What Is an ASN?

An ASN (Autonomous System Number) identifies the network operator that announces a block of IP addresses on the public internet. Advertisers use ASN data to tell everyday consumer and mobile networks apart from datacenter and hosting ranges that often carry bot traffic and invalid clicks.

An autonomous system is a network, or a group of networks, run under one routing policy. It speaks BGP with other networks so traffic can find a path across the internet. The ASN is the number other routers use to recognize that operator. When you look up an IP, you often see something like “AS15169 Google” or “AS7922 Comcast.” That label is the ASN and the organization behind it.

How ASNs work

Large providers, hosting companies, enterprises, and universities obtain an ASN from a regional internet registry such as ARIN, RIPE, or APNIC. They announce IP prefixes to peers and upstreams with BGP. Each announcement is tied to an ASN so the rest of the internet can build a global routing map. For a policy overview, see ARIN’s ASN guide.

Public ASNs appear in global routing tables. Private ASNs exist for special internal cases and are not meant for the public internet. ASNs do not replace IP addresses. They group many prefixes under one operator. Two servers in the same datacenter may share one ASN; a phone on a carrier network maps to a different ASN entirely.

That grouping is why fraud tools care. Checking one IP at a time does not scale when an attacker rotates thousands of addresses inside the same hosting ASN. Grouping by ASN shows whether the volume is coming from a consumer ISP, a mobile carrier, a cloud host, or a VPN exit network.

ASN versus IP address

An IP address points to a host or endpoint. An ASN points to the organization that announces the prefixes containing those IPs. You can change IPs inside an ASN all day and still leave the same operator fingerprint. Attackers who buy cheap cloud VMs or residential proxy access are still exiting through some ASN; they shift the pattern rather than erase it.

Most websites never need their own ASN. They sit on a host or CDN that uses the provider’s ASN. Advertisers almost never operate an ASN either. The value is on the buy side: reading ASN context on the clicks you already pay for.

Why ASN data matters for click fraud

Fraud detection treats ASN as a reputation and context signal. Datacenter and bulletproof-host ASNs behave differently from residential or mobile carrier ASNs. A burst of ad clicks from many IPs inside a small set of ASNs can indicate automation, purchased traffic, or a bot farm that only rotated addresses inside one provider.

ASN alone must not block a whole consumer ISP. Real customers share carrier and broadband networks. Strong stacks combine ASN with velocity, device consistency, and conversion quality: the same layered approach described in how we detect fraud. That is how you score suspicious clicks without punishing ordinary mobile users.

In practice, filter or group campaign traffic by ASN when CTR rises and revenue does not. Compare converting ASN mixes with non-converting ones. If “high intent” geos are dominated by unfamiliar hosting ASNs, dig into session behavior before you raise bids. Those patterns show up across click fraud and wider ad fraud.

How teams use ASN day to day

Keep a short mental model: IP is the endpoint, ASN is the operator, ISP is often the consumer label for that operator. Use ASN to ask whether traffic looks like eyeball networks or rented infrastructure. Then decide with behavior, not with a single field.

When residential-proxy abuse is in play, ASN distribution can look more “consumer” than it used to. That is why modern defense does not stop at network class. ASN still speeds up triage: it tells you where to look first when invalid traffic starts burning budget.