# What Is an Autonomous System (ASN)?

> An Autonomous System is a network — or group of IP prefixes — operated by a single organization with one consistent routing policy. Each AS is identified by a unique Autonomous System Number (ASN) assigned by a Regional Internet Registry, and uses BGP to exchange routes with other ASNs.

*Source: https://www.whisper.security/glossary/autonomous-system*
*Published: 2026-05-05*
*Last updated: 2026-05-05*

---

## How ASNs Are Allocated

ASNs are issued by the five Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) to network operators — ISPs, hosting providers, large enterprises, content networks. There are two flavors:

- **16-bit ASNs** (1 – 65535) — the original numbering space; mostly exhausted.
- **32-bit ASNs** (65536+) — the modern allocation space.
- **Private ASNs** (64512 – 65534, 4200000000 – 4294967294) — used inside organizations and never appear on the public internet.

## Why ASNs Matter for Security

Every public IP belongs to an ASN. That single piece of context tells you a lot:

- **Ownership** — who runs the network the IP sits on.
- **Reputation** — some ASNs host overwhelmingly legitimate traffic; others are repeat offenders.
- **Geography and jurisdiction** — useful for compliance, takedowns, and threat attribution.
- **Routing behavior** — withdrawals, hijacks, and unusual peer changes are visible at the ASN level.

## Bulletproof and Abuse-Tolerant ASNs

Some ASNs are well-known for hosting phishing kits, command-and-control servers, malware, or content that gets quickly removed elsewhere. Mapping which ASNs concentrate abuse — and how aggressively they take it down — is a foundational piece of threat-intelligence work.

## BGP and ASN Relationships

[BGP](/glossary/bgp-routing) is how ASNs talk to each other. Each ASN announces the IP prefixes it routes; peers and transit providers propagate those announcements. The relationships between ASNs (peer, customer, provider) are usually inferred from observed routing data — they are rarely published directly.

## ASNs in Whisper

[Whisper](https://www.whisper.security) treats **IPV4**, **IPV6**, **CIDR**, and **ASN** as first-class data types. Range queries, containment checks, and ASN traversals are instant. Analysts pivot from a single suspicious IP to the full ASN, the prefixes it announces, the upstream peers, and the historical routing changes — without writing joins by hand.

## See it in practice

Run it live in these use cases: [Spot BGP hijacks & route anomalies](/products/intelligence/use-cases/network-routing/route-health).

## Where this shows up

See it in a live investigation: [Map an org’s infrastructure concentration risk](/products/intelligence/use-cases/infrastructure-supply-chain/supply-chain), [Find the real infrastructure behind the CDN](/products/intelligence/use-cases/infrastructure-supply-chain/infrastructure-mapping), [Enrich an ASN — routing, RPKI & physical footprint](/products/intelligence/use-cases/network-routing/route-health).

Go hands-on with [the compliance recipes](/docs/recipes/third-party-posture), [the recon recipes](/docs/recipes/pentest-recon) and [the BGP & routing recipes](/docs/recipes/bgp-routing).

## Related Terms

- [Bgp Routing](https://www.whisper.security/glossary/bgp-routing.md)
- [Infrastructure Intelligence](https://www.whisper.security/glossary/infrastructure-intelligence.md)
- [Whois](https://www.whisper.security/glossary/whois.md)