AS403

AS403 is a legacy autonomous system number registered under ARIN to the U.S. Air Force, held under the aggregated block record AFCONC-BLOCK1-AS that spans AS379–AS508. The registrant organization is "Air Force Systems Networking" (ARIN org handle 7ESG, 501 East Moore Dr., Gunther Annex, Maxwell AFB, AL), and the administrative, technical, and abuse contact is DISA-Columbus (300 North James Road, Whitehall, OH), the Defense Information Systems Agency office that manages ARIN registrations for Department of Defense number resources. The triage point for AS403 is that it is effectively dormant today: RIPEstat reports announced=false, an empty announced-prefixes list for the query window ending 2026-07-02, and 0 of 323 IPv4 RIS peers plus 0 of 321 IPv6 RIS peers seeing it. It does, however, carry a real BGP history — first seen originating 198.220.193.0/24 on 2008-07-15 and last seen originating 197.157.219.0/24 on 2025-04-11. Notably, its recent history shows origination of several Nigerian ISP IPv4 prefixes via peer AS36920 (KKON Technologies Ltd), a pattern consistent with dormant-ASN third-party origination but not confirmed as any reported hijack; AS403 itself carries no bogon or abuse flag on bgp.tools or bgp.he.net, and no abuse signal was found in AbuseIPDB, Spamhaus, Talos, VirusTotal, or NANOG archives as of 2026-07-02. CAIDA AS Rank data was unavailable (query timeout), so rank and customer-cone figures are recorded as Unknown rather than guessed.

Operator

Air Force Systems Networking (U.S. Air Force / DoD; ARIN registrations managed by DISA-Columbus) [Confirmed] — ARIN RDAP autnum/403, ipinfo.io/AS403

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin)

Allocated

1989-08-04 (ARIN autnum TOP-LEVEL registration event on the AFCONC-BLOCK1-AS block record covering AS379–AS508; a first-party RIR fact — NOT an IEEE date); last changed 2008-06-06 [Confirmed] — ARIN RDAP autnum top-level events; corroborated by ipinfo.io/AS403 (A2, A3, A4 agree)

Allocated date note

the RDAP query for autnum 403 resolves to ARIN's aggregated block object (handle AS379, startAutnum 379, endAutnum 508, name AFCONC-BLOCK1-AS) rather than an AS403-isolated record; entity-level dates (REGIS10-ARIN poc reg 2009-06-24; 7ESG org reg 2008-06-05) were explicitly excluded as decoys

[Confirmed] — ARIN RDAP autnum/403

Org status

active ARIN registration (RDAP status: active); routing status dormant/unrouted; no registry change since 2008-06-06, consistent with a legacy/inactive-in-practice DoD allocation rather than a decommissioned one [Confirmed] — ARIN RDAP, bgp.tools/as/403

Contacts

disa.columbus.ns.mbx.arin-registrations@mail.mil (abuse/admin/tech, DISA-Columbus); registrant Air Force Systems Networking, Maxwell AFB, AL [Confirmed] — RIPEstat abuse-contact-finder, ARIN RDAP autnum/403

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-02 — not in AbuseIPDB, Spamhaus, Talos Intelligence, VirusTotal, or NANOG archives; AS403 carries no bogon/abuse tag on bgp.tools or bgp.he.net. The AS36920 bogon-announcement flag belongs to AS36920, not AS403, and is not merged in

Network & routing

Network type

U.S. federal government / military (DoD, U.S. Air Force); non-commercial; AS403 is legacy and currently dormant/unrouted [Confirmed] — ARIN RDAP, ipinfo.io/AS403

Size

dormant — 0 IPv4 prefixes / 0 IPv6 prefixes currently announced; announced=false [Confirmed]. IPv4 address estimate, AS rank, and customer cone Unknown — CAIDA query timed out, no data returned [Unknown] — RIPEstat routing-status

Routing/peering

NOT announced — 0/323 v4 and 0/321 v6 RIS peers seeing it; observed_neighbours 0 [Confirmed] — RIPEstat routing-status. Upstreams/peers not derivable (unrouted); no published peering policy and no PeeringDB network record for AS403

[Confirmed absence] — peeringdb.com/org/20118 (lists AS65/123/175/221/301, not AS403)

RPKI

not assessable — AS403 announces no prefixes, so there are no ROAs to validate; RIPEstat rpki-validation skipped (no prefix supplied) [Unknown]

Notable usage

dormant DoD/Air Force ASN with historical BGP activity (first seen 2008-07-15 announcing 198.220.193.0/24; last seen 2025-04-11 announcing 197.157.219.0/24); recent history includes origination of Nigerian ISP prefixes (e.g. 197.157.219.0/24) via peer AS36920 (KKON Technologies)

[Confirmed as observation] — RIPEstat routing-status, bgp.he.net/AS403

Analyst note

Encountered as a dormant, legacy DoD/Air Force ASN whose RDAP resolves to the AFCONC-BLOCK1-AS block (AS379–AS508). Clean registry reputation but a noteworthy recent history of originating third-party (Nigerian) prefixes via AS36920 before dropping from the global table in April 2025. Recorded as a sourced observation, not a confirmed incident.