Group botnet attacks with bulk ASN audits

Quick answer

A distributed attack — a botnet, a credential-stuffing run, a scraping swarm — arrives as hundreds of different IPs, which looks like chaos. But group those IPs by ASN and the structure often snaps into focus: a handful of networks doing most of the damage. Here’s how to run that analysis.

Why does ASN grouping reveal botnet patterns?

Attackers rent infrastructure, and rented infrastructure clusters in specific hosting networks. So while an attack shows hundreds of unique IPs, those IPs frequently collapse into a few ASNs. Seeing “300 IPs” is overwhelming; seeing “300 IPs across 4 hosting ASNs” is actionable — you can block 4 networks instead of chasing 300 addresses.

Step 1: Collect the attacking IPs

Extract the offending addresses from your logs — see extracting unique IPs. Sort by request volume so you’re working with the heaviest sources first. You now have the raw list to attribute.

Step 2: Attribute each IP to its ASN

Look up the network owner for each address. Our Bulk IP Audit tool returns the ASN organisation per IP; for hundreds of addresses, script it via our developer endpoints or a bulk-audit script. The output you want is each IP tagged with its ASN.

Step 3: Group and count by ASN

Tally how many attacking IPs belong to each ASN. The distribution is usually lopsided — a few ASNs account for most of the traffic. Those concentrated networks are your high-value targets; the long tail of one-off ASNs matters less. This is the moment the “swarm” becomes a short list.

Step 4: Block at the network level

For the dominant abusive ASNs — especially pure datacenter networks with no legitimate user traffic — block their CIDR ranges or block by ASN at your edge (see blocking abusive ASN networks). One network-level rule neutralises every current and future IP from that source, which is why ASN grouping is so much more durable than per-IP blocking against a botnet that rotates addresses.

Step 5: Distinguish botnet types

Two patterns look different under ASN analysis. Rented-server botnets concentrate in datacenter ASNs — clean to block. Compromised-device botnets (IoT, home PCs) scatter across many residential ASNs — here blocking whole networks would hurt real users, so rate-limiting, challenge pages, or targeted blocks are safer than broad ASN bans. The ASN profile tells you which kind you’re facing.