Data Points

🛰 ASN

Autonomous System Number identifying a network operator on the internet.

Network

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

open →

native tool

🔧 Native workbench

Open ASN workbench →Advanced search →Link analysis →

🔎 Live indicators (IoC view)

ASN indicators →IoC dashboard →Search asn →

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — ASN exploitation

Direction — frame the requirement for ASN: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench (open); capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 ASN

An Autonomous System Number identifies a network operator that announces a set of IP prefixes under a single routing policy via BGP. In investigations it reveals who owns and routes infrastructure, exposes bulletproof and abuse-prone hosters, and lets analysts cluster IPs and CIDRs by operator for scoping and blocking.

Format: ASPLAIN integer 1-4294967295 (32-bit); often written AS-prefixed (AS13335). Reserved: AS0, AS23456, private 64512-65534 and 4200000000-4294967294.

📡 How it is collected

BGP routing tables / RIB dumps
Team Cymru IP-to-ASN mapping
RIR (ARIN/RIPE/APNIC/LACNIC/AFRINIC) allocation records
RouteViews / RIPE RIS collectors
IP enrichment lookups
Whois org records

📚 Enrichment & validation sources

Team Cymru IP-to-ASN →bgp.he.net (Hurricane Electric) →RIPEstat →PeeringDB →BGPView →RADb / IRR →ipinfo →Spamhaus ASN-DROP →

🔗 Pivot to

IP Range / CIDR →IP Address →announced prefixes →peer/upstream ASNs →org / registrant →downstream customer ASNs →

🧩 Analysis & hunting techniques

Prefix announcement enumeration
Peering and upstream/downstream mapping
ASN reputation and abuse-density scoring
Hijack / route-leak detection (RPKI/ROA)
Bulletproof-hoster identification
Historical origin-AS change tracking
Geographic footprint analysis
Cross-campaign IP clustering by ASN

🔧 Tools

bgp.he.net
RIPEstat
BGPView
PeeringDB
pyasn
whois
bgpq4
MISP

⚡ Workbench actions

List announced prefixes
Map peers & upstreams
Score ASN abuse density
Check RPKI/ROA validity
Cluster campaign IPs by ASN
Pull RIR org record
Track origin-AS history
Export prefix blocklist

📊 Dashboard KPIs

Number of announced prefixesTotal advertised IP spaceAbuse-density (malicious IPs / total)RPKI-valid prefix ratioPeer/upstream count

📂 Open

ASN profile →Data point profile →Netflow explorer →Correlate infrastructure →Country dashboard →Link analysis →

🔄 Data Feeds & Datasets

Feed	Category	Format	Status
PeeringDB API	ASN	`json`	enabled
BGPView API	ASN	`json`	enabled
RIPEstat data API	ASN	`json`	enabled
iptoasn ip2asn v4	ASN	`tsv`	enabled
Feodo Tracker C2 (family+ASN)	C2 Attribution	`json`	enabled

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook