AS411

AS411 is a legacy autonomous system number registered under ARIN to Air Force Systems Networking (ARIN org handle 7ESG), a U.S. Department of the Air Force networking organization based at Maxwell AFB, Alabama. The key structural fact for this ASN is that ARIN does not publish a standalone per-ASN record for it: an RDAP query for autnum/411 resolves to a block-level record (handle AS379, name AFCONC-BLOCK1-AS) spanning the range AS379–AS508, which AS411 falls inside. This is the standard registry pattern for large DoD/Federal legacy ASN blocks administered under a single ARIN autnum object. The block's top-level RDAP registration event dates to 1989-08-04 (first-party ARIN registry fact for the block containing AS411), last changed 2008-06-06. The second triage point is that AS411 is dormant: every routing source consulted agrees it announces zero IPv4 and zero IPv6 prefixes. RIPEstat shows 0 of 323 v4 RIS peers and 0 of 321 v6 RIS peers seeing it, zero observed neighbours, and no announced address space. CAIDA AS Rank puts it at 79,459 with a singleton customer cone (itself only, 0 prefixes, 0 addresses) and an AS degree of zero across customer, peer, and provider — i.e. it has never been observed announcing routes. RPKI posture is not assessable because there are no announced prefixes and therefore no ROAs to validate. No notable public abuse signal was found as of 2026-07-02 across AbuseIPDB, Spamhaus, Talos Intelligence, VirusTotal, CleanTalk, and NANOG archives, consistent with an unrouted ASN inside a legacy military block. The registrant abuse contact routes through DISA Columbus.

Operator

Air Force Systems Networking (ARIN org handle 7ESG; U.S. Department of the Air Force) [Confirmed] — ARIN RDAP autnum/411 registrant entity, whois.arin.net/rest/org/7ESG

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin), CAIDA country.iso=US

Allocated

1989-08-04 (ARIN RDAP top-level 'registration' event for the AS379–508 block covering AS411 — first-party RIR fact, recorded not nulled); last changed 2008-06-06 [Confirmed] — ARIN RDAP autnum top-level events

Org status

active — ARIN registrant org record (7ESG) last changed 2025-03-13 [Confirmed] — ARIN RDAP autnum/411

Contacts

abuse via disa.columbus.ns.mbx.arin-registrations@mail.mil (DISA Columbus, 300 North James Road, Whitehall, OH 43213); registrant address 501 East Moore Dr., Bldg 884 Rm 1100, Gunther Annex, Maxwell AFB, AL 36114, US [Confirmed] — ARIN RDAP autnum/411, RIPEstat abuse-contact-finder

Website

Unknown — no dedicated AFSN public website located; the .mil AFSN article could not be fetched (HTTP 403) [Unknown]

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-02 — AbuseIPDB, Spamhaus (SBL/DROP), Talos Intelligence, VirusTotal, CleanTalk (empty metrics), NANOG archives searched; consistent with an unrouted ASN in a legacy DoD block

Network & routing

Network type

U.S. military/government enterprise network operator; AS411 is a legacy/dormant DoD ASN within the AFCONC block [Confirmed for holder/scope; Likely for AFNET-support characterization — secondary sources only]

Size

dormant — 0 IPv4 prefixes / 0 IPv4 addresses and 0 IPv6 prefixes; customer cone = 1 ASN (itself), 0 prefixes, 0 addresses — RIPEstat routing-status / CAIDA AS Rank (2026-07)

Routing/peering

NOT announced — 0 RIS peers seeing it (0/323 v4, 0/321 v6); CAIDA degree total 0 (customer 0, peer 0, provider 0); 0 observed neighbours; no upstreams or peers visible in any source [Confirmed]. No official peering policy located; a PeeringDB org page for "Air Force Systems Networking" lists a disjoint ASN set (65,123,175,221,301) not including AS411, so it is not cited as authoritative [Unknown]

RPKI

not assessable — AS411 announces no prefixes, so there are no ROAs to validate; RIPEstat rpki-validation requires a prefix and none exists [Confirmed]

Notable usage

described in secondary sources as supporting U.S. Air Force enterprise data communications (AFNET); not independently confirmed against a reachable primary .mil source in this session (the Wright-Patterson AFB article returned HTTP 403) [Likely]

Registration scope

AS411 has no individual ARIN autnum record; it falls inside the block record handle AS379 (AFCONC-BLOCK1-AS), range AS379–AS508 [Confirmed] — ARIN RDAP autnum/411 (startAutnum 379, endAutnum 508)

Search-noise caveat

"AS411" collides with Alaska Airlines flight AS411 in general web search; all flight-tracker results excluded as unrelated [Confirmed exclusion]

Analyst note

Dormant legacy DoD ASN. ARIN RDAP for id=411 returns a block-level record (AS379, AFCONC-BLOCK1-AS, 379–508); the 1989-08-04 registration and 2008-06-06 last-changed dates are taken from the autnum TOP-LEVEL events[], not the nested org/POC decoy events (org 7ESG registration 2008-06-05, POC REGIS10-ARIN 2009-06-24 — both excluded). Clean, unannounced ASN.