Resource created as part of Grace Chi & the Pulsedive Threat Research team’s TI Essentials article: “ASN Data for Threat Detection: A Defender's Guide” | Published June 18, 2026 | feedly.com/ti-essentials/

Effectively leverage Autonomous System Number (ASN) data into threat detections tailored for your organization. This guide outlines a three-step process:

Create a high-confidence list of malicious ASNs
Evaluate your organization's network traffic against this list
Regularly review the findings to ensure accuracy

Step 1: Create a high-confidence list of malicious ASNs

Review public intelligence reporting from security vendors and government reports about threats to collect IoCs and specific ASNs of concern.

unchecked
1. Combining public intelligence with blocklists will yield a broader list of ASNs to analyze for reputation.
Assign reputation scores to the ASN list previously generated

unchecked
1. Factors: the following data should be analyzed to generate a reputation score
  1. ASN Size
    1. Larger ASNs may be abused by threat actors while also serving legitimate infrastructure.
    2. If a large ASN is included in blocklists, there is a chance that legitimate traffic is blocked.
  2. AS Number
  3. AS Name
  4. Active IPs
  5. Active Subnets
  6. IPs in ASN
  7. Sub-ASNs
  8. Reports of Abuse
  9. ASN Reputation Score
  10. ASN takedown timeline
    1. Long takedown times are a cause for concern, as infrastructure used for malicious purposes remains available longer.
2. Public Reporting: ASNs from public reporting should be analyzed for the volume of reports and similar activity observed. This allows organizations to leverage a larger volume of data to determine if that ASN is being abused.
3. Hosting & Cloud Providers: The ASN list should be reviewed for any that belong to hosting or cloud providers. The infrastructure is also used for many legitimate services and, as such, should be removed from any detections or blocklists.
  1. Examples of ASNs that should not be blocked include:
    1. Microsoft
    2. Amazon.com, Inc.
    3. Google
    4. Cloudflare, Inc

Use the following tools to gain more insights into the ASNs from a scoring perspective.

Tool	Description
IPinfo	Online database of information about IP addresses and ASes.
ASRank	Ranks ASes by their customer cone size.
CleanTalk	Tracks IP addresses used within spam messages. This information is used to assign a spam rate to each ASN.
URLHaus	Database of URLs used to distribute malware. Malware sites are correlated with IP addresses assigned to the ASN used. This resource also tracks the average time the provider takes to action takedown requests.
risk-db	A GitHub project that tracks different attack reports by ASN.
Spamhaus	Spamhaus provides an ASN drop list in JSON format.
Fraudguard	Provides details on anonymous and malicious IP addresses from a specific ASN.

Step 2: Evaluate your organization's network traffic against the list of ASes identified in step 1

The curated output from step 1 should be compared with incident data to determine whether any of the ASNs have been observed in incidents or security investigations. In addition to reviewing against incidents, the list should be compared against network traffic in an organization to identify if any traffic from the ASN is observed.

Any observations should be investigated to determine if an incident was missed.

unchecked
If the observed traffic was benign and served a legitimate purpose, that ASN should be removed to reduce false positives.

unchecked

Step 3: Regularly review findings to determine if the ASN list needs to be modified

Once blocklists or detections using the ASN list from step 2 are created, the ASN list used should be actively monitored for false positives or any new additions. If additions are required, this cycle can be repeated on a regular cadence.