ASN and IP Ranges

A large organization doesn’t have one IP: it has ranges of IPs, and sometimes its own ASN (Autonomous System Number), the identifier of a network on the Internet. Discovering which ranges and ASN the target owns hugely expands the surface: you go from “this domain” to “all the infrastructure this company controls,” including hosts with no DNS name but with exposed services.

What an ASN is

An ASN groups the IP blocks an entity advertises over BGP (Internet routing). ISPs and large companies have their own ASNs; an SMB usually uses its cloud/hosting provider’s. From the ASN you get all the ranges that entity owns.

Discover the ASN and ranges

# from domain/IP to ASN and range
whois 1.2.3.4                     # organization, range, ASN
# ASN tools
amass intel -asn <ASN>            # domains in an ASN
asnmap -d target.com              # the domain's ASN and ranges (projectdiscovery)
# web services
bgp.he.net (Hurricane Electric)   search the org -> see its ASNs and prefixes
ipinfo.io/AS<ASN>                 ranges and details
# from the org to its ranges
whois -h whois.radb.net '!g<AS_NUMBER>'   # advertised prefixes

From ranges to live targets

Once you have the ranges (CIDR), you discover what’s alive —preferably passively first:

# passive: what services are in the range (Shodan/Censys)
# Shodan:  net:1.2.3.0/24
# active (with scope): discovery and scanning (see recon-activo)
nmap -sn 1.2.3.0/24                # live hosts
masscan 1.2.3.0/24 -p80,443,22,3389 --rate 5000
# reverse DNS of the range (host names)
for ip in 1.2.3.{1..254}; do dig +short -x $ip; done

Why it matters

Hosts with no DNS name: services exposed on IPs that don’t appear in subdomains.
Real IP behind the CDN: if the origin is in the org’s same ASN/range, you find it bypassing Cloudflare (see Shodan and Device Search Engines, WAF Bypass).
Acquisitions and forgotten infra: ranges of acquired companies, old data centers.
Delimit the real scope: in a pentest/bug bounty, knowing which IPs truly belong to the target.

Mind the scope

An ASN may include customer IPs, shared hosting, or out-of-scope addresses. Verify ownership before scanning: attacking an IP that isn’t the target’s (even if in “its” nominal range) can be illegal and out of scope.

For the defense

Know your own surface: inventory your ASNs/ranges, be aware of what you expose on IPs without DNS, protect the origin behind the CDN (so it isn’t reachable by its IP), and monitor your prefixes. An ASM (Attack Surface Management) does exactly this from the defensive side.

BGP: how ranges are announced

The Internet routes via BGP: each ASN announces the prefixes (CIDR blocks) it controls, and other routers learn “to reach 1.2.3.0/24, go via AS X”. That information is public, and it’s what you exploit in recon:

# see the prefixes an ASN announces
whois -h whois.radb.net '!gAS<NUM>'        # route objects of the AS
# from a prefix to its origin ASN and organization
whois -h whois.cymru.com ' -v 1.2.3.4'
# BGP viewer with history and relationships (upstreams/peers)
bgp.he.net -> search the org or the ASN

A prefix is sometimes sub-delegated in smaller blocks to customers: that’s why a nominal ASN range may not be the target’s. Always verify ownership (the whois inetnum/org object) before scanning.

Cloud: own ASN vs provider’s

Org with own ASN       owns its ranges -> the ASN gives you ALL its infra directly
Org in cloud (common)  its assets live in AWS/Azure/GCP ranges (provider's ASN)
                       -> do NOT scan "the AWS ASN": it's millions of other customers' IPs
                       -> here recon goes through DNS/subdomains/CT, not the ASN

Rule of thumb: the ASN is gold when the target has its own network (banks, telcos, large corps); in a cloud SME, focus on DNS and the asset inventory, not the provider’s range.

Testing checklist

whois of the domain/IP → organization and ASN
The target’s ASN and prefixes (asnmap/bgp.he.net/amass intel)
CIDR ranges collected
Passive discovery in the ranges (Shodan net:)
Reverse DNS of the ranges (host names)
Real IP behind CDN searched in the owned ranges
Ownership of each IP verified before scanning
Hosts without DNS but with services noted