ASN: Data Point Intelligence Guide

The ASN is where infrastructure stops being anonymous. Every packet on the public internet is routed by an organisation that signed up, was allocated a number, and can be held accountable.

Understanding the ASN as an intelligence artifact

An Autonomous System Number identifies a network under a single, clearly defined routing policy that announces prefixes into the global BGP routing table. Numbers are 16-bit or 32-bit, allocated by IANA through the Regional Internet Registries, and written in ASxxxx form. An AS is an administrative and policy boundary rather than a physical one: it maps to an operator, whether that is a tier-one carrier, a hosting company, a university, an enterprise or a shell company reselling address space. It is the unit at which routing accountability exists.

Analytically, distinguish transit providers from stub networks, and both from bulletproof hosters that lease space through layers of resellers. The relationships that matter are upstream transit, peering, and the origin-AS field in BGP announcements. Route objects and RPKI ROAs in the RIR databases declare who is authorised to announce a prefix, so mismatches between announced origin and authorised origin are themselves a strong signal.

Why it matters

ASN analysis moves an investigation from single hosts to whole estates. Actors rarely rent one IP; they rent from a provider whose abuse tolerance suits them, and that provider becomes a durable clustering key long after individual IPs rotate. The ASN gives you the operator to escalate to, the upstream transit providers who can apply pressure when the operator will not, and a population baseline for judging whether malicious hosting on that network is exceptional or routine.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

The full set of prefixes originated by the AS, defining the complete address footprint an actor can rotate through.
Upstream transit and peering relationships, which identify who can be escalated to when the operator ignores abuse reports.
Registered organisation name, country and abuse contact from the RIR, plus the age of the AS registration.
Concentration of malicious indicators per thousand routed addresses, distinguishing an abuse-tolerant network from a large legitimate one.
BGP announcement stability, where frequent short-lived announcements of unused space suggest hijacking or spam-driven address rotation.
RPKI validation state and route object coverage, revealing operators that do not authenticate their own announcements.
Downstream customer ASNs, which expose reseller structures used to place distance between an operator and its tenants.
Historic renaming or reassignment of the AS, a common tactic after a network acquires a reputation for abuse.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

BGPView or bgp.tools — Prefixes originated, upstream and downstream relationships, peers, and organisational detail for any AS.
RIPEstat and RIPE RIS — Historic BGP announcement data, prefix visibility over time and routing consistency checks.
RIR RDAP and WHOIS databases — Authoritative AS holder, allocation date, country, abuse mailbox and registered route objects.
Spamhaus ASN-DROP and badness listings — Networks assessed as predominantly hostile, useful as a prior when scoring hosting choice.
Shodan and Censys ASN-filtered search — Service and certificate inventories across the entire AS, revealing repeated deployment patterns.
Team Cymru IP to ASN mapping service — Fast bulk resolution of addresses to origin AS and prefix for large log enrichment jobs.
RPKI validators and RIPE routing consistency tools — Whether announcements are cryptographically authorised, exposing hijacks and sloppy operators.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Map the address to its AS — Resolve the IP or prefix in question to its origin AS and covering prefix, using bulk mapping if you are enriching logs at scale.
Profile the operator — Pull RIR registration for the AS holder, country, allocation date and abuse contact, and note reseller or shell indicators in the organisation record.
Enumerate the footprint — List every prefix the AS originates so subsequent hunting covers the whole estate rather than the single address that triggered the case.
Assess concentration — Count known malicious hosts within the AS relative to its routed address count to distinguish systemic tolerance from incidental abuse.
Trace upstreams — Identify transit providers and peers, building an escalation ladder for cases where the immediate operator is unresponsive.
Check routing hygiene — Compare announced origins against route objects and RPKI ROAs, flagging unauthorised announcements as potential hijack or squatting.
Monitor for change — Watch for new prefixes, changed upstreams or renamed organisations, which typically precede or follow enforcement action.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Cyber Intelligence — Adversary Activity in Networks and Systems
Technical Intelligence — Technology Capability, Design, and Exploitation
Geospatial Intelligence — Intelligence Derived from Place
Energy Intelligence — Energy Production, Transport, and Markets
Risk Intelligence — Structured Assessment of Threat and Consequence
Vulnerability Intelligence — Weaknesses, Exploitation, and Prioritization

Investigated in these domains

Critical Infrastructure

Pivots to these data points

Domain Name — Human-readable address that maps to IP infrastructure via DNS.
IP Address — Internet Protocol address identifying a device or server on a network.
URL — Uniform Resource Locator pointing to a web resource.
Subdomain — A host under a parent domain — often reveals staging, admin, and forgotten infrastructure.
IP Range / CIDR — A block of IP addresses expressed in CIDR notation — the unit of network ownership and allocation.
MAC Address — Hardware address of a network interface; the OUI prefix identifies the manufacturer.

Inside the platform: where ASN lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

asn-profile.php — ASN profile
datapoint.php?dp=dp_asn — Data point hub
domain.php?d=critinfra — Critical Infrastructure dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Resolve Everything
Threat Hunt
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Map the address to its AS is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Enumerate the footprint turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Monitor for change feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses ASN

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

An ASN gives a defence analyst the organisational unit of the internet: the entity that announces routes and can be held accountable for what transits them. This supports network characterisation in intelligence preparation, cyber terrain mapping for defensive planning, and force protection decisions such as whether to restrict traffic to networks with no legitimate mission relationship. It also underpins resilience analysis, since transit dependency for a partner nation or deployed site is expressed in AS relationships. Constraints are real: AS level blocking severs civilian services, hyperscaler ASNs carry everything, and routing observations reflect collector placement rather than ground truth, so claims about a network need multiple vantage points.

🕵 National intelligence

National intelligence uses AS level analysis to characterise national and commercial network structure, identify chokepoints and transit dependencies, and track the small population of providers that persistently host hostile infrastructure. Routing data is entirely open, which makes it valuable for producing releasable assessments that can be shared with partners and industry without exposing collection. Requirements discipline applies: profile an AS because it answers a standing question about resilience, censorship, sanctions exposure or actor infrastructure. Handling considerations are modest, though small operator registry records contain personal contact details. Report with collector coverage caveats, because absent announcements often mean absent visibility rather than absent routes.

👮 Law enforcement

Law enforcement uses the ASN to identify which legal person operates the network behind an address, which determines where a production order or preservation request is served and under which jurisdiction. Registry records provide the registered organisation, country and abuse contact, and routing data shows whether that organisation actually announces the prefix or has leased it to a downstream customer, which frequently changes the correct recipient. Evidentially, routing observations should be captured from a named public collector with timestamps. AS level findings support proving that a provider was on notice, which matters for continuing liability and complicity arguments against bulletproof hosters.

🔍 Private investigation and corporate security

Corporate security uses AS analysis for third party risk, sanctions and supply chain screening, and for judging whether a counterparty's stated infrastructure matches reality. Discovering that a supplier platform is announced by a shell AS with no transit history and an abuse mailbox that bounces is a material due diligence finding. Private actors may freely use public routing and registry data and may contact abuse addresses about traffic affecting their own client, but may not scan third party networks, may not misuse abuse contacts for commercial approaches, and may not represent themselves as law enforcement when escalating to upstream providers.

📰 Journalism and OSINT media

Journalists use ASNs to make infrastructure stories concrete and attributable to named companies. Showing that a spyware vendor, a disinformation network or a sanctioned entity's services are announced by a specific provider, with named upstream transit partners, turns a technical claim into an accountability story with identifiable subjects who can respond. Verification requires multiple routing collectors, dated observations and corporate registry corroboration of the AS holder, since shell naming is common. Give both the AS holder and the upstream providers a genuine right of reply, and be precise that announcing a prefix is not the same as operating the content on it.

🌍 NGO, humanitarian and human rights

Human rights organisations use AS level data to document internet shutdowns, throttling and censorship, and to identify the providers whose cooperation enables them. Routing withdrawal patterns across a national AS set are among the most defensible technical evidence of a deliberate shutdown, and they are collectible without endangering anyone in country. Do no harm applies to naming in country staff of a provider, who may face reprisal, so accountability reporting should target corporate entities and decision makers rather than employees. Preserve collector data with timestamps under Berkeley Protocol practice so the material supports later legal or treaty body proceedings.

🎓 University and research

Researchers use AS level data for topology studies, routing security measurement, censorship research and abuse concentration analysis. Rigour requires naming the collector set, the observation window and the inference method for AS relationships, since transit, peering and sibling relationships are inferred rather than published and different algorithms disagree. Reproducibility is well supported here because the underlying route collector archives are public and versioned. Ethics review is usually light given the minimal personal data, though registry contact details for small operators are personal information. Cite collector and relationship inference datasets by version and date, and publish code for relationship derivation.

Playbook: working ASN end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Anchor the question

Decide what the AS analysis must answer: who to serve process on, whether a network is systemically abusive, where transit dependency sits, or whether an announcement is authorised. The answer determines which data you need and prevents an open ended trawl. A good output is a one line analytical question with the decision it supports. Stop when the question is specific enough that a finding would change something.

Phase 2 — Map address to origin AS

Resolve the address or prefix to its origin AS and covering announcement using public routing data, and use bulk mapping services when enriching logs at scale. Record the collector and observation time, because origin can change and collectors differ. A good output is an origin AS with the announcement seen, the collector that saw it and the timestamp. Stop when the origin is consistent across at least two collectors or the inconsistency is itself recorded.

Phase 3 — Profile the registered holder

Pull registry records for the AS: organisation name, country, allocation date, contacts and abuse mailbox. Cross check the organisation against a corporate registry to see whether it is a substantive company or a shell, and note directors, incorporation date and address reuse. A good output is a holder profile stating whether the registered entity appears operational. Stop when you can name the legal entity accountable for the announcements.

Phase 4 — Enumerate the prefix footprint

List every prefix the AS originates, in both IPv4 and IPv6, so subsequent hunting covers the whole estate rather than the single address that triggered the case. Note recently added and recently withdrawn prefixes. A good output is a complete, dated prefix list with total routed address count. Stop when the footprint is enumerated and any very recent changes are flagged for follow up.

Phase 5 — Measure abuse concentration

Count distinct known bad indicators inside the AS over a defined window and normalise by routed address count, then compare against peer networks of similar size. Raw counts always make large providers look worst, which is why normalisation is mandatory. A good output is an abuse density figure with the window, the indicator sources and a peer comparison. Stop when you can state whether abuse is systemic or incidental with numbers behind it.

Phase 6 — Trace transit and peering

Identify upstream transit providers, notable peers and downstream customer ASNs. Upstreams are the escalation ladder when the operator ignores abuse reports, and downstream customers reveal reseller structures used to place distance between operator and tenant. A good output is a relationship map naming each upstream with the collector evidence. Stop when you have at least one upstream with a functioning abuse process.

Phase 7 — Check routing authorisation

Compare announced origins against route objects in the registry databases and against RPKI authorisations, flagging invalid or unknown states. Persistent invalids indicate either poor hygiene or hijacked space, and the distinction matters. A good output is a per prefix validation state with the authorisation that governs it. Stop when every prefix is classified as valid, invalid or not covered, with an explanation for the invalids.

Phase 8 — Assess announcement stability

Review historic announcement data for short lived announcements of otherwise unused space, frequent origin changes or prefixes appearing only from unusual collectors. These patterns indicate hijacking, spam driven address rotation or squatting on dormant allocations. A good output is a stability timeline with anomalous announcements identified and dated. Stop when the pattern is characterised as stable, churning or anomalous.

Phase 9 — Inventory services across the AS

Query passive scan repositories filtered by ASN for repeated certificates, panel software, banners and naming conventions across the whole estate. Repeated fingerprints reveal a single tenant operating many hosts. A good output is a fingerprint inventory showing how many hosts share each artifact. Stop when the dominant tenancy patterns are identified rather than after enumerating every host.

Phase 10 — Judge the correct intervention

Choose between abuse notification to the operator, escalation to upstreams, narrow prefix blocking, full AS blocking, referral to law enforcement or public reporting. Document the proportionality assessment, including estimated legitimate traffic affected. A good output is a recorded decision with the collateral impact estimate. Stop when the intervention is chosen and its collateral cost is written down, not assumed.

Phase 11 — Monitor for adaptation

Set alerts on new prefixes originated, changed upstreams, organisational renaming and AS transfer, all of which typically follow enforcement pressure. Operators frequently reappear under a new AS number with the same address space. A good output is a monitoring rule set with defined triggers. Stop when alerting covers footprint change, relationship change and holder change.

Phase 12 — Record and review

Preserve routing snapshots, registry records and abuse density calculations with dates and sources, since routing history is queryable but reputation feeds are not always retrievable retrospectively. Set a review date. A good output is a case record another analyst could re run and reproduce. Stop when every numeric claim in your report has a preserved source behind it.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
bgp.tools	Open	Live and historic prefix to ASN mapping, upstream, downstream and peer relationships, and per AS prefix listings with visibility data.	Primary interactive view of an AS footprint and its transit relationships when building an escalation ladder.
Hurricane Electric BGP toolkit	Open	Free interface exposing AS details, originated prefixes, peers, upstreams and downstreams derived from public routing data.	Enumeration of an AS prefix footprint and relationships for reporting and for building an escalation ladder.
RIPE RIS and RIPEstat	Open	Archive of BGP updates and table dumps from globally distributed route collectors, with derived visibility, history and consistency views.	Authoritative historic announcement evidence with named collectors and timestamps for evidential routing claims.
University of Oregon Route Views	Open	Long running public route collector project archiving BGP table dumps and updates from many peering locations over decades.	Independent second collector set for corroborating announcement history and detecting collector specific visibility gaps.
RIPE NCC database and RDAP	Open	Registry objects for autonomous systems including aut-num, organisation, abuse contact and route objects declaring authorised origins.	Establishes the registered AS holder, jurisdiction, abuse contact and declared route authorisations in the RIPE region.
ARIN registry services	Open	Authoritative records for North American AS assignments including organisation, point of contact and network reassignment data.	Identifies the accountable entity for ASNs assigned in the ARIN region and any downstream reassignment.
APNIC registry services	Open	Registry data for Asia Pacific AS assignments with organisation, contact and route object information.	Holder identification for Asia Pacific ASNs where reseller and shell structures are frequently encountered.
RPKI repositories and validator tooling	Open	Cryptographically signed Route Origin Authorisations declaring which AS may originate a given prefix, published by the registries.	Determines whether announcements are authorised, exposing hijacks and operators who do not sign their own routes.
CAIDA AS relationships and AS Rank	Registration	Inferred customer, provider and peer relationships between autonomous systems, plus rankings by customer cone size, published periodically.	Structural context on how central an AS is and who its providers are, cited by dataset version.
PeeringDB	Open	Voluntary database of network operators, their exchange points, facilities, peering policies and technical contacts.	Physical and organisational context for an AS, including where it interconnects and who to contact operationally.
Spamhaus ASN-DROP and network reputation	Open	Assessment of autonomous systems judged to be predominantly hostile or under criminal control, with listing rationale.	Independent prior on whether an AS is a bulletproof host rather than a network with incidental abuse.
Shodan ASN filtered search	Registration	Scan results filterable by autonomous system, exposing service, banner and certificate patterns across the whole network.	Detects repeated tenant fingerprints across an AS, distinguishing a single operator estate from mixed hosting.
Censys ASN filtered search	Registration	Structured host and certificate records queryable by autonomous system with historic views of service configuration.	Certificate and software version clustering across an entire AS to characterise its tenant population.
Team Cymru IP to ASN mapping	Open	Bulk mapping service resolving addresses to origin AS, prefix, registry, country and allocation date via DNS or whois.	High volume enrichment of log data to AS context without exhausting interactive rate limits.
Internet Outage Detection and Analysis	Open	Near real time detection of connectivity disruption using routing, active probing and background traffic signals per country and AS.	Evidences shutdowns, throttling and large scale outages at AS granularity with dated, citable measurements.
IANA autonomous system number registry	Open	Authoritative record of AS number blocks delegated to each Regional Internet Registry, including 16 and 32 bit ranges.	Confirms which registry is responsible for an AS number before querying the correct database.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against ASN. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

bgpq4 — Generates prefix filters from registry route objects and AS set macros for a given AS. Limitation: output quality depends on how well operators maintain their objects.
Routinator or rpki-client — Validates announcements against RPKI Route Origin Authorisations locally. Limitation: coverage is partial, so unknown state is common and not evidence of wrongdoing.
bgpdump and pybgpstream — Parse and stream archived route collector data for historic announcement analysis. Limitation: data volumes are large and require substantial processing capacity.
whois with registry specific flags — Retrieves aut-num, organisation and route objects directly from the responsible registry. Limitation: object accuracy depends entirely on operator maintenance.
CAIDA AS Rank tooling — Provides inferred AS relationships and customer cone metrics for structural analysis. Limitation: relationships are inferred, and different algorithms produce different answers.
Shodan and Censys clients — Bulk retrieval of host and certificate data filtered by ASN for tenancy fingerprinting. Limitation: snapshot data that may lag the current state by weeks.
MISP with ASN attributes — Stores AS level context alongside address indicators so clustering survives address rotation. Limitation: analysts must populate AS attributes deliberately.
Dashboards over routing archives — Visualise announcement stability, prefix count and origin changes over time. Limitation: requires local ingestion of large collector datasets to be useful.
PeeringDB API — Programmatic lookup of an operator's exchanges, facilities and technical contacts. Limitation: entries are self reported and frequently outdated for smaller networks.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Resolve Everything — Batch-resolves ASN, country, org and netblock for every IP from local reference datasets — no API calls, so it runs at millions of rows and works offline.
Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Normalise abuse by routed address count before comparing networks. Raw indicator counts always rank the largest consumer providers as the worst offenders, which is an artefact of size rather than a finding about tolerance.
The registered AS holder and the operator of a malicious host are often three layers apart. Follow the sub allocation and reseller chain in registry objects before deciding who to serve process on or who to name publicly.
Announcement absence is usually collector blindness. Regional announcements not seen by your vantage points will be missing entirely, so state which collector set you used and never claim a prefix was unrouted from a single source.
Bulletproof operators reappear rather than reform. Watch for a new AS number originating the same prefixes, or the same prefixes appearing under a renamed organisation with the same contact address or director.
An RPKI invalid state is not automatically malicious. Misconfigured authorisations and stale objects are extremely common, so treat invalid state as a prompt to investigate operator hygiene rather than as evidence of hijack.
Upstream transit providers respond to different pressure than the hosting operator. Reputational and contractual arguments work at that level where abuse reports to the operator itself are simply discarded.
Corporate registry checks on the AS holder frequently outperform technical analysis. Shared directors, a recent incorporation date and a virtual office address across several ASNs are stronger evidence of common control than any routing pattern.
Judge an AS by whether abuse is remediated, not by whether abuse exists. Every large network hosts abuse; the discriminator is whether reports produce action, so track your own notification outcomes per AS as data.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on ASN is producing anything, and they are worth baselining before you change process or tooling.

Abuse density per AS normalised by routed address count, tracked over time so improvement or deterioration in a provider is visible.
Median time to acknowledgement and to remediation for abuse reports, recorded per AS, used to decide when to escalate to upstreams.
Proportion of your own announced prefixes covered by valid Route Origin Authorisations, measuring routing hygiene you control directly.
Number of investigations where AS level clustering survived address rotation, measuring whether the pivot is adding durable value.
Count of AS level blocks applied and the volume of legitimate traffic they affected, tracked to keep controls proportionate.
Detection latency for new prefixes originated by monitored hostile ASNs, measured from first collector observation to internal alert.
Share of AS findings that identified the accountable legal entity through corporate registry corroboration rather than registry name alone.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Large cloud and CDN ASNs host everything, so AS membership carries almost no signal for hyperscaler address space.
Reseller layers mean the registered AS holder may have no operational relationship with the tenant actually running the malicious host.
Malicious concentration must be normalised by network size, otherwise every big consumer ISP scores as hostile.
BGP data reflects what collectors observed, so regional announcements invisible to your vantage points will be missing entirely.
Operators rebrand, split or transfer ASNs, so historic reputation may not attach to the current holder of the number.
Blocking an entire AS is a blunt control that regularly severs legitimate business traffic alongside the threat.

Legal and ethical considerations

AS registration and routing data are published for operational purposes and carry minimal privacy exposure, though small-operator records can contain individual names and personal contact details that remain personal data. Use abuse contacts for their intended purpose rather than bulk marketing or unrelated correspondence, since misuse can lose you access. When recommending network-level blocking, document the proportionality assessment, because collateral impact on innocent customers is a real and foreseeable harm you should be able to justify.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for ASN, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 1 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Should I ever block an entire ASN?

Rarely, and only with a documented proportionality assessment. It is defensible for a small AS whose entire routed footprint is dedicated to abuse and which has ignored notification, where you can show near zero legitimate traffic. It is indefensible for hyperscaler, content delivery or large provider ASNs, where blocking severs business services and customer access far more effectively than it inconveniences an attacker. Prefer the narrowest prefix that captures the threat, prefer behavioural detection over network blocking where possible, and always record the estimated legitimate traffic affected before applying the control.

How do I find who really controls a suspicious AS?

Combine registry and corporate sources. Start with the aut-num and organisation objects for the registered name, country and contacts, then check the corporate registry in that jurisdiction for incorporation date, directors and registered address. Look for reuse of the same address, director or contact email across multiple ASNs, which is the classic bulletproof reseller pattern. PeeringDB entries reveal facilities and operational contacts. Routing relationships show which upstreams accepted the customer, and those upstreams performed some level of customer verification that can be referenced in escalation.

What does an RPKI invalid announcement actually tell me?

That the announcement conflicts with a signed authorisation, most commonly because the origin AS differs from the authorisation or the prefix is more specific than the maximum length allowed. Hijacks produce this state, but so do routine operational errors, stale authorisations after a customer migration, and providers who signed once and never maintained it. Treat invalid as a trigger for investigation, not a verdict: check whether the announcing AS has any plausible relationship to the holder, whether the invalid is persistent or transient, and whether the legitimate holder is still announcing the covering prefix.

Why do my two routing sources disagree about the origin?

Because they see different parts of the internet. Route collectors peer with a finite set of networks, so an announcement propagated only regionally, or one filtered before reaching a collector's peers, will appear in one dataset and not another. More specific announcements can also change apparent origin depending on the vantage point. This is normal and should be reported rather than resolved by picking a favourite source. Name the collectors, give the observation window, and treat disagreement as a finding about propagation rather than an error in the data.

Is AS level attribution good enough for reporting?

It is good enough to name the accountable network operator and to support notification, escalation and civil or regulatory action against that operator. It is not attribution of the actor using the network, because ASNs host many tenants and resellers stand between operator and customer. Report it precisely: this prefix was announced by this AS, registered to this organisation, during this window. Any claim about who operated the content on that prefix needs separate evidence such as certificates, payment records, tenancy fingerprints or process served on the provider.

How do I evidence an internet shutdown at AS level?

Use route collector archives to show withdrawal of prefixes originated by the national ASNs, cross checked against active measurement and background traffic signals from an independent measurement project. Record the exact withdrawal and restoration times, the collectors observing them, and which ASNs were affected versus unaffected, since selective shutdowns often spare government networks. Corroborate with in country reporting where it can be obtained safely. Preserve raw collector data rather than screenshots, because accountability proceedings will test whether the measurement can be independently reproduced.

How stable is an ASN as a clustering key?

Much more stable than an address and usually more stable than a domain, which is why it is worth the effort. Actors rotate addresses hourly and domains weekly but change hosting provider only when forced, because migration costs them uptime and setup work. The failure mode is the opposite of instability: hyperscaler ASNs are so heavily shared that membership carries no signal at all. Use AS as a clustering key for small and mid size providers, and fall back to certificate, kit and behavioural fingerprints inside large cloud ASNs.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

RFC 4271 and RFC 6793, defining BGP-4 and the four octet AS number space that underpins all routing observation.
RFC 6480 and RFC 6811, defining the RPKI architecture and BGP prefix origin validation used to authorise announcements.
MANRS, the Mutually Agreed Norms for Routing Security, setting operator commitments on filtering, anti spoofing, coordination and validation.
Regional Internet Registry policy frameworks governing AS number assignment, transfer and registry accuracy across all five registries.
RFC 2142 and registry abuse contact policies, defining the abuse mailbox obligations that make network level notification workable.
ITU and national telecommunications licensing regimes, which determine what obligations a network operator carries in its jurisdiction.
MITRE ATT&CK Resource Development techniques, covering acquisition of infrastructure and hosting services by adversaries.
Berkeley Protocol on Digital Open Source Investigations, applicable where routing evidence supports shutdown or human rights accountability work.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Routing Information Service — RIPE NCC. Global route collector network archiving BGP updates and table dumps for historic routing analysis.
Route Views Project — University of Oregon. Long running public archive of BGP routing data from diverse peering vantage points.
bgp.tools — bgp.tools. Public routing observatory presenting AS footprints, relationships and prefix visibility.
PeeringDB — PeeringDB. Operator maintained database of networks, interconnection facilities and peering policies.
Mutually Agreed Norms for Routing Security — Internet Society. Norms and measurement programme for operator routing security practices.
AS Rank and AS relationships datasets — CAIDA. Inferred inter-AS business relationships and customer cone rankings published for research use.
ASN-DROP list — Spamhaus. Listing of autonomous systems assessed as predominantly criminal or bulletproof hosting.
Autonomous System Number registry — IANA. Authoritative delegation record of AS number blocks to Regional Internet Registries.
Internet Outage Detection and Analysis — Georgia Institute of Technology. Measurement platform detecting connectivity disruption at country and AS granularity.
RPKI documentation and validator guidance — RIPE NCC. Reference material on Route Origin Authorisations, validation states and operational deployment.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: profiles networks by prefix footprint, abuse concentration and upstream relationships to support estate-level tracking and escalation. Explore the platform, or browse the rest of the library by following any tag above.