AS11286 KEYBANK

KEYBANK is the enterprise network of KeyBank National Association, the Cleveland-headquartered US regional bank. RIS sees 24 IPv4 prefixes, 16,896 addresses, no IPv6, and 4 observed neighbours — a corporate footprint, not a provider.

What it's used for

The bank's own IT: branch and corporate connectivity, the public edge of its online-banking and business-services platforms, and the address space behind its data centres. Four observed neighbours is the load-bearing number. A bank of KeyBank's size has plenty of traffic, but it buys transit rather than selling it, so its AS terminates at a small handful of upstreams instead of peering broadly. Combined with a mid-five-figure address count, that is an unambiguous large-enterprise silhouette — the same shape a retailer or insurer shows, and nothing like an ISP.

Notable

Nearly all announced space sits inside 156.77.0.0/16, and every prefix sampled — the covering 156.77.64.0/18, the two /19s beneath it, and the many /24s — is registered to the KEYBANK ARIN org (KeyBank National Association). One prefix, 12.189.139.0/24, sits in AT&T's legacy 12.0.0.0/8; that is ordinary provider-assigned space from an upstream, not a third-party registrant, and it is exactly the false positive to not fire on when reading a registrant list.

Interesting

The deaggregation is heavy: a /18, two /19s covering it, and roughly twenty more-specific /24s all announced from the same origin. Banks commonly do this to steer individual service or site blocks independently across upstreams and to make prefix hijacks harder to fly, since a more-specific /24 already exists for the space. The absence of any announced IPv6 is also notable for an institution of this size, and is typical of conservative financial-sector networks that have kept their external estate IPv4-only.