Skip to content
Workspace Forensics

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.

Glossary

Hosting ASN

An autonomous system belonging to a cloud or VPS provider; user sign-ins from one often indicate a proxy such as an AiTM phishing kit.

An ASN (autonomous system number) identifies the network that owns an IP address. A hosting ASN belongs to a cloud or VPS provider: AWS, Google Cloud, Azure, DigitalOcean, OVH, Hetzner, Vultr and similar.

Employees sign in from offices, homes and mobile carriers, not from rented servers. A successful sign-in from a hosting ASN is therefore a strong sign of an adversary-in-the-middle proxy or a replayed session. Corporate VPNs and cloud desktops are the usual false positives. The Reports API gives the ASN in networkInfo.ipAsn.

See: suspicious logins and 2SV changes.

This tool is not affiliated with, endorsed by or sponsored by Google LLC. Google Workspace, Gmail and Google Drive are trademarks of Google LLC. Other names are trademarks of their respective owners.