AS288

AS288 is a legacy autonomous system number held by the European Space Agency (ESA), the intergovernmental space organisation, and managed day-to-day by the ESA Network Information Centre (ESANIC). RIPE NCC is the authoritative RIR, and RIPE RDAP records a top-level registration date of 2002-09-19 with a last-changed date of 2024-12-17. Unlike a dormant legacy ASN, AS288 is actively routed: it originates roughly 53 IPv4 prefixes (about 18,688 addresses) drawn mainly from the 131.176.0.0/16 ESA legacy block and a 192.171.x.x range, and it announces no IPv6 at all. RIPEstat shows full IPv4 RIS visibility (325/325 peers) and zero IPv6 visibility, and CAIDA classifies it as a pure stub/leaf network — a singleton-plus customer cone with four upstream providers, zero peers, and zero downstream customers. The network supports ESA's internal space-operations infrastructure across sites such as ESOC (Darmstadt, Germany) and ESRIN (Frascati, Italy), and IPinfo classifies its traffic as a business network with a weekday business-hours rhythm. ESANIC (esanic@esa.int) handles ASN registration, public IP ranges, OUI assignment, and abuse coordination. On the security side the ASN is clean as of June 2026: it is absent from Spamhaus ASN-DROP, shows a 0.00% CleanTalk spam rate, and exhibits no BGP routing anomalies. ESA itself was the victim (not the source) of external-server breaches reported in December 2025 and an unconfirmed January 2026 claim, both affecting peripheral collaboration servers rather than AS288 infrastructure.

Operator

European Space Agency (ESA); managed by the ESA Network Information Centre (ESANIC, esanic@esa.int) [Confirmed] — RIPE RDAP (rdap.db.ripe.net/autnum/288), esa.int/About_Us/esait/ESA_Network_Information_Centre

Country / RIR

primary operational address DE (Darmstadt, Germany), org registration also lists IT (Frascati, Italy); RIPE NCC [Confirmed] — RIPE RDAP, RIPEstat abuse-contact-finder (authoritative_rir: ripe)

Allocated

2002-09-19 (RIPE RDAP autnum top-level registration event — first-party RIR fact, not an IEEE/database artifact); last changed 2024-12-17 [Confirmed] — RIPE RDAP autnum top-level events

Org status

intergovernmental organisation (IGO); multi-member-state European space agency [Confirmed] — esa.int

RIR status

LEGACY [Confirmed] — RIPEstat whois (stat.ripe.net/data/whois?resource=AS288)

Contacts

abuse / NIC esanic@esa.int (Mon–Fri 08:00–18:00 CET/CEST); registered addresses Robert-Bosch-Strasse 5, 64293 Darmstadt, Germany and Via Galileo Galilei snr, 00044 Frascati, Italy [Confirmed for abuse via RIPEstat; Confirmed for addresses via RDAP/whois]

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal as of 2026-06-25 — absent from Spamhaus ASN-DROP, CleanTalk 0.00% spam rate, no BGP anomalies/bogons, no NANOG abuse mentions. ESA was the VICTIM of external-server breaches reported Dec 2025 (~200 GB from external Jira/Bitbucket) and an unconfirmed Jan 2026 claim (~500 GB); both affected peripheral collaboration servers, not AS288 routing infrastructure [Confirmed] — spamhaus.org/drop/asndrop.json, cleantalk.org/blacklists/as288, bgp.he.net/AS288, bleepingcomputer.com (Dec 2025), cyberinsider.com (Jan 2026)

Network & routing

Network type

corporate/research enterprise network supporting ESA space operations (ESOC Darmstadt, ESRIN Frascati); IPinfo classes it "Business"; weekday business-hours traffic pattern [Confirmed] — ipinfo.io/AS288

Size

~53 IPv4 prefixes / ~18,688 IPv4 addresses; 0 IPv6 prefixes; CAIDA customer cone 1 ASN / 54 prefixes / 18,720 addresses [Confirmed] — RIPEstat routing-status, CAIDA AS Rank, ipinfo.io/AS288

Routing/peering

stub/leaf network — full IPv4 RIS visibility (325/325 peers), 0/323 v6; CAIDA degree 4 providers, 0 peers, 0 customers; 4 observed neighbours; first seen routing 2000-08-18 (131.176.51.0/24). PeeringDB peering policy "Open" but no active IXP presence or public prefixes listed; peering contact esanic@esa.int [Confirmed for routing metrics; Likely for PeeringDB policy]

Upstreams

4 upstream providers per CAIDA (count Confirmed); specific names not returned in the CAIDA graphql response — IPinfo cites GTT Communications and SURF B.V. among them [Likely] — CAIDA AS Rank, ipinfo.io/AS288

RPKI

not assessed — RPKI validation was skipped in the canonical fetch (no --prefix supplied); per-prefix ROA status not evaluated [Unknown]

Notable usage

ESA's internal enterprise network supporting European space-operations centres (ESOC, Darmstadt; ESRIN, Frascati). ESANIC manages ASN registration, public IP ranges, domain registration, OUI assignment, and security/abuse handling on behalf of ESA

[Confirmed] — esa.int/About_Us/esait/ESA_Network_Information_Centre, ipinfo.io/AS288

Community context

RIPE/NANOG archives note a 2007 BGP routing-instability episode involving AS288; no major reputation issues found beyond that. An early search confusion with PSINet was resolved — PSINet used AS1281–AS1284, not AS288 [Likely] — RIPE routing-wg archives (2007)

Analyst note

Actively routed legacy ASN belonging to the European Space Agency, managed by ESANIC. Clean abuse posture; ESA breach incidents were external collaboration servers, unrelated to AS288 prefixes.