Classify an IP by ASN Type: Hosting, Business, ISP

An IP address does not tell you what kind of network it belongs to. The autonomous system behind it does. Every routable IP sits inside an ASN, and that ASN has a type: hosting, business, education, government, or a consumer ISP. One lookup returns it, and that single field sorts almost any address into datacenter traffic, an organization, or a real person on a home connection.

Almost. There are a few cases where ASN type alone points you toward the wrong conclusion, including one that matters particularly for fraud and abuse work. We'll get to them.

TL;DR

• Every public IP belongs to an ASN, and the ASN carries a type field: ISP, HOSTING, BUSINESS, EDUCATION, or GOVERNMENT.
• HOSTING means a datacenter or cloud provider. ISP means a consumer access network. BUSINESS, EDUCATION, and GOVERNMENT are organizations on their own address space.
• A single call to the dedicated ASN endpoint returns the type and can also include routing data such as routes, upstreams, downstreams, and peers for additional context.
• The type describes the network operator. When a business runs on rented cloud space, the operator is a hosting company but the tenant is a business. Reading only the ASN type mislabels them.

The rest of this is the matrix, a classifier you can paste in, and the four places the type field stops being enough.

The ASN-type classification matrix

Here is the whole idea in one table. Look up the ASN for an address, read type, map it to a bucket.

asn.type	What it is	Example ASN	Treat traffic as
HOSTING	Cloud/datacenter provider. Servers live here.	AS24940 (Hetzner)	Datacenter. Bots, scrapers, and VPN exits cluster here.
ISP	Primarily an end-user access network, including fixed-line and mobile ISP space.	AS1257 (Tele2)	Consumer/access network. Lower baseline infrastructure suspicion, but not proof of a human user.
BUSINESS	A company operating its own address space.	AS1 (Level 3)	Organization. Office egress, corporate VPNs, SaaS backends.
EDUCATION	Universities and research networks.	AS12 (New York University)	Organization. Campus and lab traffic.
GOVERNMENT	Public-sector networks.	(varies by RIR)	Organization.

The three buckets developers usually care about, hosting, business, and consumer, come straight out of this. HOSTING is your datacenter bucket. ISP is your consumer bucket. BUSINESS, EDUCATION, and GOVERNMENT are three flavors of the same "this is an organization, not a home user and not a rented server" bucket, and you can collapse them if your logic doesn't need the distinction.

What makes this reliable is that ASN type is a property of the network operator, not a guess from the IP number. You cannot look at 49.12.0.0 and know it's a datacenter. You look up its ASN, see AS24940 Hetzner tagged HOSTING, and now you know.

One ASN lookup, one classification

The ASN type field is available on the dedicated ASN endpoint and in the main geolocation response. The dedicated ASN API is the cleaner choice when classification is all you want, because it returns the ASN record and nothing else, and it takes either an IP or an AS number.

The response and the type field

A lookup by IP returns the ASN that announces it:

curl -X GET 'https://api.ipgeolocation.io/v3/asn?apiKey=API_KEY&ip=49.12.0.0'

{
  "ip": "49.12.0.0",
  "asn": {
    "as_number": "AS24940",
    "organization": "Hetzner Online GmbH",
    "country": "DE",
    "type": "HOSTING",
    "domain": "hetzner.com",
    "date_allocated": "2002-06-03",
    "asn_name": "HETZNER-AS",
    "allocation_status": "ASSIGNED",
    "num_of_ipv4_routes": "84",
    "num_of_ipv6_routes": "6",
    "rir": "RIPE"
  }
}

type is HOSTING, so 49.12.0.0 is datacenter space. The type field requires a paid plan; the free tier returns the AS number, organization, and country but not the classification. Everything else in this guide keys off type, so that's the field to check your plan for.

Lookup by IP or by AS number

You can classify a single address, or a whole network. Passing an AS number instead of an IP skips the IP-to-ASN step and returns the same record:

curl -X GET 'https://api.ipgeolocation.io/v3/asn?apiKey=API_KEY&asn=1'

That returns AS1 (Level 3) as BUSINESS. This is useful when you already have the ASN from your logs or your CDN and just want its classification, or when you're building a static allowlist of, say, every ASN a partner operates. When you look up by asn, the response drops the top-level ip field, since there's no single address to report.

A classifier you can copy

Here's the logic wrapped so it returns a bucket and never throws on a bad response.

import os
import requests

IPGEO_API_KEY = os.environ.get("IPGEO_API_KEY")

# ASN type values that mean "an organization runs this," not a home user
# and not a rented server. Collapse them if your logic doesn't need the split.
ORG_TYPES = {"BUSINESS", "EDUCATION", "GOVERNMENT"}


def classify_ip(ip):
    """Return 'hosting', 'consumer', 'organization', or 'unknown' for an IP.

    Never raises on a network or parse error; callers get 'unknown' and can
    decide their own fallback (fail-open vs fail-closed) from there.
    """
    try:
        resp = requests.get(
            "https://api.ipgeolocation.io/v3/asn",
            params={"apiKey": IPGEO_API_KEY, "ip": ip},
            # Short timeouts: a classification call should never hang a request path.
            timeout=(1.0, 1.5),
        )
        resp.raise_for_status()
    except requests.RequestException as exc:
        # Log and fall back. Don't let an IP lookup take down the caller.
        print(f"ASN lookup failed for {ip}: {exc}")
        return "unknown"

    # .get() the whole way down: any field can be absent or empty.
    try:
        data = resp.json()
    except ValueError as exc:
        print(f"Invalid ASN response for {ip}: {exc}")
        return "unknown"

    asn_type = (data.get("asn") or {}).get("type") or ""

    if asn_type == "HOSTING":
        return "hosting"
    if asn_type == "ISP":
        return "consumer"
    if asn_type in ORG_TYPES:
        return "organization"
    return "unknown"  # empty type, unrecognized value, or bogon range


if __name__ == "__main__":
    for ip in ("49.12.0.0", "8.8.8.8", "91.128.103.196"):
        print(ip, "->", classify_ip(ip))

Two decisions worth calling out. The timeout is deliberately tight because an ASN lookup usually sits on a request path (a signup, a login, a checkout), and a slow classifier is worse than no classifier. And an empty or unrecognized type returns unknown rather than a guess, so your downstream rules can treat "we don't know" differently from "we know it's a home user."

The same shape in JavaScript, using fetch with an abort timeout:

const IPGEO_API_KEY = process.env.IPGEO_API_KEY;

// Organization ASN types, kept separate from hosting and consumer.
const ORG_TYPES = new Set(["BUSINESS", "EDUCATION", "GOVERNMENT"]);

async function classifyIp(ip) {
  const url =
    `https://api.ipgeolocation.io/v3/asn` +
    `?apiKey=${IPGEO_API_KEY}&ip=${encodeURIComponent(ip)}`;

  try {
    const resp = await fetch(url, {
      // Abort before this ever stalls a login or checkout flow.
      signal: AbortSignal.timeout(1500),
    });
    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);

    const data = await resp.json();
    // Optional chaining the whole way: asn or type may be missing.
    const asnType = data?.asn?.type ?? "";

    if (asnType === "HOSTING") return "hosting";
    if (asnType === "ISP") return "consumer";
    if (ORG_TYPES.has(asnType)) return "organization";
    return "unknown";
  } catch (err) {
    // Network error, timeout, or bad JSON: fall back, don't throw.
    console.error(`ASN lookup failed for ${ip}: ${err.message}`);
    return "unknown";
  }
}

Both return one of four strings. What you do with them is your policy, not the classifier's job: most teams pass consumer, add friction to hosting, and treat organization as low-risk-but-log. The point is that the branching lives in one place, keyed on one field.

One operational note: If your logs or edge provider already give you the ASN, cache classification by AS number. If all you have is an IP, you still need an IP-to-ASN mapping first, so in a higher-volume implementation cache both the IP/prefix-to-ASN mapping and the ASN-to-type classification.

When ASN type is not enough

The matrix handles the large majority of addresses. Then there are four cases where reading type alone can give you an incomplete or misleading answer. These are the parts most guides skip, and they're the reason the classification isn't a one-liner.

Subleased cloud: the operator is hosting, the tenant is a business

This is the important one. A company rents servers or address space from a cloud provider and runs its own service on it. The ASN belongs to the hosting company, so asn.type reads HOSTING, but the actual occupant is a business. If you classify on ASN type alone, you file a legitimate company under "datacenter" and treat its traffic as suspect.

This is exactly why the company object in the main geolocation response is worth pulling alongside the ASN. The company object can identify a more specific organization associated with the IP range than the ASN operator, and it carries its own type. Look at 2.56.188.34:

curl -X GET 'https://api.ipgeolocation.io/v3/ipgeo?apiKey=API_KEY&ip=2.56.188.34'

{
  "asn": {
    "as_number": "AS62240",
    "organization": "Clouvider Limited",
    "type": "HOSTING",
    "domain": "clouvider.net"
  },
  "company": {
    "name": "Packethub S.A.",
    "type": "BUSINESS",
    "domain": "packethub.com"
  }
}

The ASN registrant is Clouvider, a hosting provider, tagged HOSTING. The company mapped to this address is Packethub, tagged BUSINESS. Same IP, two different answers, and the company result gives you more specific context for "who is associated with this IP". When company.type and asn.type differ, the company field can give you useful context about who is associated with that particular address range, while the ASN still tells you about the underlying network. Reading both, and knowing which to trust when they split, is the difference between a classifier that works on cloud-hosted businesses and one that flags every startup running on a VPS.

Corporate VPN: hosting-looking, entirely legitimate

An employee connecting through their company's VPN often egresses from a datacenter or a business ASN, not from their home ISP. The ASN type will say HOSTING or BUSINESS, and both are technically correct: the traffic really is leaving a server. But the human behind it is a legitimate employee, not a bot. If your rules hard-block hosting IPs, you've just locked out everyone on the corporate VPN. Weight the ASN type against account history and behavior rather than blocking on it outright.

Residential proxy: the one that reads consumer and isn't

Here is the case that runs opposite to the subleased-cloud one. A residential proxy routes traffic through a real home connection, so the exit IP sits on a consumer ISP and asn.type reads ISP. Everything about the network says "home user." But the traffic is being relayed on behalf of someone else, often a scraper or a fraud operation renting access to that household's connection. ASN type cannot see this, because at the network layer it genuinely is a consumer ISP. Catching it needs a dedicated signal: if you also run the security module, the is_residential_proxy flag is what flips an ISP-typed address from "trust" to "inspect." Without that flag, a residential proxy is invisible to ASN-type classification, which is worth knowing before you lean on the consumer bucket for anything security-sensitive.

CDN and anycast: the ASN bucket needs more context

Some addresses aren't a datacenter, a business, or a home. They're anycast IPs announced from many locations at once, fronting a CDN or a large platform. Akamai, Cloudflare, and the big content networks fall here. The ASN type may say HOSTING or BUSINESS, but treating the address as either misses that it's infrastructure serving content, not an origin you can reason about as a single user or server.

Treat is_anycast as an additional flag, not another ASN bucket. The ASN type can still describe the operator, but an anycast IP should not be interpreted as one physical server or one geographic origin because the same address may be served from multiple locations.

Corroborating with ASN topology

The ASN endpoint returns more than a label. Pass include=peers,downstreams,upstreams,routes,whois_response and you get the network's routing shape, which is a useful sanity check when a type value surprises you.

curl -X GET 'https://api.ipgeolocation.io/v3/asn?apiKey=API_KEY&asn=12&include=upstreams,downstreams,routes'

For AS12 (NYU, EDUCATION) the response includes its announced routes, its upstreams (transit providers like GTT and Zayo), and its downstreams (customer networks like NYU Langone Health). The signals that corroborate a type:

• Downstreams. An ASN with customer networks hanging off it is transit or a large operator, not a home connection.
• Upstreams. Who an ASN buys connectivity from tells you where it sits in the hierarchy.

You don't need this for routine classification, and pulling it on every request is wasteful. It earns its place when you're building the allowlist, auditing a surprising result, or investigating a specific ASN by hand. The raw whois_response is there too, but treat it as a last resort: it's an unstructured text blob meant for human reading, not something to parse in code. For routine classification, the structured fields are easier to work with. Keep whois_response for deeper registration details or manual investigation.

A few extra notes that don't need their own sections. IPv6 uses the same workflow: resolve the IPv6 address to its origin ASN, then classify that ASN in the same way. Bogon and private ranges have no public ASN, so a lookup on 10.0.0.0 or a documentation range returns an error rather than a type, which is why the classifier treats anything without a clean type as unknown. And the ASN type is stable over days and weeks, not seconds, so caching aggressively by AS number is safe.

Where this leaves you

Classification by ASN type is one field and one lookup for the common case, and a second field, company.type, for the case where a business runs on rented infrastructure. Wire the classifier onto the paths where the answer changes what you do, signup, login, checkout, and cache by AS number when you already have the ASN, or cache both IP-to-ASN and ASN-to-type mappings at higher volume. Keep the four edge cases in mind before you turn a bucket into a hard block: a hosting label can be a corporate VPN, a consumer label can be a residential proxy, and an anycast address isn't really any of the three. The type tells you what the network is. What you do with that is your call to make, and it should almost always be scoring, not blocking.