AS0 Reserved ASN appearing in logs

Just been checking some logs and am seeing hundreds of entries for attacks from IP 143.198.171.118 which is resolving to AS0, a reserved ASN but also appears to be a DigitalOcean IP
I’m assuming I’m missing something here but is this correct: a reserved ASN IP being used?

Is this happening in Firewall Analytics? If so, could you please raise a support ticket with timestamps and rayIDs so that we could narrow down the root cause?

1 Like

I’m been seeing them regularly but partcularly noticed them in the analystics I’m doing on my Siteground logs, strangely they havent been back, so far, today, as I downloaded and processed the Siteground logs today this morning but was seeing the same AS0 in CloudFlare Firewall Overview where I first noticed it

They will probably be back soon so as soon as they come back I’ll get the info from the CloudFlare Firewall Overview and raise a ticket

I’ve seen against 20+ sites in the last month - same two IP’s attacking most mornings and afternoons

Raised a ticked, waited a few days, got a message back saying it was “solved”: thats it, no details, nothing appears to have been answered, just closed as “solved”

Update: Support now looking into the issue

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.

Note that IP addresses get their ASN updated at a different frequency than Cloudflare updates. You’ll see here that the ASN for 143.198.171.118 was 0 on June 1st but then was updated to 14061 on June 2nd:

https://bgpranking-ng.circl.lu/ipasn_history/?ip=143.198.171.118&date=2021-06-01
https://bgpranking-ng.circl.lu/ipasn_history/?ip=143.198.171.118&date=2021-06-02