AS409

AS409 is a legacy autonomous system number registered under ARIN to Air Force Systems Networking — a U.S. Department of Defense / United States Air Force network resource administered by the Defense Information Systems Agency (DISA). As with its siblings, ARIN does not issue a discrete RDAP record for AS409: querying autnum/409 returns the contiguous block record handle AS379, ASName AFCONC-BLOCK1-AS, spanning startAutnum 379 through endAutnum 508, and AS409 falls inside that legacy block. The registrant org (ARIN handle 7ESG) lists an address at 501 East Moore Dr., Bldg 884 Rm 1100, Gunter Annex, Maxwell AFB, AL 36114, while abuse, administrative, and technical contact routes through DISA-Columbus (300 North James Road, Whitehall, OH 43213; disa.columbus.ns.mbx.arin-registrations@mail.mil). The distinguishing triage point for AS409 — versus dormant siblings like AS390 (withdrawn) or fully-dark ones like AS389 — is that AS409 is genuinely active in the global routing table today: RIPEstat records announced=true with 13 IPv4 prefixes currently originated (roughly 269,312 IPv4 addresses), first seen as origin AS409 on 2007-12-23 (192.77.105.0/24) and last seen on 2026-07-02 (143.140.70.0/24), with 322 of 323 RIS peers observing it in v4. There is no IPv6 presence (0/321 v6 RIS peers). CAIDA ranks the ASN at 12,722 with a singleton customer cone (1 ASN, 13 prefixes, 269,312 addresses) and only one observed BGP neighbour, consistent with a government/military network reachable through a single, tightly-filtered transit relationship. RDAP status is "active." RPKI posture was not assessable in this pass (RIPEstat rpki-validation requires a specific prefix, which was not supplied). CAIDA's single geo coordinate (mid-Pacific east of Japan) is an inference artifact, not a real location — the registrant (Maxwell AFB, Alabama) and abuse contact (DISA-Columbus, Ohio) place the true footprint in the continental United States. No notable public abuse signal was found as of 2026-07-02 — not in Spamhaus DROP/ASN-DROP, AbuseIPDB, or NANOG archives — consistent with a clean, actively-routed military allocation whose restricted public visibility reflects operational-security policy rather than reputation.

Operator

Air Force Systems Networking (U.S. DoD / U.S. Air Force; ARIN OrgId 7ESG; administered by DISA) [Confirmed] — ARIN RDAP (https://rdap.arin.net/registry/autnum/409)

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin); ARIN RDAP

Allocated

1989-08-04 (ARIN registry date from the autnum TOP-LEVEL registration event of the parent block record AS379/AFCONC-BLOCK1-AS, NOT an IEEE date — IEEE publishes no ASN registration dates; the nested entity/org events of 2008-06-05 and 2009-06-24 are decoys); last changed 2008-06-06

[Confirmed] — ARIN RDAP autnum top-level events (https://rdap.arin.net/registry/autnum/409)

Org status

active per ARIN RDAP; U.S. Air Force network resource administered by DISA (Gunter Annex, Maxwell AFB, AL; DISA-Columbus, OH); block-level record last changed 2008-06-06, registrant org 7ESG last updated 2025-03-13 [Confirmed] — ARIN RDAP (https://rdap.arin.net/registry/autnum/409)

Contacts

abuse/admin/tech via DISA-Columbus — disa.columbus.ns.mbx.arin-registrations@mail.mil, +1-844-347-2457 ext.2; registrant HQ 501 East Moore Dr., Bldg 884 Rm 1100, Gunter Annex, Maxwell AFB, AL 36114 [Confirmed] — ARIN RDAP (https://rdap.arin.net/registry/autnum/409)

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-02 — not in Spamhaus DROP/ASN-DROP/SBL, AbuseIPDB, or NANOG archives (WebSearch-only pass; no live check.spamhaus.org / GreyNoise / VirusTotal lookup); general USAF breach news is NOT attributable to AS409's prefixes and was excluded

Network & routing

Network type

U.S. government / military network (DoD, U.S. Air Force / AFNET); not a commercial ISP, hosting, or content network; AS409 is legacy but actively routed [Confirmed] — ARIN RDAP; DISN Connection Process Guide (disa.mil)

Size

actively announced — 13 IPv4 prefixes / ~269,312 IPv4 addresses and 0 IPv6 prefixes; customer cone = singleton (1 ASN itself, 13 prefixes, 269,312 addresses) [Confirmed] — RIPEstat routing-status / CAIDA AS Rank (resource 409)

Routing/peering

currently announced — as-overview announced=true; 13 IPv4 prefixes (132.15.0.0/16, 143.140.64.0/21, 132.15.225.0/24, 131.36.0.0/16, 131.47.0.0/16, 132.20.0.0/16, 131.36.116.0/24, 131.47.106.0/24, 143.140.70.0/24, 132.20.251.0/24, 132.3.8.0/22, 128.216.0.0/20, 131.47.100.0/24); 322/323 RIS peers see it in v4, 0/321 in v6; 1 observed neighbour; no public peering policy published; no PeeringDB network record for AS409 (peeringdb.com/asn/409 → 404; block org page peeringdb.com/org/20118 lists no populated peering fields and omits AS409)

[Confirmed] — RIPEstat routing-status; peeringdb.com/org/20118, peeringdb.com/asn/409

Historical routing

first seen 2007-12-23 (192.77.105.0/24, origin AS409); last seen 2026-07-02 (143.140.70.0/24, origin AS409) — a continuously-active footprint distinguishing AS409 from withdrawn/dark siblings [Confirmed] — RIPEstat routing-status (resource 409)

RPKI

not assessable in this pass — RIPEstat rpki-validation requires a specific prefix (none supplied), so ROA validity was not evaluated [Unknown] — RIPEstat rpki-validation (skipped, no prefix)

Notable usage

part of a contiguous historical ASN block (AS379 through AS508) allocated to Air Force Systems Networking for DoD/Air Force internal networking since the earliest ASN allocations; administered by DISA; currently originates 13 IPv4 prefixes with a single observed BGP neighbour (third-party bgp.he.net associates that neighbour with AS27066, U.S. DoD); no public-facing commercial services documented

[Likely] — RIPEstat routing-status; bgp.he.net/AS409

Within-block duplicate note

ARIN keys resource 409 to the same AFCONC-BLOCK1-AS block record already fully enriched and finalized as AS379 (/asn/379/, status DONE) and shared by AS385/AS386/AS389/AS390/AS391. AS409 is not a separately allocable RDAP entity; all registry facts match the parent block, though its routing footprint (13 live prefixes) is distinct

[Confirmed] — ARIN RDAP (https://rdap.arin.net/registry/autnum/409); /asn/379/

Analyst note

Encountered as a within-block number of a legacy military ASN block registered to Air Force Systems Networking via DISA; RDAP status is "active" and — unlike withdrawn sibling AS390 — AS409 is actively announcing 13 IPv4 prefixes today. Registry data resolves to the block record AS379, not a discrete AS409 record. CAIDA geo coordinates (mid-Pacific) are an inference artifact and were not used as the footprint. The absence of community/peering presence reflects deliberate DoD operational security, not a defunct or ill-reputed operator. Clean, actively-routed ASN. Flagging for the checker: if the pipeline treats within-block numbers as duplicates-of-DONE, AS409 may be closed against AS379 rather than published as a distinct page.