ASN Threat Analysis

ASNs Observed

163

Malicious IPs (ASN-mapped)

438

IPs Needing ASN

532.3K

Just Resolved

0

Resolve ASN & Abuse Contacts

Fastest path: load the WhoisXML IP Netblocks and resolve ASN/org/country locally (millions/sec, no API). Then pull abuse contacts for every ASN from RIPEstat. 0 ASN abuse contacts cached.

▶ Resolve ASN from local data ▶ Resolve abuse contacts (RIPEstat) Resolve 50 via ipinfo (needs outbound) ↻ Recompute ranking Export abuse contacts (CSV)

Cron: */15 * * * * php /home/zaptf0zdggll/public_html/threats/resolve-local.php and 0 * * * * php /home/zaptf0zdggll/public_html/threats/resolve-asn-abuse.php

Worst ASNs by Targeting Priority

Priority = malicious IP count × average threat. High-priority ASNs concentrate the most malicious infrastructure — the best candidates for block-listing at the network level or coordinated takedown.

ASN Threat Ranking (Top 40)

RankASNOrganizationAbuse ContactMalicious IPsAvg ThreatDominant ActivityPriorityAction
1 AS4134 — — 39 0.50 Other Malicious IPs · Block
2 AS16509 — — 24 0.50 Other Malicious IPs · Block
3 AS13335 — — 14 0.50 Other Malicious IPs · Block
4 AS61317 — — 14 0.50 Other Malicious IPs · Block
5 AS14618 — — 12 0.50 Other Malicious IPs · Block
6 AS29465 — — 12 0.50 Other Malicious IPs · Block
7 AS213412 — — 10 0.50 Other Malicious IPs · Block
8 AS398324 — — 9 0.50 Other Malicious IPs · Block
9 AS4766 — — 8 0.50 Other Malicious IPs · Block
10 AS60729 — — 8 0.50 Other Malicious IPs · Block
11 AS16276 — — 7 0.50 Other Malicious IPs · Block
12 AS215125 — — 7 0.50 Other Malicious IPs · Block
13 AS396507 — — 7 0.50 Other Malicious IPs · Block
14 AS9498 — — 7 0.50 Other Malicious IPs · Block
15 AS150436 — — 6 0.50 Other Malicious IPs · Block
16 AS396982 — — 6 0.50 Other Malicious IPs · Block
17 AS55286 — — 6 0.50 Other Malicious IPs · Block
18 AS57558 — — 6 0.50 Other Malicious IPs · Block
19 AS6939 — — 6 0.50 Other Malicious IPs · Block
20 AS8075 — — 6 0.50 Other Malicious IPs · Block
21 AS219502 — — 5 0.50 Other Malicious IPs · Block
22 AS24309 — — 5 0.50 Other Malicious IPs · Block
23 AS38365 — — 5 0.50 Other Malicious IPs · Block
24 AS48090 — — 5 0.50 Other Malicious IPs · Block
25 AS135377 — — 4 0.50 Other Malicious IPs · Block
26 AS14061 — — 4 0.50 Other Malicious IPs · Block
27 AS206092 — — 4 0.50 Other Malicious IPs · Block
28 AS25369 — — 4 0.50 Other Malicious IPs · Block
29 AS396190 — — 4 0.50 Other Malicious IPs · Block
30 AS45271 — — 4 0.50 Other Malicious IPs · Block
31 AS47890 — — 4 0.50 Other Malicious IPs · Block
32 AS198093 — — 3 0.50 Other Malicious IPs · Block
33 AS29518 — — 3 0.50 Other Malicious IPs · Block
34 AS36912 — — 3 0.50 Other Malicious IPs · Block
35 AS45102 — — 3 0.50 Other Malicious IPs · Block
36 AS4837 — — 3 0.50 Other Malicious IPs · Block
37 AS10439 — — 2 0.50 Other Malicious IPs · Block
38 AS132203 — — 2 0.50 Other Malicious IPs · Block
39 AS142052 — — 2 0.50 Other Malicious IPs · Block
40 AS142647 — — 2 0.50 Other Malicious IPs · Block

Targeting Recommendations

  • ■ AS4134 (unknown org) is your #1 target — 39 malicious IPs concentrated here.
  • ■ 7 ASNs carry 10+ malicious IPs each — network-level blocking of these gives the highest coverage-per-rule.
  • ■ For coordinated takedown, start with high-priority ASNs whose dominant activity is Ransomware or C2 / APT — the highest-impact classes.
  • ■ Use the Takedown Ops tool to pull abuse contacts for the network operators above.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center