AS209242

AS209242 is an active autonomous system number registered under RIPE NCC to Cloudflare London, LLC (RIPE org handle ORG-CLL6-RIPE), a UK-registered subsidiary of the publicly traded Cloudflare, Inc. (NYSE: NET). The RDAP name field is CLOUDFLARESPECTRUM, and both Cloudflare's own developer docs and third-party routing databases identify it as the dedicated ASN that backs Cloudflare Spectrum — Cloudflare's L3/L4 TCP/UDP reverse-proxy and DDoS-mitigation product — and its BYOIP (Bring Your Own IP) program, under which enterprise customers announce their own address space through Cloudflare's network. It is a child/stub ASN: every routing source consulted (RIPEstat, bgp.he.net, bgp.tools) agrees its sole observed upstream/neighbour is AS13335 (Cloudflare, Inc.), Cloudflare's primary network ASN. It originates roughly 306 IPv4 prefixes (~113,664 addresses) and 29 IPv6 prefixes, with 335 prefixes announced in total, and reaches effectively 100% of RIPE RIS peers, consistent with a global anycast deployment across Cloudflare Spectrum PoPs. CAIDA ranks it 13168 globally, with a customer cone of 1 ASN, ~301 prefixes, and ~112,640 addresses. RPKI coverage is partial — most prefixes carry valid ROAs (about 168 IPv4 and 18 IPv6) while a handful (11 IPv4) are RPKI-invalid and bgp.he.net flags two bogon prefixes, both consistent with BYOIP customer-onboarding edge cases rather than abuse. No notable public abuse signal was found as of 2026-06-25: AS209242 is absent from the Spamhaus DROP and ASN-DROP lists and from the ipapi.is top-1,000 abusive-ASN list, and no AS209242-specific NANOG operator complaints or BGP incidents were located. The autnum top-level registration event is dated 2019-03-13, with the record last changed 2019-06-20 — both first-party RIPE NCC registry facts.

Operator

Cloudflare London, LLC (RIPE registrant ORG-CLL6-RIPE; parent Cloudflare, Inc., NYSE: NET) [Confirmed] — RIPE RDAP autnum, cloudflare.com/about-overview

Country / RIR

US (org address 101 Townsend Street, San Francisco, CA 94107); RIPE NCC [Confirmed] — RIPE RDAP autnum, RIPEstat rir-stats-country

Allocated

2019-03-13 (RIPE RDAP autnum top-level registration event, a first-party RIR fact — not an IEEE date); last changed 2019-06-20 [Confirmed] — RIPE RDAP autnum top-level events[]

AS name

CLOUDFLARESPECTRUM [Confirmed] — RIPE RDAP autnum, bgp.he.net/AS209242

Org status

parent Cloudflare, Inc. is a public company (NYSE: NET, IPO 2019-09-13); Cloudflare London, LLC is the RIPE-region registrant subsidiary; HQ 101 Townsend Street, San Francisco, CA 94107 [Confirmed] — cloudflare.com/about-overview, RIPE RDAP

Contacts

abuse@cloudflare.com; admin/tech contacts via Cloudflare Germany GmbH, Munich; abuse contact handle CF6885-RIPE [Confirmed] — RIPE RDAP autnum, RIPEstat abuse-contact-finder

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal as of 2026-06-25 — not on Spamhaus DROP or ASN-DROP, not on the ipapi.is top-1,000 abusive-ASN list; no AS209242-specific NANOG complaints or BGP incidents. ThreatFox maintains an ASN page (CAPTCHA-gated, no extractable IOC counts); AbuseIPDB and CleanTalk pages returned HTTP 403 (status unknown from those sources). Broader Cloudflare-platform abuse (Tunnel, WARP) is documented but not attributed to AS209242 [Confirmed for the negative Spamhaus/ipapi.is findings; Likely overall given unreachable sources] — spamhaus.org/drop, ipapi.is/most-abusive-asn, threatfox.abuse.ch/asn/209242

Network & routing

Network type

content / DDoS-protection proxy — dedicated ASN for Cloudflare Spectrum (L3/L4 TCP/UDP reverse proxy + DDoS mitigation) and BYOIP customers who announce their own prefixes through Cloudflare [Confirmed] — developers.cloudflare.com/spectrum, bgp.he.net/AS209242, bgp.tools/as/209242

Size

~306 IPv4 prefixes (~113,664 addresses) and 29 IPv6 prefixes originated; 335 prefixes announced total; CAIDA customer cone: 1 ASN, ~301 prefixes, ~112,640 addresses [Confirmed] — RIPEstat routing-status / announced-prefixes, bgp.he.net, CAIDA AS Rank

Routing/peering

child/stub ASN — sole observed BGP upstream/neighbour is AS13335 (Cloudflare, Inc.); RIS visibility ~100% (v4 325/325, v6 ~322/323) [Confirmed] — RIPEstat asn-neighbours / routing-status. Cloudflare operates an open peering policy (peering@cloudflare.com, automated via the Peering Portal; PNI for >10 Gbps) [Likely — applies to Cloudflare broadly via cloudflare.com/peering-policy, not a per-AS209242 fact]

RPKI

partial — ~168 IPv4 + 18 IPv6 prefixes RPKI-valid; 11 IPv4 RPKI-invalid; 2 bogon prefixes flagged; remainder unvalidated. Routing-hygiene anomalies consistent with BYOIP onboarding, not abuse [Confirmed for counts via bgp.he.net; Likely for the partial-coverage characterization]

Notable usage

carries traffic for Cloudflare Spectrum and BYOIP customers; observed enterprise tenant prefixes include Uber, Zoom, Box.com, and HubSpot; feeds into the main Cloudflare network via AS13335 [Confirmed for Spectrum/BYOIP role via developers.cloudflare.com/spectrum and bgp.tools; Likely for the specific tenant list (third-party DB observation)]

Related ASNs

AS13335 (Cloudflare, Inc.) — primary Cloudflare network and the sole observed upstream for AS209242 [Confirmed] — RIPEstat asn-neighbours

Analyst note

encountered as an active, purpose-built Cloudflare ASN for the Spectrum product and BYOIP customer routing — distinct from Cloudflare's primary AS13335. Clean ASN with enterprise-provenance address space. CAIDA AS Rank 13168; customer cone 1 ASN, ~301 prefixes, ~112,640 addresses.