What is an ASN, and why fraud controls act on whole networks

An ASN (autonomous system number) identifies the organisation that operates a block of IP addresses and routes it: every IP address belongs to exactly one ASN at a time — an ISP, a hosting company, a cloud provider, a university. The addresses inside one ASN usually share the same kind of use, which is why fraud and abuse controls often act on whole networks rather than on single addresses.

What an ASN tells you, and what it does not

Who runs the network. AS15169 is Google, AS4134 is a national carrier's backbone. The number is stable for decades; addresses under it come and go.
What the space is for. An ASN is mostly one kind of thing: consumer broadband, mobile, hosting, enterprise, education. IP99 publishes that mix per network on the ASN pages — residential vs datacenter share by segment.
Not who is on the keyboard. An ASN says nothing about the person or device behind an address, and nothing about whether a particular address is currently a proxy exit. That is per-address evidence with a timestamp.

Why controls act on networks

Rotating proxy pools and dial-up pools burn through addresses faster than any list can follow: an exit seen this morning is somebody's ordinary connection this afternoon. The one thing that does not change is the network the addresses are drawn from. So a control that says "step up everything from this hosting ASN" or "treat this carrier's CGNAT range as shared" stays correct for months, while a control that says "block this address" is wrong within hours. The price is collateral: a residential ASN is where real customers live, so the network-level rule should raise friction, never close the door.

The numbers

The IP99 geolocation database attributes IPv4 space to 84,863 autonomous systems. The distribution is extremely skewed: the largest, AS4134, holds 8,588,471 IPv4 segments, while most ASNs hold a handful. The 5,000 largest have a page each with their segment count, address count, country split and residential-vs-datacenter mix.

How to get the ASN of an address

Free, no signup, no API key — 1000 lookups per day per client IP:

curl https://ip99.com/v1/ip/8.8.8.8

{
  "ip": "8.8.8.8",
  "network": { "asn": 15169, "usage_type": "IDC" },
  "geo": { "country": "US", "region": "California", "city": "Mountain View" },
  "signals": { "hosting": true, "proxy": false, "vpn": false },
  "risk": { "score": 0, "level": "none" }, "evidence_state": "none"
}

network.asn is the ASN; network.usage_type is the usage type of the segment the address falls in (IDC here — hosting). Operator names are not part of the English API: the ASN is the machine-readable identity, and the name is one lookup away in any routing registry.

FAQ

How do I find the ASN of an IP address?

Look the address up: GET https://ip99.com/v1/ip/{ip} returns it as network.asn together with the usage type of the segment, free and without a key. The ASN's own page at /en/asn/{asn} shows how large the network is and what its address space is used for.

Is an ASN the same as an ISP?

No. An ISP is a company; an ASN is a routing identity. One ISP can operate several ASNs (backbone, mobile, hosting), and one ASN can carry customers of several resellers. IP99's English API reports the ASN and not an operator name, because the number is exact and the name is not.

Can two addresses in the same ASN have different risk?

Yes. Risk evidence is per address and per observation: one address in a carrier's range can be a proxy exit right now while its neighbour is an ordinary subscriber. The ASN gives you the prior — what kind of space this is — and the lookup gives you the evidence for this address.

Should I block an entire ASN?

For hosting ASNs with a history of abuse, blocking or hard-challenging can be reasonable because real customers are rarely there. For residential or mobile ASNs, never: raise friction for fresh evidence instead. A network-level rule stays correct far longer than an address-level one, which is exactly why its collateral damage lasts longer too.

How many ASNs are there?

On the order of a hundred thousand are in use worldwide, and IP99's geolocation database attributes IPv4 space to tens of thousands of them. A few hundred carriers and clouds hold most of the addresses; the long tail holds a few segments each.