AS19281

AS19281 is the autonomous system behind Quad9, the free public DNS resolver reachable at 9.9.9.9 and 149.112.112.112. The ASN is registered under ARIN to CleanerDNS Inc. (doing business as Quad9, OrgId CLEAN-97, registered in Berkeley, California) since September 2017, though Quad9 operates today as a Swiss-headquartered non-profit foundation based in Zurich. This is recursive-resolver anycast infrastructure, not an access or hosting network: it announces only a tiny set of service prefixes (about five IPv4 and three IPv6, including 9.9.9.0/24) yet serves them from 230+ anycast locations across 100+ countries, in partnership with Packet Clearing House / WoodyNet (AS42), which provides transit and global anycast nodes. The anycast service is also enrolled in the AS-QUAD9-ANYCAST set alongside AS398892. Quad9 distinguishes itself by blocking known-malicious domains at resolution time and by a privacy-respecting no-logging posture. For triage, traffic *from* a Quad9 address is DNS resolution on behalf of clients — an inbound hit from 9.9.9.x is the resolver, not an attacker — so it should be treated as trusted public-resolver anycast and never as eyeball or hosting space. No notable public abuse signal is associated with the network as of June 2026.

Operator

Quad9 / CleanerDNS Inc. dba Quad9 (ARIN OrgId CLEAN-97) [Confirmed] — ARIN RDAP/WHOIS

Country / RIR

US (registered, Berkeley CA), ARIN [Confirmed] — ARIN RDAP; operationally a Swiss non-profit (Zurich) [Likely] — quad9.net

Allocated

2017-09-13 (ASN RegDate; org 2017-09-07) [Confirmed] — ARIN RDAP

Org status

active non-profit (Quad9 Foundation, Zurich) [Likely] — quad9.net

Security/abuse context

recursive-resolver anycast with malware-domain filtering; traffic from these IPs is DNS resolution, not end-user browsing. Privacy-respecting non-profit. No notable public abuse signal as of 2026-06-04 — quad9.net

Network & routing

Network type

public DNS resolver / anycast [Confirmed] — PeeringDB + bgp.tools ("Content / CDN Anycast")

Size

~5 IPv4 prefixes (~1,280 addrs incl. 9.9.9.0/24), ~3 IPv6; ~16–19 peers; ~14 upstreams — bgp.he.net (2026-05/06)

Routing/peering

anycast in 230+ locations across 100+ countries (per Quad9 PeeringDB); transit/global nodes via PCH/WoodyNet (AS42); RPKI-valid ROA on 9.9.9.0/24 (small invalid counts on some prefixes) — quad9.net, peeringdb.com/asn/19281, bgp.he.net

Notable usage

free security-filtering public DNS resolver (9.9.9.9 / 149.112.112.112) — quad9.net

Related ASNs

AS398892 (AS-QUAD9-ANYCAST); anycast/transit partner AS42 (PCH/WoodyNet)

Analyst note

Seeing 9.9.9.9 / 149.112.112.112 means a client used Quad9 for DNS; treat as trusted public-resolver anycast, never as eyeball or hosting.