How-to
Reading an ASN Detail Page
Mitigation banner, status-code panel, firewall actions, cache outcome, top paths, alert history, and the Suggest rule button — what every panel tells you.
Jump to section
Every row on the Offenders page drills into a per-ASN detail view. Use it when you need to answer: "is this ASN being mitigated, and is the mitigation appropriate?"
Network identity
Below the header, a Network identity panel shows who the network really is: the brand behind its registered name (e.g. Cyberzone S.A. operating as Surfshark), its parent group, and a short note, drawn from Blankitt's shared directory. Your team can also add its own alias, note and tags here. See Naming and Annotating Networks. It's context only, never a rule.
Edge-mitigation banner (top of page)
The red "This ASN is being mitigated at the edge" banner appears when either of these signals trips:
- ≥ 50% of requests matched a mitigating firewall action (block, challenge, or connection close)
- ≥ 50% of requests didn't reach a cache decision (typical of edge-layer blocks)
The banner is silent when only monitor-mode rules (log / allow) are matching, because those don't actually interfere with the request. A residential ISP showing 100% log matches is not "blocked" — it's being observed by an analytics rule.
Suggest rule
The page header has a Suggest rule button. Click it and Edge drafts the same guided-response rule an alert would carry for this network: the exact eCDN expression, the recommended action (challenge-first), and the caveats to read before using it. You can copy it straight into Business Manager. One-click apply stays tied to an open alert; if this ASN has one, the card links you to it.
Stat tiles
- Total requests — count for this ASN, with share-of-total
- 499 rate — share where the client gave up (scraper signature)
- Cache bypass rate — share that went to origin instead of cache
- 499 count — raw count of 499 responses
- Hit rate — cache-hit share. Renders "—" when cache outcomes are dominated by unknown (typical of edge-blocked ASNs — see banner above)
- Egress bytes — total bytes returned to clients
- Bytes per request — typical browsing is 30–80 kB; under 8 kB suggests JSON-API scraping; over 500 kB is bulk asset leeching
- Share of total — this ASN's percentage of the site's overall traffic
Requests over time
Stacked status-class timeseries with a dashed Site-wide baseline overlay. Alert markers (red dashed lines) show when detectors fired on this ASN.
Cache outcome breakdown
How the cache treated this ASN's requests. Hits are good; dynamic / miss / expired mean origin was hit. A large "unknown" share is the edge-block signature.
HTTP status codes
Specific status codes returned: 403 (WAF block), 404 (path not found), 429 (rate-limited), 499 (client hung up), 500/502/504 (origin error), 530 (blocked at the edge). Stacked bar with chip legend showing exact counts per code.
What the codes tell you on a blocked ASN:
- 403 dominant — the request was hard-rejected
- 530 dominant — blocked at the edge (rule, rate-limit, bot challenge)
- 500/502/504 dominant — scanner found a real endpoint that's crashing or timing out (worst case — investigate what's broken)
- 404 dominant — path doesn't exist; if combined with high distinct-path-count, the ASN is probing
Firewall actions
What the edge firewall did with each request, broken down by action (none, log, allow, challenge variants, block, connection close). The panel headline summarises in one of five tiers: Heavily mitigated (≥80%), Mitigated (≥30%), Partial mitigation (>0%), Monitor mode (rules matching but not enforcing), Unfiltered (no rules matching).
Top path prefixes
Top paths this ASN was hitting in the window. On low-volume ASNs the list may be short — the drill-down keeps the highest-traffic combinations per batch.
User-agent versions
Both family and version-specific bars. A normal browser population clusters sharply on the latest 1–2 versions; a long, evenly-distributed tail (Chrome/116, /117, /118, /119, /120 with comparable shares) is a classic rotation signature.
Top IPs in this ASN
Up to ~24 distinct IPs captured for this ASN. "—" means the ASN's IPs didn't crack the top-N capture (low ASN volume); spin up an IP discovery window if you need full coverage for forensics.
Probe & scanner activity (when present)
If this ASN has triggered any classified probe paths (WordPress, env_secrets, git_repo, webshell, sql_dump, admin_panel, tenant_targeted), a Probe Panel renders. See Probe & Scanner Detection for family definitions.
Alert history
Last 30 days of alerts for this ASN. Stacked bar by detector kind on top, full chronological list below. Click to drill into the alert.
Pin / Ignore actions
Pin floats this ASN to the top of Offenders. Ignore hides it. Both are saved to your workspace and shared with your whole team.