Requesting INFO : Why the ASNs 16509 , 8075 and 14618 are in this bad ASN list?

[AtulDureja]

Hello, I am building a Splunk query where I am checking if our network has any events which involve bad ASNs. I chose this popular list from GitHub but noticed there are various (good) ASNs in the list that are actually legit.

Example: The ASNs 16509 , 8075 and 14618 appear legit and safe with good reputation. Please find the details below:

ASNumber: 16509
ASName: AMAZON-02
ASHandle: AS16509
RegDate: 2000-05-04
Updated: 2012-03-02
Ref: https://rdap.arin.net/registry/autnum/16509

ASNumber: 8068 - 8075
ASName: MICROSOFT-CORP-MSN-AS-BLOCK
ASHandle: AS8068
RegDate: 1997-03-31
Updated: 2013-09-04
Ref: https://rdap.arin.net/registry/autnum/8068

ASNumber: 14618
ASName: AMAZON-AES
ASHandle: AS14618
RegDate: 2005-11-04
Updated: 2012-03-02
Ref: https://rdap.arin.net/registry/autnum/14618

Please help me understand the reason for this. Just wondering if this list is obsolete!

Thanks

[AnushK-Fro]

A lot of the companies on this list are legitimate.

The reason why it's likely on the list is that IPs from those ASNs are most likely from AWS or Azure (meaning that they are rented servers/cloud infrastructure). No residential (or "real") user will likely have an IP address from Microsoft or Amazon when connecting to your website.

I receive brute force attempts from both Microsoft and Amazon ASNs towards my servers, most likely due to compromised EC2/Azure instances.

This is more of a list of cloud providers, not necessarily companies acting in bad faith. Residential users are unlikely to connect to your service through a cloud provider, unless they are using some sort of VPN or something.

[AtulDureja]

I got your point @AnushK-Fro . Thanks for sharing the information.