The problem with IP blacklists
IP blacklisting works like this: a bad actor sends spam from IP address 1.2.3.4, that IP gets added to a blacklist, and future mail from that IP gets blocked. It sounds logical. The problem is that IP addresses are cheap and disposable. An attacker who gets blocked simply switches to a new IP and is clean again within minutes. Blacklists are always catching up to yesterday's attackers.
What is an ASN?
An ASN (Autonomous System Number) is a unique identifier assigned to a network operator. When an ISP, hosting provider, or large organisation connects to the internet, they get an ASN. All the IP addresses they operate sit under that ASN. Think of an ASN as the landlord, and IP addresses as individual apartments. Attackers rotate apartments constantly. But they rarely move to a different building.
Why attackers can't easily switch ASNs
Getting a new IP address takes seconds. Getting a new ASN, or renting infrastructure under a different one, takes time, money, and a relationship with a new provider. It's not impossible, but it's expensive enough that most attackers don't bother. This means that when an ASN develops a bad reputation, that reputation sticks in a way that IP reputation never could.
How MX Moat uses ASN scoring
When a connection arrives at the MX Moat gateway, the sender's IP is looked up against the Team Cymru DNS API in real time to retrieve its ASN. That ASN is then checked against our reputation database, which scores ASNs on a scale from -100 (blocked) to +100 (trusted) based on historical behaviour. A neutral or unknown ASN gets a small window to prove itself: a few emails, with greylisting applied. A suspicious ASN gets heavily rate-limited. A blocked ASN gets rejected at the connection level before any email is even transferred.
The result
Because ASN reputation persists across IP rotations, MX Moat can identify and throttle bad actors even when they switch IPs, which is exactly what happens during a registration bomb attack. The ASNs behind most bomb attacks are the same ones behind other spam campaigns. By the time they reach a new target, MX Moat already has their number.