AS731
Operated by AFCONC-BLOCK2-AS - Air Force Systems Networking.
Summary
- // analyst note
- Dormant DoD/Air Force ASN, no live routing since Dec 2016. Standout finding is a ~12-day bogon mis-origination of a Swedish prefix in Dec 2016, corroborated by Hurricane Electric and RIPEstat. No top-level RDAP registration event exists on the autnum object, so allocated_date is Unknown rather than borrowed from an entity-level or sibling-block date.
- // security note
- NEUTRAL/DATED: no notable public abuse signal found as of 2026-07-26 beyond the December 2016 bogon anomaly; not in Spamhaus ASN-DROP; no NANOG mentions found; Cisco Talos lookup blocked (HTTP 403, unverified).
About this ASN.
AS731 is a dormant U.S. Air Force–administered autonomous system that has announced zero prefixes since December 21, 2016. It is registered under ARIN to Air Force Systems Networking (registrant entity 7ESG, Maxwell AFB, Alabama) with administrative, technical, and abuse contact handled by DISA-Columbus.
The ASN sits inside ARIN's AS727–AS746 block, named AFCONC-BLOCK2-AS, alongside sibling Air Force ASNs. No PeeringDB record exists for AS731, and no public operator website was located — consistent with an internal DoD administrative allocation rather than a commercial or transit network.
Historically, AS731 originated three short-lived prefixes: 192.156.15.0/24 and 192.156.26.0/24, each announced for roughly 12 days in June 2009, and 91.220.58.0/24 for about 12 days in December 2016. That last announcement stands out — 91.220.58.0/24 is a Swedish block registered to Karlström & Dahlstrand AB, not DoD/Air Force space. Hurricane Electric's BGP toolkit explicitly flags AS731 under bogon prefixes for this announcement, and RIPEstat's independent routing history corroborates the same prefix and dates. The episode reads as a mis-origination or bogon-leak event rather than confirmed malicious activity, and it is the ASN's only visible routing activity since 2016.
RPKI validation does not apply: AS731 announces no current prefixes, so there are no ROAs to check. CAIDA ranks it 79,459 with a singleton customer cone (0 prefixes, 0 addresses) and zero measured degree — no customers, peers, or providers.
- Operator
- Air Force Systems Networking (ARIN registrant entity 7ESG, Maxwell AFB, AL); admin/technical/abuse contact DISA-Columbus (REGIS10-ARIN) [Confirmed] — ARIN RDAP autnum/731
- Country / RIR
- US, ARIN [Confirmed] — RIPEstat whois resource 731
- Allocated
- Unknown — the RDAP autnum object's top-level events[] contains only a "last changed" event (2008-06-06); no top-level "registration" eventAction is present. A 2009-06-24 registration date exists but is nested under the registrant entity object, not the autnum itself, so it is excluded per the no-decoy-date rule[Confirmed absence] — ARIN RDAP autnum/731
- Org status
- Active (ARIN RDAP registration status) [Confirmed] — ARIN RDAP autnum/731
- Contacts
- abuse/admin/tech — REGIS10-ARIN, disa.columbus.ns.mbx.arin-registrations@mail.mil, +1-844-347-2457, 300 North James Road, Whitehall, OH 43213, US; registrant org 7ESG, Maxwell AFB, AL 36114, US [Confirmed] — RIPEstat abuse-contact-finder resource 731, ARIN RDAP autnum/731
Security/abuse context (NEUTRAL, DATED)
no notable public abuse/threat-feed signal found as of 2026-07-26 beyond the December 2016 bogon anomaly documented above; not in Spamhaus ASN-DROP; no NANOG archive mentions; Cisco Talos lookup blocked (HTTP 403, unverified)
Network & routing
- Network type
- U.S. Department of Defense / Air Force administrative network block, ARIN-registered, DISA-administered; not a commercial ISP or transit provider [Likely] — ARIN RDAP autnum/731
- Size
- dormant — 0 IPv4 prefixes / 0 IPv4 addresses and 0 IPv6 prefixes today; customer cone = 1 ASN (itself), 0 prefixes, 0 addresses [Confirmed] — RIPEstat announced-prefixes/routing-status resource 731, CAIDA AS Rank asn 731 (2026-07)
- Routing/peering
- NOT announced — 0/331 RIS peers seeing it (v4), 0/324 (v6); CAIDA degree total 0 (customer 0, peer 0, provider 0); no PeeringDB record [Confirmed]. Historically, one anomalous observed neighbour, AS197339 (Plennyx, France), surfaced in passive BGP data; the nature of that relationship is unverified[Unknown] — bgp.he.net/AS731
- RPKI
- not applicable — AS731 announces no current prefixes, so there are no ROAs to validate [Confirmed] — RIPEstat routing-status resource 731
- Notable usage
- unrouted/dormant since 2016-12-21; historical originations were three short-lived prefixes (192.156.15.0/24 and 192.156.26.0/24 in June 2009, 91.220.58.0/24 in December 2016), the last being a corroborated bogon/mis-origination of a Swedish block[Confirmed] — bgp.he.net/AS731, RIPEstat routing-history resource 731
- Related ASNs
- part of ARIN block AS727–AS746 (AFCONC-BLOCK2-AS) [Confirmed] — ARIN RDAP autnum/731
- Analyst note
- Dormant DoD/Air Force ASN with no live routing since December 2016. The one notable event in its history is a ~12-day bogon mis-origination of a Swedish prefix (91.220.58.0/24) in December 2016, cross-corroborated by two independent sources. No top-level RIR registration date exists on the autnum record itself, so allocated_date is recorded as Unknown rather than borrowed from an entity-level or sibling-block decoy date.