Skip to main content
The ASN abuse score is a 0–100 rating of how much of our detection data falls in an ASN. It combines how many of our classified range records fall in the ASN, relative to the size of its announced IPv4 space, which classes those are (Tor, VPN and proxy count for more than hosting, CDN or relay), how long those detections have lasted, and whether new ones keep appearing, adjusted for the kind of network the ASN is (for example residential or hosting). It is not a percentage: a high score does not mean that most of the network, or most of its traffic, is anonymized. Use the score for peering decisions, traffic prioritization and bulk filtering.

​
Single IP

Every IP lookup returns an asn_abuse block when we hold an abuse score for the originating ASN, and null otherwise:
Intro and Starter tiers see only abuse_score and abuse_level. Pro and above see the full breakdown.

​
One ASN

From Pro, look up one ASN’s score with the per-class counts behind it:
The counts are our classified range entries in the ASN, each counted once whatever its size, so they are not address counts. See ASN reputation for every field.

​
Leaderboard

Get the top abuse-density ASNs:
Sorted descending by abuse_score. Useful for:
  • Identifying networks worth blocking outright at the WAF
  • Compiling abuse-reporting evidence for IRTs
  • Peering / transit decisions

​
What it doesn’t tell you

The score is statistical, not a per-IP verdict. flagged_ratio is an estimate from our flagged range entries (each entry counts once, whatever its size) against the ASN’s announced IPv4 addresses, so it is neither a share of addresses nor a share of traffic. A flagged entry can also be hosting or CDN rather than an anonymizer. Don’t block by ASN unless you’ve quantified your false-positive tolerance. For application traffic, prefer per-IP classifications and use the ASN score as a contextual signal.

​
Refresh cadence

ASN abuse scores are recomputed daily from the live observation graph. Drift over a 24-hour window is typically under 2 abuse points — call it stable for triage purposes.