What Is an ASN? A Guide to Internet Infrastructure

A suspicious IP hits your SIEM. You look it up. The IP is clean. You close the alert.

Three weeks later, you're staring at a bulletproof hosting cluster that's been running phishing infrastructure for months, all of it sitting in the same autonomous system you dismissed. The IP was clean. The ASN was not.

That's the gap. And it's why understanding what an ASN is, and what you can actually do with one, matters more than most analysts give it credit for.

What an ASN actually is

An Autonomous System Number is a unique identifier assigned to a network operating under a single administrative and routing policy. Every time your traffic crosses the internet, it passes through a chain of autonomous systems, each advertising its IP prefixes to its neighbours via BGP.

The ASN is the handle that ties all of that together: the IP ranges an organisation controls, the routing decisions it makes, the upstream providers it peers with, and the registration details attached to it in WHOIS.

IANA delegates ASN assignments to the five Regional Internet Registries — ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC , and each registry maintains public WHOIS records for the ASNs it issues.

There are roughly 100,000 active ASNs on the internet at any given time. Most belong to ISPs, cloud providers, and large enterprises. A meaningful subset belong to hosting providers who ask very few questions of their customers.

Why ASNs matter for threat investigations

Individual IPs rotate. Domains expire and re-register. ASNs are stickier. A threat actor can burn through hundreds of IPs and dozens of domains while staying in the same autonomous system for months.

That persistence is the investigative opportunity.

When you pivot from a malicious IP to its ASN, you stop asking "is this one IP bad?" and start asking: who operates this network, what else do they host, and what does the routing history reveal about their infrastructure strategy?

Those are the questions that surface bulletproof hosting operations, fast-flux networks, and adversary staging infrastructure — the kind of findings that isolated signals miss entirely.

The bulletproof hosting signal

Bulletproof hosting (BPH) providers deliberately operate in jurisdictions or under structures that make takedown requests ineffective. They attract criminal tenants by design.

ASN-level signals that indicate BPH activity include:

High prefix churn: the ASN frequently announces and withdraws IP prefixes — a pattern consistent with rotating infrastructure to evade blocklists
Upstream provider instability: the ASN peers with a small number of transit providers known for lax abuse policies, or changes upstream providers frequently
WHOIS registration anomalies: thin or inconsistent registration details, recently created, or registered through privacy proxies in high-risk registries
Concentration of flagged IPs: a disproportionate share of the ASN's IP space appears across threat feeds relative to its total announced prefixes

None of these signals is conclusive on its own. Together, they build a picture. And building that picture requires correlating BGP routing data with WHOIS registration history and threat feed coverage simultaneously — which is exactly where single-signal tools fall short.

As blocklists always lag behind active infrastructure, the ASN-level view gives you structural context that no blocklist can provide.

The BGP layer: routing history as evidence

BGP route announcements are public. Every time an ASN announces or withdraws a prefix, that event is recorded by route collectors. The historical record of those announcements is one of the most underused data sources in threat intelligence.

For a bulletproof hosting investigation, routing history answers questions like:

Has this ASN ever announced IP space that later appeared in threat feeds?
Did this ASN previously peer with another ASN that's already flagged?
When did this prefix first appear, and has it been withdrawn and re-announced in patterns consistent with evasion?

This is where whisper.history() becomes directly useful. It surfaces ASN and IP prefix routing history alongside WHOIS transfer history, so you can trace how infrastructure ownership and routing have changed over time — not just what the current state looks like.

A practical query structure

In Whisper's Cypher-based API, an ASN investigation starts with a simple pivot:

MATCH (ip:IPV4 {name: "<flagged-ip>"})-[:ANNOUNCED_BY]->(:ANNOUNCED_PREFIX)-[:ROUTES]->(asn:ASN) MATCH (asn)-[:ROUTES]->(prefix:ANNOUNCED_PREFIX)<-[:ANNOUNCED_BY]-(related_ip:IPV4) OPTIONAL MATCH (related_ip)-[:LISTED_IN]->(feed:FEED_SOURCE) RETURN asn.name AS asn, prefix.name AS prefix, related_ip.name AS ip, collect(DISTINCT feed.name) AS feeds LIMIT 500

That query takes one IP, walks to its ASN, expands across all announced prefixes, and surfaces every IP in that address space appearing in any of Whisper's 39+ threat feeds. You're no longer investigating one indicator. You're mapping a hosting environment.

From there, you can pivot to WHOIS registration data, passive DNS records, and certificate infrastructure — all within the same graph traversal, without switching tools or stitching API responses together manually.

WHOIS as a corroborating layer

WHOIS data on its own is often thin, especially for ASNs registered through intermediaries or in jurisdictions with minimal registry requirements. But WHOIS history tells a different story.

Changes in registrant name, contact email, or administrative organisation over time can reveal when an ASN changed hands, whether it was acquired as part of a BPH operation, or whether the current registration details are consistent with the routing behaviour you're observing.

whisper.history() surfaces this transfer history directly. Combine it with the BGP routing record and you have a timeline: when the ASN was registered, when it changed ownership, when it started announcing the prefixes you care about, and when those prefixes started appearing in threat feeds.

That timeline is what turns an alert into a finding.

What you can't see from the IP alone

The failure mode in most investigations is stopping at the IP. An IP is a point-in-time indicator. It tells you where traffic went. It doesn't tell you who built the infrastructure, how it connects to other campaigns, or whether the hosting provider has a history of ignoring abuse reports.

The ASN is the organisational unit. It's the level at which infrastructure decisions are made — routing policy, upstream selection, IP space allocation. Investigating at the ASN level means investigating the actor's choices, not just their current deployment.

That shift — from indicator to infrastructure — is what separates reactive alert triage from proactive adversary mapping. Whisper's knowledge graph, spanning 46.5 billion datapoints across DNS, BGP, WHOIS, GeoIP, DNSSEC, and threat feeds, is built specifically for that kind of traversal.

For teams building out their threat intelligence methodology, the research and white papers at whisper.security cover infrastructure investigation techniques in depth.

From ASN to full infrastructure map

A complete BPH investigation typically follows this path:

Start with a flagged IP from an alert or threat feed
Pivot to the ASN and pull all announced prefixes
Cross-reference prefix space against threat feeds to measure concentration of malicious activity
Pull routing history to identify prefix churn and upstream provider changes
Check WHOIS registration history for ownership changes and registration anomalies
Expand to passive DNS to identify domains hosted across the ASN's IP space
Map certificate infrastructure to find shared TLS certificates tying domains together across different IPs

Each step builds on the last. The graph structure makes the relationships explicit rather than requiring you to manually correlate outputs from seven different tools.

FAQs

What is an ASN in simple terms?
An Autonomous System Number is a unique identifier for a network operating under a single routing policy. It groups together all the IP address ranges that a particular organisation controls and announces to the rest of the internet via BGP.

How is an ASN different from an IP address?
An IP address identifies a single device or endpoint. An ASN identifies the network that owns and routes a block of IP addresses. One ASN can control thousands of individual IPs across multiple prefixes.

Why do threat actors use bulletproof hosting ASNs?
Bulletproof hosting providers operate in ways that make abuse complaints and takedown requests ineffective. Threat actors use them because their infrastructure survives longer — even when individual IPs or domains get flagged, the underlying ASN keeps running.

Can an ASN change ownership?
Yes. ASNs can be transferred between organisations, and those transfers are recorded in WHOIS data. Tracking ASN ownership history is an important part of infrastructure investigations — it can reveal when a network was acquired for malicious use.

What does BGP routing history tell you about an ASN?
BGP routing history shows which IP prefixes an ASN has announced over time, how frequently those prefixes have been withdrawn and re-announced, and which upstream providers the ASN has peered with. High prefix churn and unstable upstream relationships are consistent indicators of evasion-oriented hosting.

How do I find all the IPs associated with an ASN?
You query the ASN's announced prefixes via BGP data and enumerate the IP space within those prefixes. In Whisper, a single Cypher query traverses from an IP to its ASN, expands across all announced prefixes, and returns the full IP space — including any threat feed matches.

What's the difference between investigating an IP and investigating an ASN?
Investigating an IP tells you about one indicator at one point in time. Investigating an ASN tells you about the infrastructure environment — who built it, how it's routed, what else it hosts, and whether the hosting provider has a history of enabling abuse. The ASN is the organisational unit; the IP is just one address within it.

Individual indicators rotate. Routing infrastructure doesn't move as fast. Start with the ASN, pull the history, and the picture of how an adversary built their hosting environment comes into focus.

Learn more at whisper.security.