AS680

AS680 is the live, actively-routed autonomous system of DFN-Verein, Germany's national research and education network (NREN), currently announcing 294 IPv4 and 24 IPv6 prefixes with no notable public abuse designation as of 2026-07-18.

The ASN is registered under RIPE NCC to Verein zur Förderung eines Deutschen Forschungsnetzes e.V., a registered non-profit association headquartered in Berlin with a network operations center in Stuttgart. RDAP's top-level autnum registration event dates the record to 2002-09-20, most recently updated 2026-05-18.

DFN operates the X-WiN backbone: roughly 10,250 km of nationwide fiber connecting ~65 core locations and ~850 sites across ~350+ member institutions (universities, research institutes, and research-affiliated companies). Peering is selective, combining public exchange presence — BCIX Berlin, DE-CIX Frankfurt and Hamburg, MegaIX Düsseldorf — with private interconnects and direct research-network links.

By routing scale, AS680 ranks 966th on CAIDA's global AS Rank, with a customer cone of 38 ASNs, 617 prefixes, and roughly 11.9 million addresses; CAIDA's AS-degree inference shows 389 total relationships (31 customer, 354 peer, 4 provider). Third-party BGP tools name likely upstreams including Arelion, Lumen, NTT America, and Deutsche Telekom, though only the provider count is first-party confirmed.

DFN-Verein is an active, long-running organization founded in 1984, with recent (2025) infrastructure investment (a Nokia backbone partnership) and no documented BGP hijacks, leaks, or NANOG-discussed incidents attributed to this ASN.

ASN-level standing

Not present on the Spamhaus ASN-DROP list as of the 2026-07-18 edition, and no NANOG mailing-list thread describes a hijack, leak, or abuse escalation tied to AS680.

Host-level signal

blocklist.de reports four IPs in AS680's announced space (139.19.117.129, .130, .131, .197) with active SSH brute-force reports current as of 2026-07-18 — isolated end-host abuse typical of a large, multi-tenant R&E network, not evidence of ASN-level malice.

RPKI

No first-party RIPEstat per-prefix validation was queried; third-party bgp.he.net reports 254 of AS680's announced prefixes as RPKI-valid, so posture is tagged Likely rather than Confirmed.

Abuse contact

abuse@dfn.de, consistent across RIPE RDAP and RIPEstat.

Operator

Verein zur Förderung eines Deutschen Forschungsnetzes e.V. (DFN-Verein), non-profit association, Berlin/Stuttgart, Germany [Confirmed] — https://rdap.db.ripe.net/autnum/680, https://www.dfn.de/en/dfn-verein/

Country / RIR

DE, RIPE NCC [Confirmed] — https://rdap.db.ripe.net/autnum/680

Allocated

2002-09-20 (RIPE RDAP autnum top-level registration event); last changed 2026-05-18 [Confirmed] — https://rdap.db.ripe.net/autnum/680

Org status

active, founded 1984; registered non-profit association (gemeinnütziger e.V.), Vereinsregister Amtsgericht Berlin-Charlottenburg VR 7729 B; >350 voting member institutions [Confirmed] — https://www.dfn.de/en/dfn-verein/

Contacts

abuse@dfn.de [Confirmed] — https://stat.ripe.net/AS680

Security/abuse context (NEUTRAL, DATED)

absent from Spamhaus ASN-DROP and NANOG incident archives as of 2026-07-18; blocklist.de flags 4 individual IPs for active SSH brute-force reporting in the same window, consistent with isolated end-host abuse on a large multi-tenant network [Confirmed for absence from ASN-DROP; Confirmed for blocklist.de IP flags] — https://www.spamhaus.org/drop/asndrop.txt, https://www.blocklist.de/en/search.html?as=680

Network & routing

Network type

national research and education network (NREN); operates the X-WiN backbone (~10,250 km fiber, ~65 core locations, ~850 connected sites) [Confirmed] — https://www.dfn.de/en/network/, https://www2.dfn.de/en/xwin

Size

294 IPv4 prefixes (~7,716,096 addresses), 24 IPv6 prefixes announced; CAIDA AS rank 966; customer cone 38 ASNs / 617 prefixes / ~11.89M addresses [Confirmed] — https://stat.ripe.net/AS680, https://asrank.caida.org/asns/680

Routing/peering

CAIDA degree total 389 (customer 31, peer 354, provider 4); selective peering policy per PeeringDB with public presence at BCIX Berlin, DE-CIX Frankfurt/Hamburg, MegaIX Düsseldorf [Confirmed]. Named upstreams (Arelion AS1299, Lumen AS3356, NTT America AS2914, Deutsche Telekom AS3320) sourced from a single third-party BGP tool

[Likely] — https://asrank.caida.org/asns/680, https://www.peeringdb.com/asn/680, https://bgp.tools/as/680

RPKI

not independently confirmed per-prefix via RIPEstat; bgp.he.net reports 254 RPKI-valid announced prefixes [Likely] — https://bgp.he.net/AS680

Notable usage

backbone connectivity for 350+ German academic/research member institutions at ~850 locations; also runs DFN-CERT security services, PKI, and eduroam-type federated access [Confirmed] — https://www.dfn.de/en/dfn-verein/, https://www2.dfn.de/en/xwin

Related ASNs

none independently corroborated in this pass [Unknown]

Analyst note

Actively routed NREN ASN with a clean ASN-level reputation and isolated, typical-for-R&E host-level SSH-scan reports; RIR registration date is a first-party RIPE RDAP fact, recorded per policy.