AS3549

AS3549 is a legacy Tier-1 backbone autonomous system registered under ARIN to Level 3 Parent, LLC, a wholly owned subsidiary of Lumen Technologies, Inc. (formerly CenturyLink). The ASN's lineage runs deep: it originated as the Global Crossing Ltd. (GBLX) global fiber backbone, was retained when Level 3 Communications acquired Global Crossing in October 2011, absorbed the former TW Telecom network around 2016, and passed to Lumen when Lumen (then CenturyLink) acquired Level 3 on November 1, 2017. The defining triage point for AS3549 today is that it is a live but wind-down ASN: Lumen has consolidated its go-forward Internet peering and transit onto AS3356 and no longer accepts new peering on AS3549, yet AS3549 still carries substantial live BGP — roughly 602 IPv4 prefixes (RIS snapshot) and 29 IPv6 prefixes spanning a global footprint, totaling about 4.99 million IPv4 addresses, with 314 observed BGP neighbours and near-total RIS visibility. Its routing was first seen in August 2000 and it remains an active, validated ARIN registration. Lumen runs an active RPKI/ROA program (ARIN entity RPKIR-ARIN, registered 2024-06-17) and operates the Black Lotus Labs threat-research unit that null-routes malicious infrastructure. Public security history is sparse and dated — the 2015 Telekom Malaysia (AS4788) route leak propagated through this AS as a victim, and a minor 2019 prefix dispute appeared on NANOG — with very low abuse-feed signal (about 6 blocklist.de hits, no Spamhaus ASN-DROP listing) consistent with a large, well-run transit network.

Operator

Level 3 Parent, LLC (ARIN handle/org LPL-141; subsidiary of Lumen Technologies, Inc.; historically Level 3 Communications, Inc. and originally Global Crossing Ltd.) [Confirmed] — ARIN RDAP autnum, peeringdb.com/net/75, en.wikipedia.org/wiki/Level_3_Communications

Country / RIR

US, ARIN (org address 1025 Eldorado Blvd., Broomfield, CO 80021; abuse 100 CenturyLink Drive, Monroe, LA 71203) [Confirmed] — ARIN RDAP autnum

Allocated

2000-03-21 (ARIN RDAP autnum top-level registration event — a first-party RIR fact, NOT an IEEE date); last changed 2018-02-20 [Confirmed] — rdap.arin.net/registry/autnum/3549 (top-level events[], confirmed by A2/A3/A5)

AS name / handle

LVLT-3549 / AS3549 [Confirmed] — rdap.arin.net/registry/autnum/3549

Org status

active; Level 3 Parent, LLC is a subsidiary of Lumen Technologies, Inc. (publicly traded; acquired Level 3 on 2017-11-01 for ~$34B); PeeringDB last updated 2025-11-03 [Confirmed] — whois.arin.net/rest/asn/AS3549, lumen.com/en-us/about.html, en.wikipedia.org/wiki/Level_3_Communications

Contacts

abuse@level3.com (LAC56-ARIN); secondary abuse@aup.lumen.com; ipadmin@lumen.com / ipadmin@centurylink.com (ADMIN POC LVLT); +1-877-453-8353 [Confirmed] — rdap.arin.net/registry/entity/LAC56-ARIN, ARIN RDAP autnum

Security/abuse context (NEUTRAL, DATED)

2015-06-12 Telekom Malaysia (AS4788) route leak propagated through AS3549 (victim role, ~2h global degradation); minor 2019-07 prefix-announcement dispute (46.28.67.0/24) on NANOG; ~6 blocklist.de hits, no Spamhaus ASN-DROP listing; Lumen's Black Lotus Labs actively disrupts botnet C2 — no systemic abuse signal as of 2026-06-25

Network & routing

Network type

Tier-1 NSP / global backbone transit network; legacy/migration-phase ASN (Lumen's go-forward platform is AS3356) [Confirmed] — peeringdb.com/net/75, bgp.tools/as/3549

Size

~602 IPv4 prefixes (RIS snapshot; 631 on announced-prefixes 14-day window), ~4.99M IPv4 addresses; 29 IPv6 prefixes (~983,061 /48 equivalents); 314 observed neighbours [Confirmed] — RIPEstat routing-status / announced-prefixes (2026-06-25)

Routing/visibility

first seen 2000-08-18 (198.151.252.0/24); RIS visibility v4 326/326 peers (100%), v6 ~323/326 (~99%); AS block 3354-4607 (IANA 16-bit AS Numbers Registry) [Confirmed] — RIPEstat routing-status / as-overview

Peering policy

Restrictive (PeeringDB); AS3549 no longer accepting new peering — new peering directed to AS3356; SFI requires 24x7 NOC, RPKI-filtered announcements, scale thresholds (peering@lumen.com) [Confirmed] — lumen.com/en-us/about/legal/peering-policy.html, peeringdb.com/net/75

RPKI

active ROA program — ARIN entity RPKIR-ARIN (RPKI-ROA, rpki-roa@lumen.com) registered 2024-06-17, last changed 2026-06-22; bgp.he.net indexes a small number of valid and a few invalid origins [Confirmed for ROA program; Likely for per-prefix validity] — rdap.arin.net/registry/entity/RPKIR-ARIN, bgp.he.net/AS3549

Notable usage

originated as the Global Crossing (GBLX) backbone; retained after Level 3 acquired Global Crossing (Oct 2011); absorbed former TW Telecom (~2016); now in wind-down with traffic migrating to AS3356 (Lumen's primary ASN)

[Confirmed] — bgp.tools/as/3549, en.wikipedia.org/wiki/Level_3_Communications, peeringdb.com/net/75

Related ASNs

AS3356 (Lumen's primary go-forward ASN); AS4323 (former TW Telecom, absorbed); AS4788 (Telekom Malaysia, 2015 leak source) [Confirmed for AS3356/AS4323; cited for AS4788]

Analyst note

Live but wind-down Tier-1 ASN. WHOIS/RDAP resolves to Level 3 Parent, LLC under Lumen; AS3549 still carries ~602 v4 / 29 v6 prefixes but Lumen's go-forward peering/transit is on AS3356. CAIDA AS-rank/customer-cone/upstreams timed out at fetch and are recorded Unknown rather than fabricated.