AS395

AS395 is a legacy autonomous system number administered under ARIN and registered to Air Force Systems Networking (ARIN org handle 7ESG), part of the U.S. Air Force within the Department of Defense. A key structural detail governs everything here: querying ARIN RDAP for autnum 395 does not return an AS395-specific record — it returns a contiguous block record, handle AS379, name AFCONC-BLOCK1-AS, spanning startAutnum 379 through endAutnum 508. AS395 falls inside that block and inherits the block's registration facts rather than carrying its own distinct autnum object. The registrant org 7ESG lists Maxwell AFB–Gunter Annex, Montgomery, Alabama; administrative, technical, and abuse contact is DISA-Columbus (Defense Information Systems Agency) in Whitehall, Ohio, with abuse routed to disa.columbus.ns.mbx.arin-registrations@mail.mil. The main triage point is that AS395 is dormant today: RIPEstat reports announced:false with an empty announced-prefixes list, zero RIS peers seeing it on both IPv4 (0/323) and IPv6 (0/321), zero observed neighbours, and zero currently announced address space. RIPEstat routing-status preserves a historical trail — first seen originating 192.31.20.0/24 on 2000-08-18 and last seen originating 132.3.36.0/22 on 2020-07-15 — consistent with an ASN that carried DoD address space until roughly mid-2020 and has been silent since. RPKI posture is not assessable because there are no live originations to validate against a ROA. No notable public abuse or threat signal was found as of 2026-07-02 across Spamhaus, AbuseIPDB, NANOG archives, or general threat-intel searches, consistent with a small, non-transit legacy U.S. federal government block that commercial reputation feeds do not track. CAIDA AS Rank and customer-cone data were unavailable (the CAIDA lookup timed out) and are therefore left unknown rather than fabricated.

Operator

Air Force Systems Networking (U.S. Air Force / DoD; ARIN org handle 7ESG, Maxwell AFB–Gunter Annex, Montgomery, AL) [Confirmed] — ARIN RDAP autnum/395 (resolves to block AFCONC-BLOCK1-AS), rdap.arin.net/registry/entity/7ESG

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin), ARIN RDAP

Allocated

1989-08-04 (ARIN RDAP autnum TOP-LEVEL registration event for the AFCONC-BLOCK1-AS block containing AS395; a first-party RIR fact, NOT an IEEE date); last changed 2008-06-06 [Confirmed] — ARIN RDAP autnum/395 top-level events[]

Org status

active per ARIN registry status field. Third-party ipinfo.io separately flags no recent BGP activity (a routing heuristic, distinct from registration status) [Confirmed for registry active] — ARIN RDAP autnum/395, ipinfo.io/AS395

Contacts

abuse/admin/tech via DISA-Columbus, disa.columbus.ns.mbx.arin-registrations@mail.mil, tel +1-844-347-2457 ext2 (300 North James Road, Whitehall, OH 43213); registrant Air Force Systems Networking, 501 East Moore Dr., Bldg 884 Rm 1100 Gunther Annex, Maxwell AFB, AL 36114

[Confirmed] — ARIN RDAP entity/REGIS10-ARIN and entity/7ESG, RIPEstat abuse-contact-finder

Security/abuse context (NEUTRAL, DATED)

no notable public abuse or threat signal found as of 2026-07-02 — not in Spamhaus (SBL / ASN-DROP), AbuseIPDB, NANOG archives, or general malware/hijack searches. Absence is by design for a small legacy DoD block, not a clean-bill guarantee

Network & routing

Network type

U.S. military / government network (Air Force Systems Networking, DoD infrastructure). Third-party heuristics (ipinfo.io) label it generically; that is a database classification, not an operator self-description [Likely] — ipinfo.io/AS395

Size / routing

dormant — announced:false, 0 IPv4 prefixes, 0 IPv6 prefixes, 0 announced address space; 0 RIS peers seeing it (0/323 v4, 0/321 v6); 0 observed neighbours [Confirmed] — RIPEstat as-overview / announced-prefixes / routing-status (resource=395)

Historical routing

first_seen 192.31.20.0/24 originated by AS395 on 2000-08-18; last_seen 132.3.36.0/22 on 2020-07-15 — consistent with a DoD ASN dormant since mid-2020 [Confirmed] — RIPEstat routing-status (resource=395)

RPKI

not assessable — AS395 announces no prefixes, so there are no live routes/ROAs to validate [Unknown] — RIPEstat rpki-validation skipped (no prefix); no announced space

Peering policy

none active. No AS395-specific PeeringDB net record exists; an org-level PeeringDB profile (org 20118) lists sibling ASNs but not AS395 and carries no website, peering policy, or NOC contact [Confirmed] — peeringdb.com/org/20118

AS rank / customer cone / upstreams

Unknown — CAIDA lookup timed out ("operation was aborted due to timeout"); RIPEstat observed_neighbours=0, consistent with an unannounced ASN [Unknown] — CAIDA (errored), RIPEstat routing-status

Notable usage

Unknown for AS395 specifically. Community sources associate the AFCONC block operator with U.S. Air Force network operations (754th Electronic Systems Group at Maxwell AFB–Gunter Annex) but none name AS395 by number, so no specific-usage claim is attributed here [Likely for operator context; Unknown for AS395-specific usage] — hanscom.af.mil (754 ELSG), en.wikipedia.org/wiki/Gunter_Annex

AS-block context

AS395 is part of AFCONC-BLOCK1-AS, a contiguous ARIN block (startAutnum 379, endAutnum 508) registered to one org (7ESG). ARIN returns this block record for the autnum/395 query; AS395 has no standalone autnum object. Nested entity dates (org 7ESG registered 2008-06-05 / changed 2025-03-13; POC REGIS10-ARIN registered 2009-06-24 / changed 2026-02-12) are contact-level and were NOT used for allocated_date

[Confirmed] — ARIN RDAP autnum/395

Analyst note

Encountered as a dormant legacy U.S. Air Force / DoD ASN inside the AFCONC-BLOCK1-AS block. ARIN returns the block record (AS379–AS508) for the autnum/395 query; the 1989-08-04 top-level registration is the block's and is recorded as AS395's allocated_date per RIR-fact policy. Historically announced DoD space through 2020-07-15; unannounced since. Clean, inactive ASN by all consulted signals.