AS609

AS609 is an ARIN-registered autonomous system number held by Ernst & Young LLP, the U.S. member firm of the global professional-services network, with its RIR registrant address at 200 Plaza Drive, Secaucus, New Jersey. Unlike a transit provider or ISP, AS609 functions as a stub enterprise network: CAIDA's customer cone shows it terminates at itself (1 ASN, 5 prefixes, 5,120 addresses), and its AS-degree record shows two providers and zero customers or settlement-free peers, consistent with a corporate network that solely announces its own address space rather than carrying anyone else's traffic. It currently originates four IPv4 prefixes (199.52.148.0/24, 199.52.149.0/24, 199.52.150.0/24, and 199.52.240.0/20 — 4,864 addresses total) plus one IPv6 block (2602:80d:8000::/36), and is fully visible across the RIPE RIS peer mesh (327/327 IPv4 peers, 322/322 IPv6 peers), indicating stable, well-propagated announcements rather than a flaky or partial origination. Its two observed upstreams are AS3356 (Lumen/Level 3) and AS13237 (euNetworks), independently corroborated by bgp.he.net and bgp.tools. EY separately holds a distinct ASN, AS400060 ("ARIN-EYL"), which must not be conflated with this record. No public abuse, blocklist, or NANOG-archive signal was found tied specifically to AS609 as of 2026-07-17; EY's well-documented corporate data-breach history (the 2023 Cl0p/MOVEit mass exploitation and an October 2025 exposed Azure SQL backup) involved third-party cloud infrastructure, not this ASN's announced space, and is not evidence of ASN-level abuse.

Operator

Ernst & Young LLP, 200 Plaza Drive, Secaucus, NJ 07094 [Confirmed] — https://rdap.arin.net/registry/autnum/609

Country / RIR

US, ARIN [Confirmed] — https://stat.ripe.net/AS609 (abuse-contact-finder authoritative_rir: arin)

Allocated

2009-07-22 (ARIN RDAP autnum TOP-LEVEL registration event, distinct from decoy entity-level dates — registrant org "EYL" 1996-01-31 and POC 2019-04-09, which are not the ASN allocation date); last changed 2023-10-04

[Confirmed] — https://rdap.arin.net/registry/autnum/609 (independently read by two research angles)

Org status

Active [Confirmed] — https://rdap.arin.net/registry/autnum/609

Contacts

abuse Internet@ey.com [Confirmed] — https://stat.ripe.net/AS609

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-17 — not on Spamhaus ASN-DROP, no NANOG mailing-list abuse-desk history, no ASN-level threat-intel attribution located via web search; AbuseIPDB per-IP scores were inaccessible without login (Unknown, not assumed clean)

Network & routing

Network type

Likely enterprise/corporate stub network (not a public ISP or transit/content network) — inferred from ASName pattern, absence of a PeeringDB net record, and EY's core business [Likely] — https://www.peeringdb.com/api/net?asn=609 (404, no record)

Size

4 IPv4 prefixes / 4,864 addresses; 1 IPv6 prefix (2602:80d:8000::/36) / 4,096 /48s [Confirmed] — https://stat.ripe.net/AS609, https://bgp.tools/as/609

Routing/peering

fully visible (327/327 v4 RIS peers, 322/322 v6 RIS peers); 2 upstreams, 0 peers, 0 customers — AS3356 (Lumen/Level 3) and AS13237 (euNetworks) [Confirmed] — https://bgp.he.net/AS609, https://bgp.tools/as/609

RPKI

not RIPEstat-verified this cycle (rpki-validation was skipped — requires a --prefix argument, none supplied); third-party pages (bgp.he.net, bgp.tools) report all announced prefixes RPKI-valid [Likely] — https://bgp.he.net/AS609, https://bgp.tools/as/609

AS rank / customer cone

CAIDA AS rank 20435; customer cone = 1 ASN (itself), 5 prefixes, 5,120 addresses (stub/leaf network) [Confirmed] — https://api.asrank.caida.org/v2/restful/asns/609

Geo footprint

New York City metro area (lat 40.75 / long -73.99), country US, consistent with RDAP registrant/POC addresses in Secaucus NJ and New York NY [Confirmed] — https://api.asrank.caida.org/v2/restful/asns/609, https://rdap.arin.net/registry/autnum/609

Notable usage / website

no independently documented notable public usage found for AS609 specifically; ey.com is EY's official corporate site with no AS609/network-specific subpage [Unknown for notable usage; Confirmed for website] — https://www.ey.com/en_us/locations/united-states

Related ASNs

Ernst & Young LLP separately holds AS400060 ("ARIN-EYL"), active with its own upstreams (AS3356, AS7018) — a distinct ASN, not merged into this record [Likely] — https://bgp.tools/as/400060

ASN / AS name

AS609 / EY-AS-L [Confirmed] — https://rdap.arin.net/registry/autnum/609

Org-level breach caveat

EY (the org) has documented 2023 Cl0p/MOVEit and October 2025 Azure SQL-backup exposure incidents; neither is attributed to AS609's announced IP space — third-party-cloud data exposures, not ASN-level abuse [Confirmed as org-level, not ASN-level] — https://securityaffairs.com/184062/data-breach/ernst-young-exposes-4tb-sql-server-backup-publicly-on-microsoft-azure.html

IANA RFC reference

none applicable; left blank rather than fabricated [Confirmed]