AS427

AS427 is a U.S. Department of Defense autonomous system number registered under ARIN as part of the legacy block registration AFCONC-BLOCK1-AS, which spans AS379 through AS508 and belongs to Air Force Systems Networking (registrant organization handle 7ESG, Maxwell AFB, Alabama). Registry contact and abuse handling run through DISA-Columbus (Defense Information Systems Agency) at a mail.mil address, consistent with a military network rather than a commercial ISP — there is no dedicated operator website or PeeringDB-style public peering policy for AS427 itself. In routing terms AS427 is a small, stable stub: it originates 7 IPv4 prefixes covering roughly 133,120 addresses (including 132.61.0.0/16, 132.16.0.0/16, 132.3.12.0/22, 199.251.88.0/23, 192.77.104.0/24, 198.218.204.0/24 and 132.61.176.0/24), announces no IPv6, and CAIDA measures its AS degree as a single upstream (provider=1, peer=0, customer=0) with a customer cone of one — itself. The single observed BGP neighbour is AS27066 (a DoD Network Information Center AS), and the v4 announcement is broadly visible (323 of 324 RIS peers). One registry caveat is worth stating plainly: the RDAP record's own handle/name fields key off AS379 because this is a block registration, not a per-ASN record. On the security side, no notable public abuse signal was found as of 2026-07-02 — AS427 is absent from the live Spamhaus ASN-DROP list, and no NANOG, seclists, or malware-tracker threads tie it to hijacking, spam, or C2. The only flags are IRR route-object hygiene warnings on bgp.he.net (stale/missing IRR objects and an uncorroborated bogon notice), typical of a legacy 1989 government ASN and not an abuse incident.

Operator

Air Force Systems Networking (U.S. DoD/Air Force; ARIN block AFCONC-BLOCK1-AS, registrant handle 7ESG, Maxwell AFB, AL) [Confirmed] — ARIN RDAP autnum/427, bgp.he.net/AS427

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin)

Allocated

1989-08-04 (ARIN RDAP autnum top-level registration event for the AS379–508 block containing AS427); last changed 2008-06-06 [Confirmed] — ARIN RDAP autnum top-level events[]; corroborated by whois.ipip.net/AS427

Org status

active; RDAP status "active" on the parent AFCONC-BLOCK1-AS record; registrant organization Air Force Systems Networking, contact/abuse via DISA-Columbus [Confirmed] — ARIN RDAP autnum/427

Contacts

disa.columbus.ns.mbx.arin-registrations@mail.mil (DISA-Columbus, roles abuse/administrative/technical); registrant address 501 East Moore Dr, Bldg 884 Rm 1100 Gunther Annex, Maxwell AFB, AL 36114, US [Confirmed] — RIPEstat abuse-contact-finder, ARIN RDAP autnum/427

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-02 — absent from live Spamhaus ASN-DROP (422 records checked); no NANOG/seclists threads or abuse.ch malware-tracker hits. Only flag is IRR route-object hygiene / an uncorroborated bogon notice on bgp.he.net (5 of 7 prefixes show IRR origin-mismatch warnings), a data-quality artifact for a legacy government ASN, not an abuse incident

Network & routing

Network type

government / military stub AS (single-homed, provides no transit); administered via DISA registration services [Confirmed] — ipinfo.io/AS427, ipgeolocation.io AS427, CAIDA ASRank (degree=1)

Size

7 IPv4 prefixes / ~133,120 IPv4 addresses; 0 IPv6 prefixes; customer cone = 1 ASN (itself), 7 prefixes, 133,120 addresses [Confirmed] — RIPEstat routing-status / announced-prefixes, CAIDA ASRank (2026-07-02)

Routing/peering

single upstream — CAIDA degree total 1 (provider 1, peer 0, customer 0); one observed BGP neighbour AS27066 (DoD NIC); v4 seen by 323/324 RIS peers, v6 0/320. No public peering policy published (military network, no PeeringDB peering page) [Confirmed for routing facts; Likely for the no-policy characterization] — CAIDA ASRank, RIPEstat routing-status, bgp.he.net/AS427

RPKI

Unknown — RIPEstat rpki-validation was skipped (requires a per-prefix parameter not supplied); no ROA data retrieved for AS427's prefixes [Unknown] — RIPEstat rpki-validation (skipped: no --prefix)

Notable usage

official U.S. Air Force network infrastructure; one ASN within the AFCONC-BLOCK1-AS (AS379–508) DoD block; no public-facing commercial service, CDN, hosting, or eyeball-ISP function [Likely] — ipgeolocation.io AS427, ipinfo.io/AS427

Prefixes

198.218.204.0/24, 132.61.0.0/16, 132.16.0.0/16, 132.3.12.0/22, 199.251.88.0/23, 192.77.104.0/24, 132.61.176.0/24 [Confirmed] — RIPEstat announced-prefixes (window 2026-06-18 to 2026-07-02)

Registry-record anomaly

the RDAP JSON's handle reads "AS379" with startAutnum/endAutnum 379–508 — this is ARIN's standard block-registration pattern (AFCONC-BLOCK1-AS), not a fetch error; AS427 is one member of the block [Confirmed] — ARIN RDAP autnum/427

Analyst note

Encountered as a legacy DoD stub ASN inside a block registration. CAIDA reports an implausible lat/long centroid (Sea of Japan) and cliqueMember=true for a degree-1 stub — both treated as low-confidence CAIDA artifacts, not location/topology facts. Trust the continental-US registrant/contact postal addresses instead.