AS596

AS596 is a legacy autonomous system number registered under ARIN to Level 3 Parent, LLC, a wholly-owned subsidiary of Lumen Technologies, Inc. ARIN's own registry name for the block — CENTURYLINK-LEGACY-LVLT-596 — signals its status directly: this is not Lumen's actively peering flagship ASN (that role belongs to AS3356) but an older, internally retained resource. Four independent research passes converge on the same ARIN RDAP top-level registration event, 2002-06-05, as the ASN's allocated date, with a last-changed timestamp of 2019-12-04; several entity-level dates buried in the same RDAP record (2003, 2018, 2021, 2024) belong to unrelated point-of-contact and RPKI-ROA objects and were correctly excluded as decoys. Today AS596's live footprint is thin: it announces a single IPv4 prefix, 137.83.2.0/23 (512 addresses), no IPv6 space, and relies on AS3356 as its sole upstream, with zero customers and zero settlement-free peers by CAIDA's count. It has no PeeringDB listing at all. ARIN's registrant remarks reinforce the legacy framing, describing the covered addresses as non-portable and conditioning any Letter of Authorization on the prefix remaining actively announced to a Lumen ASN. No independent abuse, spam, or BGP-hijack signal ties to AS596 as of mid-2026; it is absent from both the bad-asn-list hosting blocklist and Spamhaus's ASN-DROP feed, and the only routing anomaly noted — an IRR origin mismatch on the announced prefix — is a registry-hygiene flag rather than a security incident.

Operator

Level 3 Parent, LLC (Lumen Technologies subsidiary; ARIN org handle LPL-141) [Confirmed] — https://rdap.arin.net/registry/autnum/596

Country / RIR

US, ARIN, status: active [Confirmed] — ARIN RDAP autnum/596

Allocated

2002-06-05 (ARIN RDAP top-level autnum "registration" event); last changed 2019-12-04 [Confirmed, 4 angles concur] — https://rdap.arin.net/registry/autnum/596 (entity-level dates for LPL-141 org, APL7-ARIN, LAC56-ARIN, RPKIR-ARIN point-of-contact objects were identified and excluded as decoys, not the ASN's own registration event)

Org status

ARIN record status active; registrant Level 3 Parent, LLC is active as a wholly-owned Lumen Technologies subsidiary; this specific ASN is explicitly named a "legacy" block, suggesting it is retained for continuity/abuse-handling rather than active peering [Confirmed for ARIN status; Likely for the legacy-operational characterization] — ARIN RDAP, Lumen Technologies 10-K (SEC EDGAR)

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-16 — absent from both the brianhama/bad-asn-list hosting blocklist and Spamhaus ASN-DROP; no NANOG archive threads found specific to AS596 abuse or hijacking; the one routing anomaly (an IRR origin-mismatch flag on the announced prefix) is a registry-hygiene note, not a corroborated abuse or hijack finding

Network & routing

Network type

legacy/internal address block; addresses marked non-portable; no PeeringDB listing found [Confirmed for PeeringDB absence and remarks text; Likely for the "legacy/internal" characterization as an inference from those facts]

Size

1 announced IPv4 prefix, 137.83.2.0/23 (512 addresses); 0 IPv6 prefixes; historically also originated 204.199.0.0/16 (~65,536 addresses, first seen 2012-05-12, no longer announced) [Confirmed] — RIPEstat routing-status, bgp.he.net/AS596, bgp.tools/as/596

Routing/peering

sole upstream AS3356 (Level 3 Parent, LLC / Lumen); 0 customers, 0 settlement-free peers per CAIDA asnDegree (bgp.he.net separately labels AS3356 a "peer," which conflicts with CAIDA's provider classification and is treated as a mislabeled transit relationship, not a distinct peering) [Confirmed for CAIDA degree data; Likely for the peers interpretation] — CAIDA ASRank asnDegree, https://bgp.tools/as/596

RPKI

not independently verified — an RPKIR-ARIN routing entity exists for ROA authoring (rpki-roa@lumen.com) but no ROA validity result was confirmed for the announced prefix; bgp.he.net separately flags an IRR origin mismatch on the prefix, which is a routing-registry hygiene note, not an RPKI finding

[Unknown/Likely] — ARIN RDAP RPKIR-ARIN entity, https://bgp.he.net/AS596

CAIDA AS rank

54,406; customer cone is itself only (1 ASN, 1 prefix, 512 addresses) [Confirmed] — CAIDA ASRank dataset, asn=596

Notable usage

ARIN registrant remarks flag the block as legacy/restricted — addresses described as non-portable, with LOA validity conditioned on the range also being actively announced to a Lumen ASN; a 6-point LOA policy covers routing restrictions, active-customer requirements, and reclamation on service termination; abuse contact abuse@aup.lumen.com; looking-glass at lookingglass.centurylink.com

[Confirmed] — ARIN RDAP remarks

Geo footprint

US; CAIDA geolocates the org near Iowa (approx. 41.64/-90.76), consistent with the sole announced prefix's association with "Iowa 80 Group, Inc." per bgp.tools; RDAP mailing addresses list Monroe, LA (registrant/abuse) and Broomfield, CO (admin/tech)

[Confirmed] — CAIDA ASRank dataset, https://bgp.tools/as/596, ARIN RDAP

Registry name

CENTURYLINK-LEGACY-LVLT-596 — the "LEGACY" designation distinguishes it from Lumen's flagship peering ASN AS3356 [Confirmed] — ARIN RDAP

Visibility

seen by 325/325 RIPE RIS peers on IPv4; 0/321 on IPv6; 1 observed neighbour, consistent with the single AS3356 upstream [Confirmed] — RIPEstat routing-status for AS596

Analyst note

a legacy CenturyLink/Level 3 block with a thin live footprint — one /23, one upstream, zero customers/peers, no PeeringDB presence — consistent with an internally retained, non-flagship ASN rather than an actively marketed peering point.