Extract and block abusive ASN networks from access logs

Quick answer

When abuse comes not from one IP but from dozens scattered across a single hosting provider, blocking addresses one by one is a losing game. The efficient move is to identify and block the whole ASN — the network — behind them. Here’s how.

What is an ASN?

An Autonomous System Number identifies a network operated by one organisation — an ISP, a hosting company, a cloud provider. Every public IP belongs to an ASN. Abusive traffic from a single bad host often originates from many IPs that all share that host’s ASN, so the ASN is the natural unit to block.

Step 1: Find the ASN behind your abusers

Take the offending IPs from your logs and look up their network owner. Our Bulk IP Audit tool shows the ASN organisation for each IP, so you can quickly see whether a cluster of bad addresses all belong to the same hosting network. When they do, you’ve found your target.

Step 2: Confirm it’s genuinely abusive, not mixed

Be careful before blocking a whole ASN — some carry both abuse and legitimate users (a big cloud provider hosts attackers and real services your customers might use). Blocking a datacenter-only ASN that’s pure infrastructure is low-risk; blocking a consumer ISP’s ASN could shut out real visitors. Check the ASN’s nature first.

Step 3: Get the ASN’s IP ranges

To block an ASN you need its list of CIDR ranges (the address blocks it announces). These are published in the regional registries and ASN-info services. Once you have them, you convert “block this network” into a concrete set of CIDR rules — see working with CIDR ranges.

Step 4: Apply the block

Add the ASN’s CIDR ranges to your firewall, web server, or CDN deny rules. At the edge (Cloudflare, a WAF) you can often block by ASN directly without listing every range, which is cleaner. At the host level, you apply the CIDR list. Either way, one rule set now stops the entire network instead of chasing new IPs from it.

Step 5: Report while you’re at it

Blocking protects you, but reporting can stop the source. Use the ASN’s abuse contact to report the activity — see tracing abuse contacts with WHOIS. Reputable networks act on credible reports; bulletproof hosts won’t, which is exactly when a standing ASN block earns its keep.