AS203

AS203 is a legacy autonomous system number registered under ARIN to Level 3 Parent, LLC, the corporate entity preserved in ARIN records after CenturyLink acquired Level 3 Communications in 2017 and later rebranded as Lumen Technologies. The ARIN name CENTURYLINK-LEGACY-LVLT-203 reflects that acquisition history, with the LVLT token echoing Level 3's former NASDAQ ticker. Unlike Merit's dormant AS181, AS203 is actively routed but functions as a pure customer stub: CAIDA reports a total degree of 1 (one upstream provider, zero peers, zero customers), and RIPEstat observes a single BGP neighbour. It originates roughly 122 IPv4 prefixes (about 174,592 addresses) and a single IPv6 prefix; the Lumen/Level 3 go-forward backbone is AS3356, not AS203, so this number carries residual legacy address space rather than primary operations. The one notable security event in the public record is an October 2020 routing incident, reported on NANOG and analyzed by Qrator, in which AS203 announced 158 prefixes it was not the legitimate origin for, generating over 1,100 routing conflicts across 31 ISPs in 19 countries; the root cause (Lumen misconfiguration versus external exploitation of missing prefix filters) was never publicly confirmed, and Lumen closed its internal ticket as no-fault. RPKI coverage on this block is poor, with roughly 80 prefixes carrying IRR origin-mismatch flags. No spam or malware blacklist presence was confirmed for AS203 specifically as of 2026-06-19, though several feeds could not be queried directly.

Operator

Level 3 Parent, LLC (subsidiary of Lumen Technologies, NYSE: LUMN; formerly CenturyLink/Level 3) [Confirmed] — ARIN RDAP, lumen.com/en-us/about.html

Country / RIR

US, ARIN [Confirmed] — ARIN RDAP autnum/203

Allocated

2002-06-05 (ARIN registry date from autnum top-level registration event, NOT an IEEE date — IEEE publishes no ASN dates); last changed 2019-12-04 [Confirmed] — ARIN RDAP autnum top-level events (two angles: A2, A3)

Org status

active corporate entity; Level 3 Parent, LLC preserved in ARIN records, subsidiary of Lumen Technologies Inc (HQ Broomfield, CO) [Confirmed] — ARIN RDAP, en.wikipedia.org/wiki/Lumen_Technologies

Contacts

abuse@level3.com (also abuse@aup.lumen.com); admin ipadmin@lumen.com / ipadmin@centurylink.com; looking glass lookingglass.centurylink.com; registered address 100 CenturyLink Drive, Monroe, LA 71203 [Confirmed] — ARIN RDAP entities (LAC56-ARIN, APL7-ARIN)

Security/abuse context (DATED)

one documented routing incident on 2020-10-21 — AS203 announced 158 prefixes it was not origin for, 1,100+ conflicts, 31 ISPs / 19 countries; root cause (misconfig vs. hijack) unconfirmed, Lumen claimed no fault. Academic AP2Vec (IEEE 2022) flagged a similar AS203 anomaly. No confirmed spam/malware blacklist presence as of 2026-06-19 (some feeds returned 403 and could not be queried) [Confirmed for the 2020 incident; Unknown for blacklist status due to feed access limits] — seclists.org/nanog/2020/Oct/314, blog.qrator.net, radar.qrator.net/as203, ieeexplore.ieee.org/document/9754706/

Network & routing

Network type

legacy stub AS within the Lumen/Level 3 Tier 1 estate; carries residual Level 3 IPv4 space, not the primary operational ASN [Confirmed] — ipinfo.io/AS203, bgp.he.net/AS203

Size

~122 IPv4 prefixes / ~174,592 IPv4 addresses; 1 IPv6 prefix (example 2804:cf4::/32). Source ranges vary (bgp.he.net ~123, ip2location ~130) [Confirmed for RIPEstat counts; Likely for the cross-source range] — RIPEstat routing-status, bgp.he.net, ipinfo.io

Routing/topology

pure customer stub — CAIDA degree total 1 (provider 1, customer 0, peer 0); RIPEstat observes 1 BGP neighbour. Sole upstream is AS3356 (Level 3 Parent, LLC itself) [Confirmed for stub topology via A3 CAIDA + RIPEstat; AS3356 upstream Likely — A2 names it, canonical CAIDA returns degree only]

Peering policy

no independent AS203 policy (not a standalone PeeringDB entry); the parent Lumen policy is Selective with high thresholds (e.g. 500 Gbps / 1,000 ASNs global, RPKI filtering) and discretionary [Confirmed for org policy; AS203 itself not separately listed] — lumen.com/en-us/about/legal/peering-policy.html, peeringdb.com/org/682

RPKI

poor coverage — ~80 prefixes flagged IRR "Parent Route Origin Mismatch"; RPKI-ROA contact RPKIR-ARIN registered 2024-06-17 (rpki-roa@lumen.com) indicates active ROA operations but incomplete validity on this block [Likely] — bgp.tools/as/203, bgp.he.net/AS203, ARIN RDAP entity/RPKIR-ARIN

Notable usage

legacy Level 3 Communications block pre-dating the 2017 CenturyLink acquisition; Level 3 was historically a major Tier 1 backbone and CDN transit carrier. Go-forward Lumen internet platform is AS3356 — en.wikipedia.org/wiki/Level_3_Communications, bgp.he.net/AS203

Related ASNs

AS3356 (Lumen/Level 3 primary backbone and AS203's upstream) [Confirmed for relationship; identity of upstream Likely per A2]

ARIN name / org handle

CENTURYLINK-LEGACY-LVLT-203 / org LPL-141 [Confirmed] — ARIN RDAP autnum/203

Visibility

full RIS v4 visibility (327/327 peers); minimal v6 (15/323 peers); CAIDA rank 13,154; customer cone 1 ASN / 128 prefixes / ~116,320 addresses [Confirmed] — RIPEstat routing-status, CAIDA AS Rank

Analyst note

actively-routed legacy stub. Topology facts (stub, 1 upstream) are double-confirmed by CAIDA and RIPEstat; the upstream's identity as AS3356 is from operator/community sources, not the canonical degree data, so tagged Likely. The 2020 incident is well-sourced but attribution stays open.