IP & ASN lookup
Who owns this address?

What an ASN is

The internet is a network of networks. Each independently run network, whether an ISP, a hosting provider, a cloud, a CDN, a university or a large company, is an autonomous system with its own number, assigned by a regional internet registry (RIPE NCC for Europe, ARIN for North America, APNIC, LACNIC and AFRINIC elsewhere). Autonomous systems announce the address blocks they operate to each other over BGP, and that is how traffic finds its way to an address.

The AS organisation is therefore the operator of the network, not necessarily the owner of a website. An address in AS16509 (Amazon) or AS24940 (Hetzner) belongs to a server rented from that provider; an address in AS13335 (Cloudflare) is usually a proxy in front of someone else's site. To find who runs a service you need the hosting customer, which only the provider knows. For abuse reports, the network's abuse contact in the registry database is the right address.

The network prefix

The prefix, such as 8.8.8.0/24, is the block of addresses the data source groups the address into. It usually matches a route the AS announces, though it can be more specific. Prefixes help when you write firewall rules or rate limits for a whole network instead of single addresses, or when you want to see whether two addresses sit in the same block.

How accurate is IP geolocation?

Country data is right most of the time for fixed broadband and data centre addresses, and it is the only level this tool shows. City-level guesses are often off by tens or hundreds of kilometres, which is why they are left out. Location is wrong or meaningless in several common cases:

• VPNs, proxies and privacy relays: you see the exit node, not the user.
• Mobile networks: many carriers route all subscribers through a few central gateways.
• Anycast networks: the same address answers in dozens of countries at once (see what anycast is), so the registered country is the useful field.
• Recently moved address blocks: databases catch up over days or weeks.

Why your address may look unexpected

If your connection supports IPv6, browsers prefer it, so your own address may appear as a long IPv6 address rather than the IPv4 address your router shows. Both are yours. An address from 100.64.0.0/10 on your router means your provider uses carrier-grade NAT and shares one public IPv4 address between many customers, which also explains why inbound connections such as port forwarding do not work.

In offices and on public Wi-Fi, everyone behind the same router shares one public address. That matters for security tools: blocking one address can block a whole office, and a single address sending a lot of traffic is not always a single person.

Using IP and ASN data for security

ASN data is a good first signal when you investigate traffic: requests from residential ISPs, from cloud providers and from known proxy networks behave differently, and attack traffic from rented servers often concentrates in a handful of hosting ASNs. It is a poor signal on its own. Blocking whole networks or countries also blocks real visitors, and botnets increasingly use residential addresses. Treat the network as one input next to behaviour, and prefer rate limits and challenges to permanent blocks.