> ## Documentation Index
> Fetch the complete documentation index at: https://vpn-docs.wxapros.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ASN Abuse

> Triage abuse-density at the autonomous system level.

The ASN abuse score reflects what fraction of an ASN's announced IP space
is currently classified as VPN, proxy, or other anonymizer. High scores
flag networks where most traffic is anonymized — useful for peering
decisions, traffic prioritization, and bulk filtering.

## Single IP

Every IP lookup returns an `asn_abuse` block when the originating ASN is
known:

```json theme={null}
{
  "ip": "45.83.236.X",
  "asn": 209590,
  "asn_org": "GLOBALCONNECT",
  "asn_abuse": {
    "abuse_score": 87,
    "abuse_level": "high",
    "flagged_ratio": 0.91,
    "flagged_ip_count": 1240,
    "total_announced_ips": 1364
  }
}
```

| Field                 | Meaning                                           |
| --------------------- | ------------------------------------------------- |
| `abuse_score`         | 0–100, higher = worse                             |
| `abuse_level`         | `none` / `low` / `medium` / `high` / `extreme`    |
| `flagged_ratio`       | Fraction of announced IPs we've seen as VPN/proxy |
| `flagged_ip_count`    | Count of flagged IPs in this ASN                  |
| `total_announced_ips` | Total IPs the ASN announces via BGP               |

Intro and Starter tiers see only `abuse_score` and `abuse_level`. Pro and
above see the full breakdown.

## Leaderboard

Get the top abuse-density ASNs:

```bash theme={null}
curl "https://vpn-proxy-detection.whoisxmlapi.com/api/v1/stats/asn-abuse?limit=100&apiKey=$WXA_API_KEY"
```

Sorted descending by `abuse_score`. Useful for:

* Identifying networks worth blocking outright at the WAF
* Compiling abuse-reporting evidence for IRTs
* Peering / transit decisions

## What it doesn't tell you

The score is **statistical**, not a per-IP verdict. A 91 % flagged ASN
still has 9 % clean traffic — don't block-by-ASN unless you've quantified
your false-positive tolerance. For application traffic, prefer per-IP
classifications and use the ASN score as a contextual signal.

## Refresh cadence

ASN abuse scores are recomputed daily from the live observation graph.
Drift over a 24-hour window is typically under 2 abuse points — call it
stable for triage purposes.