An IP address by itself is almost meaningless for fraud. What matters is who owns it and where the network claims it sits. Both come from the same lookup layer: the autonomous system number that identifies the routing network, and the geolocation databases that map ranges to places. Used well, these turn a raw IP into context about whether the traffic is a home broadband user in Ohio or a virtual machine in a Frankfurt datacenter.
Used badly, they generate false positives and a false sense of precision. This article explains what ASN and geolocation actually tell you, where each fails, and how to combine them with device signals so the network layer strengthens your risk decisions instead of muddying them.
What an ASN reveals
Every routable IP belongs to an autonomous system, identified by an ASN, that a single organization controls. The ASN is often more informative than the IP because it classifies the network’s purpose.
- Consumer ISPs. Residential broadband and mobile carriers. Normal for most human traffic.
- Hosting and cloud providers. AWS, GCP, and similar. A consumer-facing login from a cloud ASN is a strong anomaly, which is the basis of datacenter IP detection.
- VPN and proxy operators. Networks whose business is masking origin, feeding VPN detection and proxy detection.
- Corporate and education. Legitimate but concentrated, so many users share one egress.
The ASN is stable and hard to spoof at the network layer, because it is derived from the routing tables that actually deliver packets. That makes it more trustworthy than a user agent or a claimed timezone, and it is a core input to IP reputation.
Where geolocation is strong and where it lies
IP geolocation maps an address to a place using databases built from registry data, latency measurements, and ISP disclosures. Its accuracy is wildly uneven.
| Granularity | Reliability | Use for fraud |
|---|---|---|
| Country | High | Sanction screening, coarse geo rules |
| Region/state | Moderate | Weak corroboration only |
| City | Low, often wrong by 100+ km | Never as a precise claim |
| Exact coordinates | Effectively fictional | Do not use |
The most common mistake is treating a city-level result as ground truth. Databases frequently place an entire ISP’s pool at the provider’s registered headquarters, so thousands of users appear to live at one address. Free databases like MaxMind GeoLite2 are excellent for country resolution and unreliable below it. The practical rule: use geolocation for country-level decisions and for detecting large, impossible jumps, never for pinning a user to a neighborhood.
Combining ASN and geo into a signal
The two are far stronger together than apart. A few patterns carry real weight.
# Mismatch between claimed and network context
device_timezone = "America/New_York"
ip_country = "DE"
asn_type = "hosting"
-> strong anomaly: cloud origin + geo/timezone mismatch
# Impossible travel across sessions
login_1: country=US, t=10:00
login_2: country=SG, t=10:25
-> physically impossible; see impossible-travel-detection
Timezone-versus-geo mismatches, a hosting ASN on a consumer surface, and impossible travel between consecutive sessions are the highest-value derived signals. Impossible travel detection depends directly on geolocation, which is why coarse-but-reliable country data matters more than precise-but-wrong city data. The direction of the ASN and geo signals also matters for IP geolocation spoofing, where a fraudster’s proxy exit and their device’s real timezone disagree.
Handling the false-positive traps
ASN and geo generate false positives if you treat them as verdicts. Several legitimate cases look suspicious at the network layer.
- Corporate VPNs. Real employees egress through a datacenter or a single foreign office. A hosting ASN is not proof of fraud.
- Carrier-grade NAT. Mobile carriers put thousands of users behind one IP, so IP-based velocity over-counts.
- Travelers and expats. Legitimate country changes happen. Impossible travel is about speed, not distance.
- Privacy-conscious users. Plenty of honest users run a VPN by default.
The correct posture is to weight these signals into a combined score with reasons, never to block on ASN or geo alone. A hosting ASN plus automation tells plus device spoofing is fraud. A hosting ASN by itself is often a remote worker. Emitting reason codes lets a reviewer distinguish the two.
Anchoring network signals to a device
Network signals rotate. Fraudsters change IPs, cycle proxies, and hop ASNs specifically to defeat IP-based rules. The durable anchor is the device. When you tie ASN and geolocation to a stable device fingerprint, a fraudster switching networks still resolves to the same visitor ID, and the network changes themselves become a signal.
- A single device seen across ten ASNs in an hour is proxy rotation.
- A device whose IP country flips repeatedly while its timezone stays fixed is masking origin.
- A trusted device on a new ASN is likely a real user traveling, not an attacker.
Prynt combines ASN classification, geolocation, and IP reputation with a sealed device result so network context and device identity reinforce each other. See the Smart Signals in the playground and the network guidance in the docs.
Frequently asked questions
What is an ASN and why does it matter for fraud?
An ASN is the identifier of the network that owns and routes an IP range. It tells you whether traffic comes from a consumer ISP, a hosting provider, or a mobile carrier, which is often more revealing than the IP itself.
How accurate is IP geolocation?
Country-level accuracy is high, but city-level accuracy is unreliable and can be off by hundreds of kilometers. Treat geolocation as a coarse signal and never as a precise location.
ASN and geolocation turn a bare IP into network context: who routes it, what the network is for, and roughly where it sits. Lean on ASN classification and country-level geo, distrust city precision, and always anchor the network layer to a stable device so rotation becomes evidence rather than an escape. Combined this way, the network signal is one of the cheapest and most durable inputs to a fraud decision.
Run it yourself
Prynt is open-source, self-hostable device intelligence — visitor IDs, bot & fraud Smart Signals, and behavioral biometrics you own end to end.