ASN Classification

The ASN classification checker examines the Autonomous System (AS) network of the client IP. BGP routing data classifies each AS as Content (hosting, CDN, or cloud provider), Eyeballs (residential or business ISP), or Unknown. Hosting networks are a primary source of bot traffic because they provide cheap, anonymous compute resources. Low-visibility ASNs (those with few advertised routes) are characteristic of residential proxy services.

This checker runs in the cheap phase using the pre-loaded asn.mmdb database.

How It Works

The checker reads the AS classification from the BGP lookup result (ctx.geoData.hosting). If the AS is classified as Content, it applies the contentClassification penalty. If the classification is Unknown, it applies unknownClassification.

The checker also counts the number of BGP routes visible for the AS. When the route count falls below lowVisibilityThreshold, it applies lowVisibilityPenalty. Route count is a meaningful signal because residential proxy networks often maintain only a handful of visible prefixes.

If an IP is both hosting-classified and below the visibility threshold, an additional comboHostingLowVisibility bonus penalty fires. This combination is highly characteristic of VPS-based proxy infrastructure.

Configuration

await defineConfiguration({
  store: { main: { driver: 'sqlite', name: './bot-detector.db' } },
  checkers: {
    enableAsnClassification: {
      enable: true,
      penalties: {
        contentClassification: 20,
        unknownClassification: 10,
        lowVisibilityPenalty: 10,
        lowVisibilityThreshold: 15,
        comboHostingLowVisibility: 20,
      },
    },
  },
})

All weights live inside the penalties: {} sub-object.

Reason Codes