AS399

AS399 is a legacy autonomous system number registered under ARIN to Air Force Systems Networking, a U.S. Department of Defense / U.S. Air Force entity administered by the Defense Information Systems Agency (DISA). The critical structural fact for triage is that AS399 has no discrete RDAP autnum object of its own: an ARIN RDAP query for autnum 399 resolves to the shared block record AFCONC-BLOCK1-AS (handle AS379), which spans AS379–AS508. AS399 therefore inherits its registrant, contacts, address, top-level registration event, and "active" status from that block rather than carrying an operator-official identity of its own. Despite the shared registry object, AS399 is operationally live and distinct in routing: RIPEstat shows it originating 8 IPv4 prefixes (~152,576 addresses, roughly 2.3 /16-equivalents), including 131.38.0.0/16, 131.49.0.0/16, and several /19–/21 blocks, with no IPv6. Its IPv4 announcements are broadly visible (322 of 323 RIS peers); it was first observed in RIS on 2016-09-14 and last seen 2026-07-02. Third-party sources (bgp.tools, ipinfo) characterize it as a single-homed stub network whose sole upstream is AS27066 (the DoD Network Information Center), consistent with DoD's centrally gated DISN connection model rather than commercial peering — no PeeringDB profile exists for AS399 (peeringdb.com/asn/399 returns 404), and it is absent from the same-named org profile (org/20118). No notable public abuse signal was found as of 2026-07-02. CAIDA AS rank and customer cone could not be retrieved (the CAIDA fetch timed out) and are left as sourced Unknowns rather than fabricated.

Operator

Air Force Systems Networking (U.S. Air Force / DoD; ARIN OrgId 7ESG; registrant of the AFCONC-BLOCK1-AS block AS379–AS508) [Confirmed] — ARIN RDAP autnum/399 (resolves to block handle AS379)

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin), ARIN RDAP

Allocated

1989-08-04 (ARIN registry date on the AFCONC-BLOCK1-AS block record's top-level events; NOT an IEEE date — IEEE publishes no ASN registration dates); last changed 2008-06-06 [Confirmed] — ARIN RDAP autnum top-level events[] (registration / last changed); corroborated by ipinfo.io/AS399

Org status

active per ARIN RDAP, though status is inherited from the parent block record (handle AS379); no operator-official source confirms AS399-specific operational detail beyond routing observation [Confirmed for RDAP status; Unknown for operator-official operational detail] — ARIN RDAP autnum/399

Contacts

registration/abuse/technical via DISA-Columbus — disa.columbus.ns.mbx.arin-registrations@mail.mil; +1-844-347-2457 ext. 2 (POC handle REGIS10-ARIN, 300 North James Road, Whitehall, OH 43213, US). Registrant org (7ESG): 501 East Moore Dr., Bldg 884, Rm 1100, Gunter Annex, Maxwell AFB, AL 36114, US

[Confirmed] — ARIN RDAP autnum/399

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-02 — not in Spamhaus SBL/DROP/ASN-DROP, AbuseIPDB aggregations, or NANOG archives for AS399 or its prefixes; consistent with a non-transit U.S. government network

Network & routing

Network type

U.S. government / military network (DoD, U.S. Air Force), administered by DISA (DISA-Columbus); not a commercial ISP, hosting, or content network [Confirmed] — ARIN RDAP autnum/399

Size

~152,576 IPv4 addresses across 8 announced IPv4 prefixes (~2.3 /16-equivalents); 0 IPv6 prefixes [Confirmed] — RIPEstat routing-status / announced-prefixes (announced_space.v4 = 8 prefixes / 152,576 IPs)

Routing/peering

single-homed stub AS; sole upstream AS27066 (DoD Network Information Center); RIPEstat observed_neighbours = 1 (identity not disclosed in the RIPEstat payload). No per-ASN peering policy published; no PeeringDB profile (peeringdb.com/asn/399 → 404); AS399 absent from org/20118's listed networks. Consistent with DoD's gated DISN connection model [Confirmed for stub/no-PeeringDB; Likely for AS27066 upstream via bgp.tools/ipinfo] — bgp.tools/as/399, ipinfo.io/AS399, peeringdb.com/asn/399, peeringdb.com/org/20118

RPKI

not assessed this pass — RIPEstat rpki-validation requires a --prefix argument that was not supplied; posture Unknown, not fabricated [Unknown]

AS rank / customer cone

Unknown — CAIDA fetch errored (operation aborted, timeout); not independently re-queried this pass [Unknown]

Notable usage

none documented on any operator-official source; no public page names AS399 by number. It is a within-block number of the AFCONC-BLOCK1-AS allocation (AS379–AS508), sibling to other DoD/Air Force ASNs already enriched in this pipeline [Unknown for operator-official; Confirmed for block membership] — ARIN RDAP autnum/399

Prefixes

131.38.0.0/16, 131.49.0.0/16, 143.156.192.0/19, 143.147.80.0/21, 143.146.192.0/19, 143.157.80.0/21, 132.3.0.0/22, 131.38.120.0/24 (a 9th, 134.165.103.0/24, is a one-off single-day timeline on 2026-06-30) [Confirmed] — RIPEstat announced-prefixes

Visibility

IPv4 seen by 322/323 RIS peers; IPv6 0/321 (none announced); first RIS-seen 2016-09-14 (134.165.1.0/24), last-seen 2026-07-02 (131.49.0.0/16) [Confirmed] — RIPEstat routing-status

Analyst note

Encountered as a live within-block DoD/Air Force ASN whose RDAP resolves to the shared AFCONC-BLOCK1-AS record (handle AS379); allocated_date (1989-08-04) and last_updated (2008-06-06) were read strictly from the autnum TOP-LEVEL events[], not the entity-nested decoy dates (7ESG 2008-06-05/2025-03-13; REGIS10-ARIN 2009-06-24/2026-02-12).