AS749

AS749 is an actively routed legacy autonomous system registered to the United States Department of Defense (ARIN organization handle USDDD, autnum name DNIC-AS-00749) that currently originates roughly 3,100–3,150 IPv4 prefixes and zero IPv6 space, making it one of the largest single announcers of IPv4 address space globally.

Three independent routing sources — RIPEstat, bgp.he.net, and bgp.tools — converge on the same picture: about 224–225 million IPv4 addresses announced through a single visible upstream, AS3356 (Lumen Technologies / Level 3 Parent, LLC). CAIDA's AS-rank places it at 12497, driven by a customer cone of just itself (no downstream customer ASNs) — a different metric from, and not contradicted by, its outsized raw address volume.

The announced space includes large legacy Class A blocks such as 6.0.0.0/8, 7.0.0.0/8, 11.0.0.0/8, 21.0.0.0/8, and 22.0.0.0/8, historically associated with DoD and military use. bgp.he.net also flags apparent bogon-route origination and IRR parent-route mismatches on some prefixes; these read as routing-registry data-quality artifacts typical of a large legacy allocation rather than confirmed deliberate DoD network behavior.

ARIN RDAP's top-level autnum record for AS749 carries no registration event — only a single "last changed" event dated 2025-09-12 — so this entry cannot report a genuine allocation date. A 2007-01-12 date exists only on the nested USDDD registrant organization record, documenting when that org record was created, not when AS749 itself was allocated; it is not substituted here.

Registration and abuse contact resolve to DISA-Columbus (Defense Information Systems Agency), Whitehall, OH, consistent with DoD's historical administration of this ASN through the Defense Network Information Center. RPKI coverage appears negligible: bgp.he.net shows zero RPKI-valid and zero RPKI-invalid origins across its announced prefixes, indicating the space is effectively uncovered by ROAs rather than actively validated.

Abuse signal

No notable public abuse signal found as of 2026-07-27; CleanTalk reports a 0.00% spam rate for AS749.

Coverage gap

Spamhaus's ASN blocklist page, AbuseIPDB's AS749 check, and ThreatFox's AS749 browse page were not directly accessible this pass (404, 403, and a bot-verification challenge respectively) — their listing status is Unknown, not confirmed clean.

RPKI exposure

Zero RPKI-valid and zero RPKI-invalid origins observed, consistent with minimal-to-no ROA coverage across AS749's ~3,100+ announced prefixes.

Routing hygiene

bgp.he.net flags apparent bogon-route origination and IRR parent-route mismatches on some prefixes — a data-quality signal, not a confirmed incident.

Not to be confused with

the 2021 activation of previously dark DoD address space widely attributed to Global Resource Systems LLC ran under AS8003, a separate ASN — that event is not evidence of abuse on AS749.

Operator

United States Department of Defense (DoD); ARIN org handle USDDD; autnum registry name DNIC-AS-00749 (DNIC = Defense Network Information Center) [Confirmed] — rdap.arin.net/registry/autnum/749

Country / RIR

US, ARIN [Confirmed] — rdap.arin.net/registry/autnum/749, RIPEstat abuse-contact-finder (authoritative_rir: arin)

Allocated

Unknown — ARIN RDAP top-level autnum events[] for AS749 carries no 'registration' action, only a single 'last changed' event dated 2025-09-12; re-verified live via a fresh RDAP re-fetch. A 2007-01-12 date exists only on the nested USDDD registrant org record (entity-level, not the autnum's own event) and is not substituted

[Confirmed absence of a top-level date] — rdap.arin.net/registry/autnum/749

Org status

Active per ARIN RDAP; registrant United States Department of Defense (USDDD), historically administered via DISA-Columbus (Defense Information Systems Agency), Whitehall, OH [Confirmed] — rdap.arin.net/registry/autnum/749

Contacts

abuse — disa.columbus.ns.mbx.hostmaster-dod-nic@mail.mil; registrant address 300 North James Road, Whitehall, OH; org billing address 3990 E. Broad Street, Columbus, OH 43218 [Confirmed] — RIPEstat abuse-contact-finder, rdap.arin.net/registry/autnum/749

Website

Unknown — no official DoD/DISA website field on PeeringDB; direct fetch attempts to disa.mil did not return verifiable DISA content this session (404 on a guessed subpath, connect-refused, and one bare-domain fetch resolving to unrelated third-party content) [Unknown] — peeringdb.com/asn/749

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-27; CleanTalk reports 0.00% spam rate. Spamhaus ASN blocklist, AbuseIPDB, and ThreatFox were not directly accessible this pass (404/403/bot-challenge) — their status is Unknown, not confirmed clean. Not to be confused with AS8003 (Global Resource Systems LLC), a separate ASN behind the 2021 DoD dark-space activation [Likely] — cleantalk.org/blacklists/AS749, spamhaus.org/blocklist/asn-blocklist/?asn=749, abuseipdb.com/check/AS749, threatfox.abuse.ch/browse/asn/749

Network & routing

Network type

Government / federal defense network [Confirmed] — peeringdb.com/asn/749

Size

~3,130–3,150 IPv4 prefixes (RIPEstat 3,138 / bgp.he.net 3,150 / bgp.tools 3,134), 0 IPv6 prefixes, ~224–225M IPv4 addresses; customer cone = 1 ASN (itself), 0 downstream customers [Confirmed] — stat.ripe.net/AS749, bgp.he.net/AS749, bgp.tools/as/749, asrank.caida.org/asns/749 (2026-07)

Routing/peering

single observed upstream AS3356 (Lumen/Level 3 Parent, LLC); 3 IPv4 peers observed on bgp.he.net (0 IPv6); PeeringDB lists policy "Open" but shows 0 prefixes and no facility/IX presence recorded, suggesting an unpopulated/default field rather than an actively maintained peering program [Confirmed for AS3356 upstream; Likely for peering-policy characterization] — bgp.he.net/AS749, bgp.tools/as/749, peeringdb.com/asn/749

RPKI

0 RPKI-valid and 0 RPKI-invalid origins observed across announced prefixes (effectively uncovered by ROAs); RIPEstat rpki-validation was not queryable without a specific prefix argument in this pass [Likely] — bgp.he.net/AS749

Notable usage

announces large legacy Class A blocks (6.0.0.0/8, 7.0.0.0/8, 11.0.0.0/8, 21.0.0.0/8, 22.0.0.0/8) historically associated with DoD/military use; bgp.he.net flags apparent bogon-route origination and IRR parent-route mismatches on some prefixes, read as data-quality artifacts of a large legacy allocation rather than confirmed deliberate behavior

[Likely] — bgp.he.net/AS749

Related ASNs

none confirmed as related this pass; distinct from AS8003 (Global Resource Systems LLC), which handled the 2021 DoD dark-space activation and is a separate, unrelated ASN [Unknown for a confirmed sibling list; Confirmed for the AS8003 distinction] — general routing-community knowledge, not independently re-verified this session

Registry last changed

2025-09-12 [Confirmed] — rdap.arin.net/registry/autnum/749

Analyst note

encountered as a large, actively-routed legacy DoD ASN with no top-level RDAP allocation date — the nearest candidate date (2007-01-12) is a nested USDDD org-record creation date, not the ASN's own allocation event, and is kept as null rather than substituted. WebSearch was unavailable this session; several abuse-tracking feeds (Spamhaus, AbuseIPDB, ThreatFox) and DISA's own site were unreachable via direct fetch, so those fields are honestly Unknown rather than assumed clean or populated.