If you do anything with IP addresses, the ASN is one of the most useful fields you're probably ignoring. It answers a deceptively powerful question: who operates the network this IP belongs to?
What is an ASN?
An Autonomous System Number (ASN) identifies an independent network on the internet — an ISP, a hosting provider, or a large organisation that announces its own IP ranges via BGP (the protocol that glues the internet together). Every public IP belongs to exactly one autonomous system at a time, identified by a number like AS16509 with an organisation name like "Amazon.com, Inc."
Think of the IP as a street address and the ASN as the city authority that owns the roads.
Looking one up
GeoQ returns the ASN and AS org on every /v1/check call:
$ curl "https://api.geoq.io/v1/check?ip=52.94.236.248" \ -H "Authorization: Bearer $GEOQ_API_KEY"
The relevant slice of the response:
{
"network": { "asn": 16509, "as_org": "Amazon.com, Inc." },
"signals": { "is_datacenter": true, "datacenter_provider": "aws" }
} You can also use the free ASN lookup tool to resolve any IP interactively.
Why the ASN matters for fraud
The AS organisation instantly buckets an IP:
- Residential ISP (Comcast, BT, Deutsche Telekom…) — most likely a real consumer.
- Cloud / hosting (AWS AS16509, Google AS15169, OVH, Hetzner…) — a server, not a person browsing from their sofa. A "user" signing up from AWS deserves a second look.
- Mobile carrier — shared, fast-rotating IPs; be careful with hard blocks.
- Networks with a reputation for abuse — useful to weight more heavily.
Because cloud providers publish their ranges, datacenter detection by ASN is close to deterministic — which is why is_datacenter carries a solid +35 in the risk score.
Using it in code
You can keep a small allow/deny list of ASNs for context, but in practice you rarely need to — is_datacenter already covers the major hosts. A belt-and-braces check:
// Treat well-known hosting ASNs as elevated risk for 'consumer' actions
const HOSTING_ASNS = new Set([16509, 14618, 8075, 15169, 396982]);
function looksLikeServer(r) {
return r.signals.is_datacenter || HOSTING_ASNS.has(r.network.asn);
} An honest caveat
ASN is context, not a verdict. Carrier-grade NAT, corporate VPNs and cloud-hosted privacy tools all blur the lines. Use the ASN to inform a risk score, not to make a sole-basis decision about a person.
Go deeper
Read residential vs datacenter proxies, explore the datacenter detection API, or get a free API key.