous system associated with an observed route to an address. It does not identify the person or device using that address.

An autonomous system groups networks under a clearly defined routing policy, as described in RFC 1930. An ASN identifies that system; an IP identifies an address; a CIDR prefix describes an address block, such as 8.8.8.0/24.

You commonly see AS15169, with AS preceding the decimal number. RFC 5396 specifies decimal ASN representation. Regional Internet Registries maintain allocation and registration records; observed BGP announcements answer a separate routing question.

How do you perform an ASN lookup by IP?

Submit the public IPv4 or IPv6 address to a routing lookup, record every returned ASN and prefix, then check registration.

Step 1: Identify the address your connection actually uses. A router’s WAN information or an external address check can help; see our guide to looking up an IP address.

Step 2: Open the lookup above. RIPEstat’s network-info documentation defines asns and prefix. Its freshness limit is eight-hour RISwhois dumps (as of October 2026).

Step 3: For a domain, resolve its A and AAAA records first and check each address. CDN or shared infrastructure identifies the serving network, not necessarily the website operator.

Which free ASN lookup tool should you use?

Choose by the question: registration, observed routing, or a quick visual check. Free access does not imply unrestricted automation.

Compare registration records using ARIN’s RDAP guide, routing observations through RIPEstat, and manual results through Hurricane Electric’s BGP Toolkit. Record retrieval time separately from the source’s observation time.

HackerTarget’s ASN lookup accepts IP, ASN, and name inputs. Its stated free limit is 50 daily lookups shared across its IP tools, with up to 25 IPs or ASNs in the non-member form (as of October 2026). These documented limits are separate from our measurements.

How do you search by ASN, company, name or country?

An ASN is the clearest starting point; company and name searches produce candidates that need verification. Country searches require an explicit definition of country.

Check candidate ASN registration records, aliases, and associated prefixes. Subsidiaries, acquisitions, and similar organization names can make a text match ambiguous.

A registration country describes registry metadata, not where every address operates. Keep it separate from physical location and read our explanation of IP geolocation accuracy before using country fields operationally.

How do WHOIS, dig and RDAP work from Linux?

WHOIS returns text, DNS queries return records, and RDAP returns structured registration data over HTTP. The queried service determines what those results mean.

Team Cymru’s official command reference covers WHOIS, DNS, IPv6, and bulk syntax. Its usage restriction warns against excessive individual WHOIS queries and directs volume users toward bulk or DNS (as of October 2026).

For manual parsing, split a verbose IP row on |, trim whitespace, and read AS, IP, prefix, country, registry, allocation date, and AS name. The tested Python code below performs that parsing. DNS origin results have a different field layout; do not reuse the WHOIS column positions.

RDAP uses JSON and referrals to authoritative registries. A network’s name and address range describe registration, not a live BGP observation.

How can Python and APIs handle bulk lookups?

For a small batch, query routing sources sequentially and export registration fields separately. Our tested workflow writes asn_lookup.csv or asn_exits.csv.

Install with pip install requests, then run python3 asn_lookup.py 8.8.8.8 1.1.1.1 9.9.9.9. Below is the unchanged executable body of asn_lookup.py; the introductory authentication example is omitted.

import csv, os, socket, sys, time, uuid
import requests

RIPE = "https://stat.ripe.net/data"
HOLDERS = {}  # cache: ASN -> holder name (one as-overview call per ASN)


def ripestat(ip):
    data = requests.get(f"{RIPE}/network-info/data.json", params={"resource": ip}, timeout=10).json()["data"]
    asns = data.get("asns", [])
    for asn in asns:
        if asn not in HOLDERS:
            time.sleep(2)
            ov = requests.get(f"{RIPE}/as-overview/data.json", params={"resource": f"AS{asn}"}, timeout=10).json()
            HOLDERS[asn] = ov["data"].get("holder")
    return {"asn": ",".join(asns), "prefix": data.get("prefix"), "holder": HOLDERS.get(asns[0]) if asns else None}


def cymru_bulk(ips):
    """One TCP connection to whois.cymru.com:43 for the whole list (their preferred way)."""
    query = "begin\nverbose\n" + "\n".join(ips) + "\nend\n"
    with socket.create_connection(("whois.cymru.com", 43), timeout=15) as s:
        s.sendall(query.encode())
        raw = b""
        while chunk := s.recv(4096):
            raw += chunk
    result = {}
    for line in raw.decode().splitlines()[1:]:  # first line is a banner
        cols = [c.strip() for c in line.split("|")]
        if len(cols) == 7:  # AS | IP | prefix | CC | registry | allocated | AS name
            result[cols[1]] = {"asn": cols[0], "prefix": cols[2], "country": cols[3], "as_name": cols[6]}
    return result


def rdap(ip):
    """rdap.org redirects to the registry that holds the block (ARIN, RIPE, APNIC...)."""
    r = requests.get(f"https://rdap.org/ip/{ip}", timeout=10)
    j = r.json()
    return {"rdap_name": j.get("name"), "rdap_range": f"{j.get('startAddress')} - {j.get('endAddress')}",
            "rdap_country": j.get("country"), "registry": r.url.split("/")[2]}


def exit_ips(n):
    template = os.environ["PROXY_URL"]  # must contain {session}
    found = {}
    for i in range(n):
        proxy = template.format(session=uuid.uuid4().hex[:8])
        try:
            ip = requests.get("https://api.ipify.org", proxies={"http": proxy, "https": proxy}, timeout=30).text.strip()
            found[ip] = f"exit-{i + 1:02d}"  # label, so the CSV does not store the exit IP
        except requests.RequestException as exc:
            print(f"session {i + 1}: {type(exc).__name__}")
        time.sleep(2)
    return found


def main():
    if sys.argv[1:2] == ["--exits"]:
        labels = exit_ips(int(sys.argv[2]))
        use_rdap = False
    else:
        labels = {ip: ip for ip in (sys.argv[1:] or ["8.8.8.8", "1.1.1.1", "9.9.9.9"])}
        use_rdap = True
    cymru = cymru_bulk(list(labels))
    rows = []
    for ip, label in labels.items():
        row = {"input": label, **ripestat(ip)}
        c = cymru.get(ip, {})
        row.update({"cymru_asn": c.get("asn"), "cymru_as_name": c.get("as_name"), "country": c.get("country")})
        if use_rdap:
            time.sleep(2)
            row.update(rdap(ip))
        rows.append(row)
        print(f"{label:22} AS{row['asn']:8} {row['holder']} | cymru AS{row['cymru_asn']} {row['country']}")
        time.sleep(2)
    out = "asn_exits.csv" if sys.argv[1:2] == ["--exits"] else "asn_lookup.csv"
    with open(out, "w", newline="") as f:
        w = csv.DictWriter(f, fieldnames=list(rows[0].keys()))
        w.writeheader()
        w.writerows(rows)
    print("saved", out)


if __name__ == "__main__":
    main()

This is a small-run script: HTTP lookup timeouts are 10 seconds, WHOIS uses 15 seconds, and exit checks use 30 seconds. It has no input validation, retry/backoff, or per-row lookup exception recovery; duplicate exit addresses collapse into one entry.

Before production use, reject invalid inputs, preserve failed rows, and use bounded backoff with at most one retry. The ipwhois RDAP documentation describes an alternative Python workflow; it was not part of this run.

How do you verify routing and find an ASN’s prefixes?

Use the 3-layer ASN verification model: input resolution, observed origin, and registry holder. Keep each layer’s evidence separate.

• Input resolution: Record the exact address and lookup time.
• Observed origin: Preserve every returned ASN and matching prefix.
• Registry holder: Inspect registration entities and ranges separately from routing labels.

For ASN-to-prefix queries, consult RIPEstat announced-prefixes. Its default visibility threshold excludes announcements seen by fewer than 10 RIS peers (as of October 2026); retain the query period too.

Multiple origins need investigation, not automatic rejection. An empty routing result does not establish that an address is unallocated, and observed announcements are not an inventory of legally owned ranges.

Can an ASN identify residential or datacenter IPs?

An ASN gives network context but cannot prove that an individual address is residential. Mixed-use networks make organization-wide labels unreliable.

IPinfo’s classification explanation discusses networks combining ISP and hosting services. Compare datacenter and residential proxies, including the definitions of residential proxies and datacenter proxies.

Our DataImpulse exit sample contained 10 datacenter sessions across nine prefixes and 10 residential sessions across ten prefixes. Datacenter origins were AS55286 (4), AS40403 (2), AS36352, AS18779, AS400463, and AS13335 (one each). Residential origins were AS21928 (5), AS6167 (3), and AS7018 (2).

The network names matched hosting/cloud and consumer-carrier patterns respectively, but this is not independent proof of endpoint type. For configuration decisions, continue to ASN exclusion tradeoffs.

What did our quick lookup run return?

In our quick run on October 19, 2026, RIPEstat and Cymru agreed on origin ASN for 24/24 comparisons. This was a small snapshot, not a benchmark.

We used Linux, Python 3.12, and requests: four public reference addresses, a separate server check, and 20 US-targeted proxy sessions with fresh session IDs. Calls were sequential with two-second pauses, under 20 RIPEstat calls per run, and one Cymru bulk connection per run. No throttling was observed.

Measurement artifacts: asn_lookup.py, asn_lookup.csv, and asn_exits.csv. RDAP registration results are separate from routing agreement.

For 1.1.1.1, Cloudflare’s announcing ASN and APNIC-LABS registration illustrate why the two questions differ.

These are single-call timings. Exact UTC timestamps, registration ranges, and complete error fields are absent from this summary. The script does not persist raw responses or timing telemetry. RDAP’s routed prefix and observed origin are N/A for this comparison.

What lookup limitations and usage rules matter?

Source age, observation coverage, and field meaning limit every result. Agreement is useful evidence, not universal accuracy.

Some US-targeted datacenter exits returned CA, GB, or SC registration codes. We did not geolocate them, so those codes do not establish server location.

Respect service terms and throttling. Keep lookup separate from scanning, minimize retained contact data, and avoid logging proxy authentication. Our published exit results omit individual addresses. If an interface fails, use the official registry or routing interface and record the failure rather than silently substituting a different kind of answer.

Check the exit network before making proxy decisions

When evaluating DataImpulse sessions, record the observed origin and registration separately, then assess the connection against your actual requirements. DataImpulse supplies proxies; it is not a scraping API, managed unblocker, VPN, or data vendor.

Last updated: October 19, 2026.