ASN Abuse

The ASN abuse score reflects what fraction of an ASN’s announced IP space is currently classified as VPN, proxy, or other anonymizer. High scores flag networks where most traffic is anonymized — useful for peering decisions, traffic prioritization, and bulk filtering.

Single IP

Every IP lookup returns an asn_abuse block when the originating ASN is known:

{
  "ip": "45.83.236.X",
  "asn": 209590,
  "asn_org": "GLOBALCONNECT",
  "asn_abuse": {
    "abuse_score": 87,
    "abuse_level": "high",
    "flagged_ratio": 0.91,
    "flagged_ip_count": 1240,
    "total_announced_ips": 1364
  }
}

Field	Meaning
`abuse_score`	0–100, higher = worse
`abuse_level`	`none` / `low` / `medium` / `high` / `extreme`
`flagged_ratio`	Fraction of announced IPs we’ve seen as VPN/proxy
`flagged_ip_count`	Count of flagged IPs in this ASN
`total_announced_ips`	Total IPs the ASN announces via BGP

Intro and Starter tiers see only abuse_score and abuse_level. Pro and above see the full breakdown.

Leaderboard

Get the top abuse-density ASNs:

curl "https://vpn-proxy-detection.whoisxmlapi.com/api/v1/stats/asn-abuse?limit=100&apiKey=$WXA_API_KEY"

Sorted descending by abuse_score. Useful for:

Identifying networks worth blocking outright at the WAF
Compiling abuse-reporting evidence for IRTs
Peering / transit decisions

What it doesn’t tell you

The score is statistical, not a per-IP verdict. A 91 % flagged ASN still has 9 % clean traffic — don’t block-by-ASN unless you’ve quantified your false-positive tolerance. For application traffic, prefer per-IP classifications and use the ASN score as a contextual signal.

Refresh cadence

ASN abuse scores are recomputed daily from the live observation graph. Drift over a 24-hour window is typically under 2 abuse points — call it stable for triage purposes.

Getting Started

Guides

Reference

Lookup

Aggregates

Bulk Exports

Single IP

Leaderboard

What it doesn’t tell you

Refresh cadence

​Single IP

​Leaderboard

​What it doesn’t tell you

​Refresh cadence

Single IP

Leaderboard

What it doesn’t tell you

Refresh cadence