ASN Threat Analysis

ASNs Observed

190

Malicious IPs (ASN-mapped)

551

IPs Needing ASN

536.4K

Just Resolved

0

Resolve ASN & Abuse Contacts

Fastest path: load the WhoisXML IP Netblocks and resolve ASN/org/country locally (millions/sec, no API). Then pull abuse contacts for every ASN from RIPEstat. 110 ASN abuse contacts cached.

▶ Resolve ASN from local data ▶ Resolve abuse contacts (RIPEstat) Resolve 50 via ipinfo (needs outbound) ↻ Recompute ranking Export abuse contacts (CSV)

Cron: */15 * * * * php /home/zaptf0zdggll/public_html/threats/resolve-local.php and 0 * * * * php /home/zaptf0zdggll/public_html/threats/resolve-asn-abuse.php

Worst ASNs by Targeting Priority

Priority = malicious IP count × average threat. High-priority ASNs concentrate the most malicious infrastructure — the best candidates for block-listing at the network level or coordinated takedown.

ASN Threat Ranking (Top 40)

RankASNOrganizationAbuse ContactMalicious IPsAvg ThreatDominant ActivityPriorityAction
1 AS4134 China Telecom anti-spam@chinatelecom.cn 44 0.50 Other Malicious IPs · Block
2 AS16509 Amazon abuse@amazonaws.com 28 0.50 Other Malicious IPs · Block
3 AS61317 Ripe abuse@hivelocity.net 19 0.50 Other Malicious IPs · Block
4 AS13335 Cloudflare abuse@cloudflare.com 17 0.50 Other Malicious IPs · Block
5 AS14618 Amazon abuse@amazonaws.com 15 0.50 Other Malicious IPs · Block
6 AS16276 OVH abuse@ovh.net 14 0.50 Other Malicious IPs · Block
7 AS29465 Ripe hostmaster@vgccl.net 13 0.50 Other Malicious IPs · Block
8 AS6939 Arin abuse@he.net 13 0.50 Other Malicious IPs · Block
9 AS396982 Google network-abuse@google.com 12 0.50 Other Malicious IPs · Block
10 AS213412 Ripe abuse@onyphe.io 11 0.50 Other Malicious IPs · Block
11 AS398324 Arin scan-abuse@censys.com 11 0.50 Other Malicious IPs · Block
12 AS396507 Arin abuse@emeraldonion.org 10 0.50 Other Malicious IPs · Block
13 AS4766 Apnic hostmaster@nic.or.kr 9 0.50 Other Malicious IPs · Block
14 AS25369 Ripe abuse@zare.com 8 0.50 Other Malicious IPs · Block
15 AS55286 Arin abuse-system@servermania.com 8 0.50 Other Malicious IPs · Block
16 AS60729 Ripe abuse@renewablefreedom.org 8 0.50 Other Malicious IPs · Block
17 AS150436 Apnic bd_abuse@bytedance.com 7 0.50 Other Malicious IPs · Block
18 AS215125 Ripe abuse@cyberology.nl 7 0.50 Other Malicious IPs · Block
19 AS48090 Ripe dmzhostabuse@gmail.com 7 0.50 Other Malicious IPs · Block
20 AS9498 Apnic ip.misuse@airtel.com 7 0.50 Other Malicious IPs · Block
21 AS219502 Ripe abuse@stormindustries.llc 6 0.50 Other Malicious IPs · Block
22 AS57558 Ripe abuse@metissrl.it 6 0.50 Other Malicious IPs · Block
23 AS59651 Ripe info@quality-network.eu 6 0.50 Other Malicious IPs · Block
24 AS8075 Microsoft abuse@microsoft.com 6 0.50 Other Malicious IPs · Block
25 AS135377 Apnic hegui@ucloud.cn 5 0.50 Other Malicious IPs · Block
26 AS206092 Ip Volume abuse@ipvolume.net 5 0.50 Other Malicious IPs · Block
27 AS24309 Apnic abuse@actcorp.in 5 0.50 Other Malicious IPs · Block
28 AS38365 Apnic — 5 0.50 Other Malicious IPs · Block
29 AS398722 Arin scan-abuse@censys.com 5 0.50 Other Malicious IPs · Block
30 AS14061 DigitalOcean abuse@digitalocean.com 4 0.50 Other Malicious IPs · Block
31 AS215778 Ripe abuse@alphastrike.io 4 0.50 Other Malicious IPs · Block
32 AS396190 Arin abuse@us.leaseweb.com 4 0.50 Other Malicious IPs · Block
33 AS45271 Apnic saji.samuel@vodafoneidea.com 4 0.50 Other Malicious IPs · Block
34 AS47890 Ripe abuse@unmanaged.uk 4 0.50 Other Malicious IPs · Block
35 AS54113 Fastly abuse@fastly.com 4 0.50 Other Malicious IPs · Block
36 AS197170 Ripe abuse@tech-ties.net 3 0.50 Other Malicious IPs · Block
37 AS198093 Ripe abuse@dfri.net 3 0.50 Other Malicious IPs · Block
38 AS200651 Ripe abuse@flokinet.is 3 0.50 Other Malicious IPs · Block
39 AS209334 Ripe abuse@modat.io 3 0.50 Other Malicious IPs · Block
40 AS210558 Ripe abuse@as210558.net 3 0.50 Other Malicious IPs · Block

Targeting Recommendations

  • ■ AS4134 (China Telecom) is your #1 target — 44 malicious IPs concentrated here.
  • ■ 12 ASNs carry 10+ malicious IPs each — network-level blocking of these gives the highest coverage-per-rule.
  • ■ For coordinated takedown, start with high-priority ASNs whose dominant activity is Ransomware or C2 / APT — the highest-impact classes.
  • ■ Use the Takedown Ops tool to pull abuse contacts for the network operators above.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center