Autonomous system detail

AS228

Announced

Operated by DNIC-AS-00228 - United States Department of Defense (DoD).

Summary

// analyst note
Active DoD government stub ASN announcing 4 IPv4 /21 + 1 IPv6 /48 in 147.241.0.0/16, single-homed via AS668 (DoD HPC/DREN), CAIDA rank 18582, clique member. allocated_date is the autnum TOP-LEVEL registration event (1988-09-08); entity-level dates (MIL-HSTMST-ARIN 1993-05-26, REGIS10-ARIN 2009-06-24) are decoys and were not used. RDAP fetch timed out in one angle but RDAP fields were independently corroborated by three other angles. Distinct from dormant sibling AS227.
// security note
NEUTRAL/DATED: no notable public abuse signal found as of 2026-06-19; not in Spamhaus, AbuseIPDB, Barracuda Central, NANOG archives, GreyNoise, Shodan, or Censys, and no BGP hijack/route-leak attributed to AS228.
IPv4 prefixes
4
~8.2K addresses
IPv6 prefixes
1
announced
Peer networks
1
1 up · 0 down
IANA block
1-1876
Assigned by ARIN
[ 01 ] — Context

About this ASN.

Updated  ·  Confidence: High

AS228 is a U.S. military autonomous system number registered under ARIN to the United States Department of Defense, administered through the DoD Network Information Center (DNIC) by DISA-Columbus in Whitehall, Ohio. Its IPv4 space is labeled "Headquarters, USAISC" — the U.S. Army Information Systems Command, the Army automation and communications command established in 1984 at Fort Huachuca, Arizona and later realigned into the Network Enterprise Technology Command (NETCOM) — while its IPv6 prefix is designated for High Performance Computing. Unlike its dormant sibling AS227, AS228 is actively present in global routing. It originates four IPv4 /21 blocks in the 147.241.0.0/16 range (147.241.48.0/21, 147.241.64.0/21, 147.241.136.0/21, 147.241.144.0/21 — 8,192 addresses total) and one IPv6 /48 (2001:480:253::/48), with near-universal RIS peer visibility (326/327 v4 peers and 323/324 v6 peers, about 99.7% each). It is a single-homed stub: CAIDA records exactly one upstream and zero peers or downstream customers, a customer cone of one ASN, and a global AS rank of 18,582; the sole observed transit relationship is AS668 (DoD High Performance Computing / Defense Research and Engineering Network, DREN). The earliest routing CAIDA/RIS recorded for the ASN was 192.48.213.0/24 in August 2005 (no longer active); the current prefixes were last seen on 2026-06-20. RPKI posture could not be assessed in this pass because no specific prefix was supplied to the validation endpoint. No notable public abuse signal was found as of June 2026 — not in Spamhaus, AbuseIPDB, NANOG archives, or general threat feeds — consistent with a closed DoD stub network with no commercial hosting or transit footprint, though several feeds returned access errors rather than explicit clean results. AS228 also appears in RFCs 2280 and 2622 purely as a routing-policy example, not as evidence of operational significance.

Operator
United States Department of Defense (DoD), administered via the DoD Network Information Center (DNIC) by DISA-Columbus; ARIN org handle USDDD, network handle DNIC-AS-00228; IPv4 space labeled "Headquarters, USAISC" (U.S. Army Information Systems Command)
[Confirmed] — ARIN RDAP autnum/228, whois.arin.net/rest/asn/AS228, ipapi.is/asn/228.html
Country / RIR
US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin), ARIN RDAP autnum/228
Allocated
1988-09-08 (ARIN RDAP autnum top-level registration event — a first-party ARIN registry fact, NOT an IEEE date; IEEE publishes no ASN registration dates); last changed 2025-09-12 [Confirmed] — ARIN RDAP autnum/228 top-level events
Org status
Active — U.S. federal government agency (DoD); ARIN registration active as of last update 2025-09-12 [Confirmed] — ARIN RDAP autnum/228
Contacts
abuse/hostmaster disa.columbus.ns.mbx.hostmaster-dod-nic@mail.mil (Network DoD, handle MIL-HSTMST-ARIN); phone +1-844-347-2457 ext 2 [Confirmed] — ARIN RDAP autnum/228, RIPEstat abuse-contact-finder

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-06-19 — not in Spamhaus, AbuseIPDB, Barracuda Central, NANOG archives, GreyNoise, Shodan, or Censys; no BGP hijack/route-leak incidents attributed to AS228; structurally low-risk as a closed DoD stub with no commercial hosting/transit [Likely — several feeds (Spamhaus, AbuseIPDB ASN view, FraudGuard) returned access errors rather than explicit clean-bill results; no positive abuse evidence in any reachable source] — abuseipdb.com, spamhaus.org, seclists.org/nanog, bgp.tools/as/228

Network & routing

Network type
U.S. federal government / military (DoD) network; government stub AS — not a commercial ISP [Confirmed] — ARIN RDAP autnum/228, ipapi.is/asn/228.html
Size
active — 4 IPv4 /21 prefixes (147.241.48.0/21, 147.241.64.0/21, 147.241.136.0/21, 147.241.144.0/21; 8,192 addresses total) and 1 IPv6 /48 (2001:480:253::/48); customer cone = 1 ASN (itself), 4 prefixes, 8,192 addresses [Confirmed] — RIPEstat announced-prefixes / routing-status, CAIDA AS Rank
Routing/peering
announced with near-universal visibility — 326/327 RIS peers v4 (~99.7%) and 323/324 v6 (~99.7%); single-homed stub via one upstream (AS668, DoD HPC/DREN); CAIDA degree total 1 (customer 0, peer 0, provider 1); CAIDA clique member = true
[Confirmed] — RIPEstat routing-status, CAIDA AS Rank, bgp.he.net/AS228, bgp.tools/as/228
Peering policy
Unknown — no public peering policy published for AS228; not present in PeeringDB as its own record; DoD maintains a closed/government-only posture with no public-exchange participation, transiting via AS668 [Likely] — peeringdb.com/org/17705, bgp.he.net/AS228, bgp.tools/as/228
RPKI
not assessed this pass — RIPEstat rpki-validation requires a specific prefix and none was supplied; posture not determinable from the data collected [Unknown] — RIPEstat (rpki-validation skipped: no --prefix supplied)
Notable usage
IPv4 space labeled "Headquarters, USAISC" (U.S. Army Information Systems Command; mission later under NETCOM) and the IPv6 prefix designated "High Performance Computing"; earliest RIS-observed origination was 192.48.213.0/24 on 2005-08-20 (no longer active); current prefixes last seen 2026-06-20; AS228 has been noted announcing bogons; appears in RFC 2280 / RFC 2622 only as a routing-policy example [Confirmed for current prefixes/usage; Likely for bogon note and historical first-seen per third-party DB] — bgp.he.net/AS228, bgp.tools/as/228, ipapi.is/asn/228.html, RFC 2622, RIPEstat routing-status
Related ASNs
AS668 (DoD High Performance Computing / DREN) — sole observed upstream/transit [Confirmed] — bgp.he.net/AS228, bgp.tools/as/228, CAIDA AS Rank
Geo footprint
United States; CAIDA coordinates ~33.87N, 96.29W (North Texas region); registrant org at 3990 E. Broad Street, Columbus, OH 43218; NOC/technical at DISA-Columbus, 300 North James Road, Whitehall, OH 43213 [Likely for coordinates; Confirmed for addresses] — CAIDA AS Rank, ARIN RDAP autnum/228
Historical context
IPv4 space labeled for USAISC; A5 records a historical association with the Navy Regional Data Automation Center (NARDAC), Washington D.C.; administrative control now sits with DISA-Columbus [Likely — single-source historical note] — ip2location.com/as228, ntrl.ntis.gov (ADA380993)
Analyst note
An active DoD government stub ASN. The allocated_date (1988-09-08) is the autnum TOP-LEVEL registration event — the entity-level dates (MIL-HSTMST-ARIN 1993-05-26, REGIS10-ARIN 2009-06-24) are decoys and were not used. The RDAP fetch in A1 timed out, but A2/A3/A4 independently confirmed RDAP fields, so the record is corroborated. Distinct from dormant sibling AS227: AS228 is actively routed.
[ 02 ] — Announced prefixes

What this network routes.

5 prefixes total · RIPEstat data · cached, not real-time
// IPv4 prefixes4
  1. 147.241.136.0/21/21
  2. 147.241.64.0/21/21
  3. 147.241.48.0/21/21
  4. 147.241.144.0/21/21
// IPv6 prefixes1
  1. 2001:480:253::/48/48
[ 03 ] — Notable peers & upstreams

Who it talks to.

1 observed neighbour
// Notable connectionsTop 1 of 1
ASNOperatorRole
AS668 DNIC-AS-00668 - United States Department of Defense (DoD) upstream
Neighbours observed via public BGP collectors; not a complete peering list.