ASN vs. ISP Blocking on Shopify: What's the Difference

If you have spent any time reading fraud-prevention documentation, you have run into two terms that seem interchangeable but are not: ASN and ISP. Both describe "where traffic comes from" at the network level, and both can be used to block abuse on Shopify. But they operate at different layers, and knowing the difference lets you block precisely instead of bluntly. This is a fundamentals piece — by the end you'll know exactly which lever to pull.

What is an ISP?

An Internet Service Provider is the company that sells you internet access. Comcast, Vodafone, Deutsche Telekom, Orange — these are ISPs. When your customer connects from home, their traffic carries the identity of their ISP. It is a consumer-facing, brand-level label. Most people can name their own ISP.

ISP data is what geolocation databases surface most prominently, and it maps roughly to "who the human's internet provider is." Useful, human-readable, but coarse.

What is an ASN?

An Autonomous System Number is a unique identifier for a network — a collection of IP ranges under a single administrative and routing policy. Every network that participates in internet routing (BGP) has an ASN. It is the internet's plumbing-level identity.

Here is the key insight: an ASN is more precise and more structural than an ISP name. One large ISP might operate several ASNs (one for residential, one for business, one for mobile). Conversely, a single ASN belongs to exactly one organization's network. Data centers, hosting companies, VPN providers, and cloud platforms all have their own ASNs — and these are frequently distinct from any consumer ISP.

• ISP: a marketing/brand label for who provides access. Human-friendly, fuzzy.
• ASN: a routing-level identifier for a specific network. Precise, technical.

Think of it this way. "ISP" is like knowing someone banks with a big national bank. "ASN" is like knowing the exact branch and account type. When you're chasing fraud, the branch-level detail matters.

Why the distinction matters for blocking

The reason this isn't academic: abuse concentrates in specific ASNs, not in consumer ISP names.

When a fraud ring or bot operation runs at scale, it does not sign up for home broadband. It rents infrastructure — servers in data centers, VPN exit nodes, proxy networks. Each of those services has its own ASN. So the cleanest way to block automated abuse is often to block the *offending ASN* while leaving legitimate consumer ISPs untouched.

Signals. A few real-world ASN patterns that correlate with abuse:

• Hosting/cloud ASNs. Networks belonging to server-rental companies. Real shoppers almost never browse from a data center; bots almost always do.
• VPN and proxy ASNs. Commercial anonymization services operate identifiable ASNs. High-fraud traffic clusters here.
• Bulletproof-hosting ASNs. A small number of networks are notorious for hosting abuse and ignoring takedown requests. These are prime block candidates.

If you tried to express these blocks in ISP terms, you'd struggle — many of these networks don't map to a consumer-recognizable "ISP" at all. The ASN is the natural unit.

When to use ISP blocking

ISP-level blocking still has its place. Reach for it when:

• A specific consumer provider is the problem. Occasionally a regional ISP in a high-fraud area generates disproportionate chargebacks. Blocking the ISP is a broad but sometimes justified move.
• You want human-readable rules. ISP names are easier for a non-technical team to reason about and audit than numeric ASN identifiers.
• The abuse tracks a brand, not a network segment. If everything bad shares one ISP identity regardless of ASN, block at that level.

The caveat: ISP blocking is a wide net. A consumer ISP can serve millions of legitimate customers, so blocking the whole thing risks heavy collateral damage. Use it sparingly and prefer to narrow with additional signals.

When to use ASN blocking

ASN blocking is the sharper instrument. Reach for it when:

• The abuse rides hosting or cloud infrastructure. Blocking a data-center ASN stops bots without touching a single residential shopper.
• A VPN/proxy network is being abused. Target its ASN directly.
• You need surgical precision. ASN blocking lets you excise one problem network while leaving the rest of the internet — including the consumer ISPs that share overlapping geography — fully served.

For most Shopify fraud problems, ASN blocking is what you actually want. The abuse lives in infrastructure networks, and the ASN is the label that isolates them.

Setting it up on Shopify

Shopify's native tools don't expose ASN or ISP filtering — this is network intelligence that requires a dedicated fraud layer.

Best control. Shieldy — Fraud Filter enriches every checkout with network data, including the connecting ASN and ISP, and enforces rules through Shopify Functions before payment is captured. A practical configuration:

1. Enable network enrichment so each order shows its ASN and ISP.
2. Review your recent fraudulent and blocked orders — look for a small set of ASNs that recur.
3. Add block rules for the offending ASNs (typically hosting, VPN, and proxy networks).
4. Reserve ISP-level blocks for the rare case where a specific consumer provider is genuinely the source.

Because enforcement happens server-side in a Shopify Function, a bot connecting from a blocked ASN never reaches a payable checkout.

A layered approach beats either alone

Neither ASN nor ISP blocking should be your only defense. The strongest setups treat them as inputs to a broader risk picture:

• Combine ASN reputation with VPN/proxy/Tor detection to catch anonymized traffic even from networks you haven't explicitly listed.
• Feed the ASN signal into AI fraud scoring, so a hosting-network connection raises risk rather than triggering a blanket block that might catch an edge-case legitimate user.
• Layer geography on top: a data-center ASN in a country you don't even serve is a near-certain block.

The mental model to keep: ISP tells you who provides the connection; ASN tells you which network the connection actually lives on. Fraud lives in networks. That's why, for precise blocking, the ASN is usually the answer.

Want to see which ASNs are hitting your store? Turn on network intelligence with Shieldy and start blocking the networks that matter.