AS8068

AS8068 is an active autonomous system registered under ARIN to Microsoft Corporation as part of the MICROSOFT-CORP-MSN-AS-BLOCK, the contiguous block spanning AS8068–AS8075. It is one of several subordinate Microsoft ASNs that route exclusively through the company's primary public-facing AS8075; every routing source consulted (RIPEstat, bgp.he.net, bgp.tools) agrees AS8068 has a single observed upstream and a single observed peer — AS8075 — making it a content/CDN stub within Microsoft's global anycast infrastructure rather than an independent transit network. AS8068 carries Microsoft consumer/MSN and content-delivery traffic, announcing 41 IPv4 prefixes (~10,496 addresses) and 33 IPv6 /48s, all of which carry valid RPKI ROAs (100% valid, 0 invalid). Its prefixes are fully visible across RIS (326/326 peers for IPv4, 323/323 for IPv6) and span US-primary and UK-secondary anycast deployments. Microsoft maintains a Selective, private-contract-only peering policy administered by its Routing, Peering, and DNS team (IOC@microsoft.com), requiring dual-stack sessions, RPKI/MANRS compliance, and public IRR registration under AS-MICROSOFT. The autnum's ARIN registration date is 1997-03-31 (last changed 2013-09-04). No notable public abuse signal was found for AS8068 specifically as of 2026-06-25 — it does not appear on the Spamhaus DROP/ASN-DROP list, and no NANOG abuse threads or BGP hijack incidents were attributed to it; scattered individual-IP reports in third-party databases reflect the expected noise of a hyperscaler CDN block.

Operator

Microsoft Corporation (public company, NASDAQ: MSFT; ARIN OrgId MSFT; HQ One Microsoft Way, Redmond, WA 98052, US) [Confirmed] — ARIN RDAP autnum/8068, news.microsoft.com/facts-about-microsoft/

Country / RIR

US, ARIN [Confirmed] — ARIN RDAP autnum/8068

AS name / block

MICROSOFT-CORP-MSN-AS-BLOCK; block spans AS8068–AS8075 (registered together) [Confirmed] — ARIN RDAP autnum/8068

Allocated

1997-03-31 (ARIN autnum top-level registration event, a first-party RIR registry fact, NOT an IEEE date); last changed 2013-09-04 [Confirmed] — ARIN RDAP autnum/8068 top-level events (entity-level contact dates were ignored as decoys)

Contacts

abuse@microsoft.com (spam/general); secure@microsoft.com (security vulns); msndcc@microsoft.com (law enforcement); IOC@microsoft.com (routing/peering, MRPD-ARIN validated handle) [Confirmed] — ARIN RDAP autnum/8068, RIPEstat abuse-contact-finder

Org status

active public company (NASDAQ: MSFT), incorporated in Washington State 1981; operates Azure, Microsoft 365, Windows, Xbox, LinkedIn; ~228,000 employees (FY2025) [Confirmed] — news.microsoft.com/facts-about-microsoft/

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found for AS8068 specifically as of 2026-06-25 — not on Spamhaus DROP/ASN-DROP; no NANOG abuse threads or BGP hijack incidents attributed; scattered individual-IP reports reflect hyperscaler CDN noise

Network & routing

Network type

content / cloud delivery (large-scale anycast CDN infrastructure); subordinate stub ASN within Microsoft's block [Confirmed] — peeringdb.com/asn/8068, bgp.tools/as/8068

Size

41 IPv4 prefixes (~10,496 addresses) and 33 IPv6 /48s announced; full RIS visibility (326/326 v4, 323/323 v6) [Confirmed] — RIPEstat routing-status, bgp.he.net/AS8068, bgp.tools/as/8068

Routing/peering

single observed upstream/peer AS8075 (Microsoft); routes exclusively through the parent ASN; first seen in routing 2000-08-18 (207.46.0.0/19); average AS-path length ~4.05 [Confirmed] — bgp.he.net/AS8068, RIPEstat routing-status

Peering policy

Selective, private-only contract. Exchange peering ≥10 Gbps port / ≥500 Mbps traffic; direct peering 100 Gbps SMF / ≥2 Gbps traffic; ISPs/NSPs only [Confirmed] — learn.microsoft.com/en-us/azure/internet-peering/policy, peeringdb.com/asn/8068

Peering technical requirements

dual-stack IPv4+IPv6 sessions required; MD5 not supported; RPKI/MANRS compliance; routes in public IRR (RADb) under AS-MICROSOFT; ExpressRoute AS12076 routes excluded [Confirmed] — learn.microsoft.com/en-us/azure/internet-peering/policy

RPKI

100% valid — all 41 IPv4 and 33 IPv6 prefixes carry valid ROAs; 0 invalid, 0 unknown [Confirmed] — bgp.he.net/AS8068, bgp.tools/as/8068

Geo footprint

US primary (Redmond-headquartered; 13.107/131.253/150.171/52.113/204.79.197 ranges); UK secondary (2a01:111:* /48s); global anycast [Confirmed] — bgp.he.net/AS8068, RIPEstat routing-status

Customer cone / AS rank

Unknown — CAIDA AS-rank/customer-cone lookups timed out; not reported by bgp.he.net or bgp.tools in fetched content [Unknown] — no source

Related ASNs

AS8075 (Microsoft primary public-facing/transit ASN); siblings AS8069–AS8074 in the same block; AS12076 reserved for ExpressRoute [Confirmed for AS8075/AS12076; Likely for sibling enumeration] — bgp.tools/as/8068, learn.microsoft.com/en-us/azure/internet-peering/policy

Analyst note

Encountered as an active subordinate Microsoft ASN. Live routing is real but flows entirely through parent AS8075; treat AS8068 as a content/CDN stub, not an independent operator. Clean abuse posture.