ASN Risk Report

September 2026 ASN risk report

methodology 2.0 · window 2026-09-01 → 2026-09-30 · 2,959 autonomous systems scored

What the report tells you

Every autonomous system observed by the HoneyDB sensor network during the month is scored from 0–100, so you can see which networks are genuinely hostile relative to their size — not just which ones are biggest. A large consumer ISP with thousands of noisy subscribers is a different problem from a small hosting network where a large share of its address space is attacking sensors.

• Density (weight 0.45) — observed attacking IPs as a share of the network's announced IPv4 space, log-scaled.
• Magnitude (weight 0.25) — how many distinct IPs were seen, log-scaled.
• Persistence (weight 0.15) — the share of the month's days the network was active.
• Breadth (weight 0.15) — how many distinct honeypot services its hosts probed, which separates a scanning farm from one compromised host.

The four are combined as a weighted geometric mean, so a network cannot score highly on one dimension alone.

Signed-in users get the full ranking with every underlying metric and month-over-month movement, plus a separate known scanners report — research and attack-surface crawlers are kept out of the ranking and listed as benign activity — and the whole dataset through the API.