Step-by-step: Creating a custom rule to block requests from specific ASNs.

Alright, let's talk about ASN blocking. Everyone's quick to slap on a geo-blocking rule, but that's about as subtle as a sledgehammer. Geo-blocks miss the big, roaming clouds of bad traffic hosted in "good" countries, and they unfairly punish legitimate users from places you've arbitrarily decided are suspicious.

So you want to be surgical. You want to hit the *network*, not the nation. Blocking by Autonomous System Number (ASN) lets you target specific hosting providers, cloud platforms, or known bulletproof hosting services where the junk traffic actually originates. It's a scalpel compared to the geo-blocking blunt instrument.

Here's the simple, free-tier WAF rule you can cook up in a minute:
`(cf.threat_score gt 14 and ip.geoip.asnum in {12345 67890})`
Breakdown: You're catching requests where Cloudflare's threat score is already elevated **and** the request comes from a network (ASN) you've identified as problematic. The threat score check keeps it from being too aggressive. You need to populate that ASN list yourself—do some digging in your security events tab to see where your persistent bots are coming from, or look up known bad-actor hosting ASNs. The numbers `12345` and `67890` are just placeholders.

Is this a silver bullet? No. Smart attackers hop networks. But it's a fantastic, zero-cost way to cut down on a huge chunk of automated noise without resorting to broad country bans. It turns your WAF from a bouncer at a club door into a detective with a file on specific troublemakers.

― Finn