AS876

AS876 is a legacy autonomous system registered to GONET (Government of Ontario) that today originates exactly one IPv4 prefix, 204.41.243.0/24 (256 addresses), reaching the Internet through a single observed upstream, AS852 (TELUS Communications Inc.) — a small, single-homed government network rather than a transit or hosting operator.

ARIN RDAP carries no standalone record for AS876; the query resolves to a consolidated block object spanning AS857–AS885, handle AS857, name GONET-ASN-17, registrant GONET / Government of Ontario (entity GOVER-10, Ministry of Public and Business Service Delivery and Procurement, Infrastructure Technology Services). That block's top-level RIR registration event, 1990-08-07, is the authoritative allocated_date for AS876; last-changed on the record is 2021-02-23.

Routing metrics for AS876 itself are thin but consistent: CAIDA ASRank placed it at 67,700 as of an August 2026 lookup, its customer cone is a singleton (1 ASN, 1 prefix, 256 addresses, i.e. no downstream customers), and RPKI coverage is absent — bgp.he.net reports 0 RPKI-valid and 0 RPKI-invalid origins, meaning the announcement is unvalidated rather than flagged invalid.

The operator's own PeeringDB record (filed under the block's representative handle, AS857) names the network "Ontario Public Service (OPS)," self-classifies as Government, and declares a Restrictive/Private-Only peering policy with no public IX presence or route-server URL. No GONET-branded site distinct from the general ontario.ca provincial portal was found as of an August 2026 search.

A sibling ASN in the same GONET organization, AS808, is separately registered and — per third-party BGP data — carries far more visible public traffic (roughly 54 IPv4 prefixes, hosting domains such as ontarioparks.com and publichealthontario.ca). That activity belongs to AS808's own announcements and is noted here only as organizational context; it is not an AS876 fact.

Public abuse feeds

no AS876-specific entry found on ThreatFox, URLhaus, or Feodo Tracker as of an August 2026 search; the retrieved Spamhaus ASN-DROP excerpt did not show AS876, but the list is large and the fetch returned only a partial excerpt, so absence there is Unknown rather than confirmed-clean.

NANOG archives

no thread naming AS876 or GONET found as of an August 2026 search of mailman.nanog.org and community.nanog.org.

Malware/CVE association

none found as of an August 2026 search; no CVE, botnet, or threat-actor attribution names AS876 or GONET.

Routing anomaly (unresolved)

bgp.he.net's AS876 page displays the text "AS876 announces bogons" next to an empty Bogon Prefixes table; this could not be corroborated as an active bogon announcement versus a page-template artifact, so it is reported as an observed page state, not a confirmed finding.

Exposure

single-prefix, single-upstream government network with no RPKI ROA coverage on its one announced /24 — a routing-hygiene gap to note, not evidence of compromise.

Operator

GONET (Government of Ontario) — registrant entity GOVER-10, Ministry of Public and Business Service Delivery and Procurement, Infrastructure Technology Services, 222 Jarvis St., Toronto, ON M7A 0B6; PeeringDB self-listing names the network "Ontario Public Service (OPS)"

[Confirmed] — https://rdap.arin.net/registry/entity/GOVER-10, https://www.peeringdb.com/asn/857

Country / RIR

CA, ARIN [Confirmed] — https://rdap.arin.net/registry/autnum/876

Allocated

1990-08-07 (ARIN RDAP autnum top-level registration event for the consolidated AS857–AS885 block containing AS876, NOT AS876's own standalone record — ARIN has none); last changed 2021-02-23 [Confirmed] — https://rdap.arin.net/registry/autnum/876

Org status

active per ARIN RDAP autnum status; registrant GONET / Government of Ontario, entity GOVER-10 [Confirmed] — https://rdap.arin.net/registry/autnum/876

Contacts

CSOC@ontario.ca (CSB8-ARIN, Cyber Security Branch, roles technical/routing/noc/abuse; ARIN records no response from this POC since 2023-11-07); general registrant address is Ministry of Public and Business Service Delivery and Procurement, Infrastructure Technology Services, 222 Jarvis St., 6th Floor, Toronto, ON M7A 0B6, Canada

[Confirmed] — https://rdap.arin.net/registry/autnum/876, https://rdap.arin.net/registry/entity/GOVER-10

Security/abuse context (NEUTRAL, DATED)

no notable public abuse, malware, or hijack signal found for AS876 as of an August 2026 search across ThreatFox, URLhaus, Feodo Tracker, Spamhaus ASN-DROP (partial fetch), and NANOG archives; a bgp.he.net "announces bogons" label with an empty bogon-prefix table is unresolved, not confirmed

Network & routing

Network type

Government (self-classified in PeeringDB); internal IP network of the Ontario provincial government [Confirmed] — https://www.peeringdb.com/asn/857

Size

1 IPv4 prefix / 256 addresses (204.41.243.0/24); 0 IPv6 prefixes; customer cone = 1 ASN (singleton), 1 prefix, 256 addresses [Confirmed] — https://bgp.he.net/AS876, https://asrank.caida.org/asns/876

Routing/peering

sole observed adjacency is AS852 (TELUS Communications Inc.), acting as upstream; no additional peers listed; CAIDA AS rank 67,700 as of an August 2026 lookup [Confirmed]. PeeringDB self-declared policy for the block (filed under AS857): Restrictive / Private Only, no public IX or route-server presence

[Likely] — https://bgp.he.net/AS876, https://asrank.caida.org/asns/876, https://www.peeringdb.com/asn/857

RPKI

no ROA coverage found — 0 RPKI-valid and 0 RPKI-invalid origins on the announced prefix (unvalidated, not invalid) [Confirmed] — https://bgp.he.net/AS876

Notable usage

AS876 itself originates only 204.41.243.0/24, no hosted services or domains identified. A separately-registered sibling ASN in the same GONET org, AS808, is reported by third-party data to originate ~54 prefixes and host domains including ontarioparks.com and publichealthontario.ca — that usage belongs to AS808, not AS876

[Likely] — https://bgp.he.net/AS876, https://bgp.he.net/AS808

Related ASNs

AS857 (RDAP block-representative handle covering AS857–AS885, which AS876 falls inside); AS808 (separately-registered sibling GONET ASN with materially different, more public-facing traffic) [Confirmed] — https://rdap.arin.net/registry/autnum/876, https://bgp.he.net/AS808

Analyst note

AS876 has no standalone ARIN RDAP record; it sits inside the consolidated GONET block AS857–AS885, so block/org-level signals (RDAP registration, PeeringDB self-listing) describe the range rather than AS876 uniquely. The one AS876-specific data point — 204.41.243.0/24, upstream AS852 — comes from third-party BGP collectors, not an operator-published source. Do not attribute AS808's prefix count or hosted domains to AS876.