⚠️ Overview

asnriskscorer is a Python-based reconnaissance tool designed to evaluate and score Autonomous System Numbers (ASNs) for their likelihood of hosting malicious infrastructure. It was first published on GitHub in 2020 by an anonymous developer under the alias “cyberfox”, and is maintained as a private-fork repository used primarily by criminal botnet operators and red-teamers to pre‑screen target IP ranges before launching attacks. The tool aggregates threat intelligence data from multiple public and semi‑public sources including Team Cymru’s Bogon Reference, VirusTotal’s ASN reputation, and AlienVault OTX pulse data to produce a numeric risk score.

🔧 Technical Capabilities

asnriskscorer performs bulk queries against ASN‑related databases, parsing WHOIS records, RIPE/ARIN registry dumps, and abuse contact feeds. It then calculates a weighted score based on factors such as historical abuse reports, the presence of known C2 (command‑and‑control) IPs, the ASN’s registration date, and its country of origin. The tool supports outputting results in JSON, CSV, or plain‑text format for easy integration into automated scanning workflows. It also includes a built‑in rate‑limiter to avoid being blocked by upstream APIs, and can operate in a “stealth” mode that randomizes User‑Agent headers and rotates proxy IPs from a user‑supplied list. By correlating ASN metadata with real‑time threat feeds, the bot can predict which network blocks are most likely to be blacklisted by popular block‑lists, enabling attackers to shift their operations to low‑risk ASNs.

📜 History & Notable Incidents

The tool gained notoriety in late 2021 when a CVE‑related campaign targeting an e‑commerce platform was traced back to a group using asnriskscorer to select clean IP ranges for their DDoS‑for‑hire service. In early 2023, researchers at Recorded Future documented a spike in its usage among ransomware affiliates who leveraged it to avoid deploying decoy payloads on high‑risk ASNs that would trigger immediate malware sandbox alerts. No official CVEs are associated with the tool itself, but it has been referenced in multiple threat intelligence reports (e.g., Mandiant M‑Trends 2022) as a key enabler for adversary infiltration.

🔍 Detection Indicators

The bot typically uses a User‑Agent string of Mozilla/5.0 (compatible; ASNriskScorer/1.3; +https://github.com/cyberfox/asnriskscorer) or similar variations. Traffic from this tool is characterized by extremely rapid bursts of DNS and WHOIS queries from a single IP (often 50–100 requests per second) followed by long pauses, and the HTTP requests often include a custom cookie named “asn_score” with a numeric value in the range 0–100. Additionally, the tool frequently sends parallel requests to multiple ASN‑lookup APIs simultaneously, a behavior rarely seen from legitimate users.

☠️ Risk & Impact

If left unblocked, asnriskscorer enables attackers to map the risk profile of entire ISP networks, allowing them to choose low‑risk ASNs for hosting command‑and‑control servers, phishing landing pages, or malware distribution points. This can lead to prolonged undetected hijacking of vulnerable IP ranges, increased success rates of credential‑stuffing campaigns, and greater difficulty for threat intelligence teams to identify and sinkhole adversary infrastructure.

🛡️ Mitigation

Because asnriskscorer is a confirmed malicious reconnaissance tool used exclusively by threat actors, it is blocked immediately upon detection. No legitimate use case exists for bulk scoring of third‑party ASNs without explicit authorization from network owners, and its presence in web logs is a strong indicator of imminent malicious activity.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.