AS666

AS666 is a legacy U.S. Army autonomous system, registered to Headquarters, USAISC in 1990, that currently announces zero prefixes and is not visible on the live BGP table. ARIN's autnum status reads "active," but that reflects the registration remaining valid administratively, not current routing activity — RIPEstat and CAIDA both confirm it originates nothing today.

The registration traces to CTNOSC (Consolidated Theater Network Operations and Security Center), a network-defense element inside the U.S. Army's network-operations lineage. USAISC (1984) evolved into U.S. Army Signal Command (1996) and then NETCOM — Army Network Enterprise Technology Command (2002–present) — under U.S. Army Cyber Command, headquartered at Fort Huachuca, AZ. ARIN's org record was never updated past the 1984-era "USAISC" name.

RIS BGP archives show AS666 did announce prefixes for a window between March 2020 and June 2022 (first seen 185.35.136.0/22, last seen 103.79.72.0/24), but no RIS peer currently sees any route from it — 0 of 325 IPv4 peers and 0 of 320 IPv6 peers. CAIDA ranks it 79,459 globally, with a customer cone of just itself: 0 prefixes, 0 addresses.

PeeringDB lists an "Open" peering policy for AS666, but the same record shows zero prefixes, no IXP presence, and traffic "Not Disclosed" — consistent with an inactive/placeholder listing rather than an active peering relationship. No dedicated public network-services page for this ASN could be located on any official Army domain (netcom.army.mil returned HTTP 403 on direct fetch).

Exposure

AS666 currently announces zero prefixes on the public Internet (RIPEstat, CAIDA), so it presents no live routing attack surface today; its last observed announcement ended in June 2022.

Abuse signal

Not listed on the Spamhaus ASN-DROP list as of 2026-07-18 (https://www.spamhaus.org/drop/asndrop.txt); no sourced reports of BGP hijacks or route leaks were found.

NANOG mention

A 2014-08-18 NANOG-archive thread flagged an unrelated troll email that spoofed an "AS666 NOC" signature — this was not abuse originating from AS666's own network (https://seclists.org/nanog/2014/Aug/311).

RPKI

Unknown/not applicable — no prefixes are currently announced, so there is no live route to validate against a ROA.

Operator

Headquarters, USAISC (U.S. Army; ARIN org handle HEADQU-3), lineage now NETCOM / U.S. Army Cyber Command, Fort Huachuca, AZ [Confirmed] — ARIN RDAP autnum/entity records

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin)

Allocated

1990-04-19 (ARIN autnum top-level registration event); last changed 2012-11-06 [Confirmed] — ARIN RDAP autnum top-level events (entity-level dates for the technical/abuse contact and registrant org records were identified as decoys and excluded)

Org status

command lineage (NETCOM/Army Cyber Command) is active and operating; the AS666 registration itself is stale — registrant name never migrated off "USAISC," last updated 2012-11-06, zero announced prefixes [Likely] — army.mil/netcom, ARIN RDAP

Security/abuse context

no notable public abuse signal as of 2026-07-18 — absent from Spamhaus ASN-DROP; one unrelated 2014 NANOG-archive troll email spoofed an "AS666 NOC" signature, not actual abuse from this ASN

Abuse contact

disa.columbus.ns.mbx.arin-registrations@mail.mil; +1-844-347-2457 ext 2; DISA-Columbus, 300 North James Road, Whitehall, OH 43213

Network & routing

Network type

U.S. government/military (Army) network, not a commercial ISP; legacy/dormant on the public-routing side [Confirmed] — PeeringDB, ARIN RDAP

Size

dormant — 0 IPv4 prefixes / 0 addresses, 0 IPv6 prefixes; customer cone = 1 ASN (itself), 0 prefixes, 0 addresses [Confirmed] — RIPEstat routing-status, CAIDA AS Rank (2026-07-18)

Routing/peering

NOT currently announced — 0/325 IPv4 RIS peers, 0/320 IPv6 RIS peers see it; CAIDA degree total 0 (customer 0, peer 0, provider 0); historical announcement window 2020-03-10 to 2022-06-22 [Confirmed] — RIPEstat routing-status, CAIDA AS Rank

PeeringDB listing

policy "Open," but 0 prefixes, no IX presence, traffic not disclosed — read as an inactive/placeholder entry [Confirmed] — https://www.peeringdb.com/asn/666

RPKI

not assessable — zero prefixes currently announced, so no ROA to validate [Unknown] — RIPEstat rpki-validation (skipped, requires a prefix parameter)

Notable usage

no current public-routing usage; historical BGP window only (2020–2022) [Confirmed]. Official website content for the operating command is unverified — netcom.army.mil returned HTTP 403 on direct fetch [Unknown] — https://www.netcom.army.mil/

Related ASNs

none identified in this research pass [Unknown]

Analyst note

RDAP status reads "active" but live BGP presence ended June 2022; treat as a dormant legacy DoD registration, not an operating network.