Blocking by ASN and country: cutting off a network, not an address

What an ASN actually is

The internet is not one network. It is tens of thousands of them, each run by somebody who decides how traffic enters and leaves. Every one of those networks carries a number — its Autonomous System Number — and every public IP address belongs to exactly one of them at any given moment.

That number is the useful unit. A hosting company may hold hundreds of thousands of addresses spread across ranges that look unrelated to each other, but they sit under one ASN or a handful. A mobile operator does the same for its subscribers. So when you ask "where is this request really coming from", the address tells you which machine, and the ASN tells you which organisation put that machine on the internet.

The distinction is the entire value. An abusive client can change address trivially — it is a button in a cloud console, and your carefully built IP list is stale within the hour. Changing ASN means changing supplier.

Finding the network behind a request

You start from an address in your logs and turn it into a network. The quickest way is a single whois query.

One address, one lookup, one network

# Team Cymru's whois service: address -> ASN, network name, country
whois -h whois.cymru.com " -v 203.0.113.10"

Reading the answer before you act on it

The lookup gives you the ASN, the organisation holding it and the country it is registered in. bgp.he.net shows the same information in a browser plus every range that network announces, which is worth a glance before you block anything: if the organisation is a large consumer ISP, the size of its address space makes that obvious immediately.

Do the lookup on several addresses, not one. A pattern only counts as a pattern when the same ASN keeps coming back. If fifty offending addresses map to fifty different networks, you are not looking at a provider you can block — you are looking at a botnet, and a rate limit or a WAF rule will serve you far better than any list.

Look at what the traffic asks for, too. A single network pulling your entire product catalogue every night is a scraper. The same network fetching one URL per customer is somebody's integration, and blocking it produces a phone call rather than a quiet improvement.

IP, ASN, country: three different questions

These are not three strengths of one tool. They answer different things, and picking the wrong one is how a block ends up costing more than the abuse did.

An IP block answers "this exact machine is a problem". It is precise and temporary by nature: use it for a specific abusive host, an attack in progress, or while you are still working out what the pattern is.

An ASN block answers "nothing legitimate reaches me from this network". That is frequently true of hosting and cloud providers — your customers browse from ISPs and mobile carriers, while scrapers, vulnerability scanners and credential-stuffing scripts run on rented servers. Blocking the network behind them survives their address changes, which is the one thing an IP block cannot do.

A country block answers "we do not serve this market". It is the bluntest of the three and the only one that expresses a business rule rather than a technical observation: a shop that ships to two countries, a service under a licence limited to one. As a security control on its own it is weak, because an attacker moves through a server somewhere else in seconds and a real customer travelling abroad does not.

The instinct that holds up: block a country for business reasons, block an ASN for behavioural ones, block an IP while you are still deciding which of the two you are looking at.

What the edge does with the list

Both lists are enforced at the edge, which is what makes them cheap. The edge resolves the visitor's address to a country and an ASN using a local database — MaxMind's GeoLite2, refreshed automatically on our edge nodes, so there is no lookup over the network in the request path and nothing for you to keep up to date.

If the address matches a list, the request is answered on the spot with a branded 403 page carrying a Reference ID. Your origin never sees the connection: no worker occupied, no database query, no bandwidth off your server. That is the difference between blocking at the edge and blocking inside your application, and it is the reason the block holds up exactly when it matters, under load.

The Reference ID matters more than it looks. When somebody tells you they cannot reach your site, that ID is how you find their exact request in the logs and answer "your network is on the blocklist" instead of guessing at it for an afternoon.

Setting it up in the panel

Open Delivery rules → Security presets in the panel — /management/cdn/advanced-management. Two managers sit side by side there: the Country Blacklist Manager and the ASN Blacklist Manager.

For a country, pick it from the list and save. For a network, enter the ASN as a plain number: 12735, not AS12735; several networks go in one comma-separated list (12735, 47331). The list holds up to 200 entries, and 0 is rejected on purpose — see the caveats below.

Then verify with something that genuinely comes from the blocked network rather than from your own connection: a host inside that cloud, a proxy, or a colleague on that carrier. The right result is the branded 403 page from there, and an ordinary 200 from everywhere else. Blocking is quiet enough to fool you into thinking it did not work, because your own request is almost never from the network you just blocked.

Doing it from the API

Both lists are available over the REST API with a bearer token, which is what you want if you keep them in version control or wire them to your own abuse detection. The update call sets the list to exactly what you send, so read it first and post the full list rather than only the addition.

Read the current list, then replace it

# what is on the list now
curl -s -H "Authorization: Bearer $TOKEN" \
  https://cdn.com.tr/api/accounts/<account-uuid>/asn_blacklist

# replace it with exactly these two networks
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"listType":"blacklist","asns":[12735,47331]}' \
  https://cdn.com.tr/api/accounts/<account-uuid>/asn_blacklist_update

The caveats that decide whether this is a good idea

Consumer ISPs and mobile carriers are millions of people. A single mobile operator's ASN can cover a large share of a country's phones. Blocking it does not block an attacker; it blocks a market segment, and the support tickets will not mention the word ASN.

CDNs, VPNs and corporate proxies hide the real origin. When a request arrives through another CDN or a VPN, the ASN you see belongs to that intermediary. Blocking it removes everyone using that service, including privacy-minded customers and remote employees on a company VPN.

Hosting ASNs also carry traffic you want. Payment webhooks, uptime monitors, link previews from chat apps, partner integrations and search engine crawlers all run on rented servers. Before blocking a cloud provider wholesale, find out which of your own integrations lives there.

ASN 0 cannot be blocked. It is what the database returns when an address maps to no known network, so it is not a network at all — blocking it would mean blocking "everything we could not identify". Traffic that resolves to it has to be handled by behaviour, with a rate limit or a WAF rule, not by a list.

Networks change hands. An ASN is not a permanent description of who is behind it. A list nobody has reviewed in two years is a list you no longer understand.

A sane order of escalation

When something abusive shows up, reach for the cheapest control that matches the shape of the problem — and describe the shape honestly first: how many addresses, how many networks, how fast, and what they ask for.

That description picks the tool. Many requests from few clients is a rate limit. Malicious-looking requests, however few, are a WAF rule. Enormous volume from everywhere at once is DDoS absorption. Only steady, deliberate traffic from one identifiable network is an ASN block — and a market you have decided not to serve is a country block.

Then make the block the narrowest one that works, write down why you added it, and look at what it cost you a week later. An entry with no reason recorded next to it is the one nobody dares remove two years from now, and every blocklist eventually accumulates them.