See which network an address belongs to, who runs it, and how that network compares to every other network in our community data. Free, no account.
ASN and Network Report
An autonomous system is a block of IP addresses run under one routing policy, usually by a hosting company, an internet provider or a large organisation, and identified by an AS number such as AS14061. The reportedIP ASN Report shows how many addresses of that network appear in our community data, what they are reported for and where the network stands among all networks we hold.
How this tool works and its limits
An address is first resolved to the network it belongs to, then the report is built for that whole network: the number of its addresses known to us, the reports they carry together, the average confidence score and the most recent activity. An AS number can be entered directly, with or without the AS prefix.
A raw report count says very little on its own. A large cloud provider produces a big number simply by being large, while a small network with a fraction of that count can be far worse per address. The report therefore places two figures against every other network in the data: how many addresses are known, and how many reports each of them carries. The gap between those two positions is what separates a big provider from a concentrated abuse network.
The report is about the network, never about its individual addresses: no address list is produced here, by design. A single address is looked up on its own page. The threat category breakdown is measured on a sample of the most recent reports of the busiest addresses in the network, because counting every report of a network with hundreds of thousands of them would not finish while you wait; the sample size is stated with the result.
We only see what the community reports. A network that does not appear here has not been reported to us, which is a good sign but not a clean bill of health.
The address is rarely the interesting part
A single address tells you about one machine. The network it sits in tells you about the operator: whether abuse there is an accident or a business model, whether it is a large hoster with a few bad tenants or a small range where almost every address has been reported.
Networks are called autonomous systems and are identified by an AS number. This report takes an address or an AS number and describes the whole network behind it.
Why one number would mislead you
Total reports on their own make every large hosting company look like a criminal enterprise. A provider with a million customers will always collect more reports than a ten-address range, without saying anything about how it is run.
The report therefore compares three things: how many addresses of the network appear in our data, how many reports each of those addresses collects on average, and where the network stands against every other network we know. A wide network with few reports per address looks very different from a small one where every address is reported constantly, and that difference is the actual finding.
Where the numbers come from
The community database behind the ReportedIP API, fed by honeypots and by fail2ban installations reporting attacks as they happen. The same data our API customers query.
The report is aggregated per network. Individual addresses are not listed here; for a single address there is the address lookup instead.