This study examines how domain risk varies across a large set of autonomous system numbers (ASNs), using registered domains as the primary unit of analysis. DomainTools software helped by supplying Domain Risk Scores for each domain, enabling the team to calculate and compare risk distributions per ASN and identify networks that host disproportionately high‑risk or suspicious domains. Analysts leveraged Whois‑derived domain lists tied to specific ASNs and then applied DomainTools’ risk‑scoring and subscore components to highlight threat‑prone infrastructure. This approach accelerated identification of problematic hosting environments, supported prioritization of investigation efforts, and provided a data‑driven basis for blocking or monitoring high‑risk ASNs and their associated domains.

Join for free to read