AS12389

AS12389 is the core network of Rostelecom, Russia's largest fixed-line and backbone operator and a major eyeball ISP, registered under RIPE to PJSC Rostelecom. It originates roughly 3,300 IPv4 prefixes (~9.5 million addresses) and ~558 IPv6 prefixes, runs traffic in the 10–20 Tbps range, and is by far the largest customer cone in Russia — CAIDA ranks it #18 globally with a cone of 4,039 ASNs, 66,693 prefixes, and ~73.2 million addresses. It takes transit and peering from a broad set of international carriers including Cogent, Arelion, GTT, Hurricane Electric, and PCCW, and is present at 18 IXPs with a selective peering policy. For triage, an address here is typically Russian residential or business traffic on shared/dynamic addressing, so the usual eyeball caveats apply. What sets AS12389 apart for analysts is its documented BGP history: a brief April 2017 event in which it originated dozens of prefixes belonging to other networks (including financial-sector firms), and a much larger April 1, 2020 incident that leaked thousands of prefixes belonging to around 200 networks, propagating onward and briefly affecting major cloud and CDN operators. Both were widely framed as route leaks or possible hijacks rather than confirmed malice, and both are reasons to prefer RPKI-validated paths and monitor origin changes.

Operator

PJSC Rostelecom (RIPE owner ru.rtk) [Confirmed] — RIPE WHOIS

Country / RIR

RU, RIPE [Confirmed] — RIPE WHOIS

Allocated

2005-07-01 [Confirmed] — bgp.tools

Org status

active; ~49% Russian-state-owned [Confirmed/Likely] — company.rt.ru

Security/abuse context (DATED, NEUTRAL)

documented BGP routing incidents framed as route leaks / possible hijacks, not confirmed malice. (1) 2017-04-26 (~22:36–22:43 UTC): AS12389 originated ~50 prefixes belonging to ~37 ASes incl. financial firms (Visa/Mastercard/Verisign/Symantec) for ~5–7 min (BGPmon). (2) 2020-04-01 (~19:28 UTC): leak affecting ~8,870 prefixes / ~200 ASes (Qrator); ~4,569 propagated via AS20764 Rascom → Cogent, impacting Amazon/Akamai/Alibaba/DigitalOcean/Linode (MANRS). Standard eyeball shared/dynamic-IP caveat also applies — bgpmon.net, blog.qrator.net, manrs.org

Network & routing

Network type

ISP-eyeball + transit-backbone (PeeringDB "NSP") [Confirmed]

Size

~3,328 IPv4 prefixes originated (~22,949 announced; ~9.5M addrs), ~558 IPv6 — bgp.he.net (2026-06)

Routing/peering

upstreams/peers incl. AS174 (Cogent), AS1299 (Arelion), AS3257 (GTT), AS6939 (HE), AS3491 (PCCW), AS6762 (Sparkle), AS5511 (Orange), AS1273 (Vodafone); 18 IXPs; selective peering; RPKI ~3,244 v4 valid, 46 v4 invalid, 276 v6 invalid — bgp.he.net, peeringdb.com

Notable usage

core network of Russia's largest fixed-line/backbone operator and major eyeball ISP; ~10–20 Tbps, mostly inbound — company.rt.ru

Related ASNs

AS42610 (NCNET / National Cable Networks, a Rostelecom company); Rostelecom telecom ASNs noted in the 2017 incident (AS29456, AS21378, AS13056, AS13118, AS8570)

Analyst note

Russian residential/business traffic on shared/dynamic addressing. Given the 2017/2020 BGP incidents, enable route-origin/path monitoring and prefer RPKI-validated paths; alert on unexpected origin changes.