Autonomous system
AS11878 TZULO
Hosting ARIN
Summary
tzulo, inc.
hosting legacy
TZULO is tzulo, inc., a Chicago-based dedicated-server, colocation and cloud hosting provider that has been trading since the early 2000s and runs its own network out of Chicago and Los Angeles facilities. This is a hosting network, and the routing evidence says so plainly.
What it's used for
Server hosting. RIS sees 195 IPv4 prefixes totalling about 114,688 addresses plus 33 IPv6 prefixes, against only 9 observed neighbours. That ratio is the tell: a wholesale carrier of this address size would peer with hundreds of ASes. Nine upstreams and a large, heavily fragmented address pool is a content-and-servers network buying transit, not selling it. Every reverse-DNS name sampled follows the same first-party template, static-<ip>.cust.tzulo.com, which is a hosting provider's default naming for customer static assignments.
Notable
- The prefix registrations look scattered at first glance: alongside blocks registered to tzulo itself, RDAP returns small LLCs and individual people as the registered orgs of
/24s that tzulo announces. Read against the rest of the evidence this is the IPv4 leasing market, not brokered proxy space. tzulo is a real, findable business with public facilities and pricing, and the leased-in blocks wear tzulo's owncust.tzulo.comreverse DNS rather than a stranger's. - The fragmentation is worth understanding for anyone geolocating an address here: the space was assembled from many small acquisitions and transfers over time, so neighbouring
/24s can have very different registration histories.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
No exchange port on file. Many exchanges publish no participant list, so this is not proof of absence.
Transit providers
8 upstream, 3 downstream and 19 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-14, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 50 prefixes · 114K addresses IPv6 14 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 64 |
Registry
Allocation record
- Registry
- ARIN
- Handle
AS11878- Registry name
- TZULO
- Registrant
- tzulo, inc.
- Abuse contact
- abuse@tzulo.com
- Registered
- 2007-04-02
- Last changed
- 2012-02-24
- Allocation
- assigned
Routing security
RPKI and IRR
- RPKI
- 84% valid · 189 valid, 36 with no ROA
- ROAs
- 70 authorising AS11878
- ASPA
- no ASPA record
- IRR
- 100% registered · 225 of 225 announcements
- Route objects
- 114 naming AS11878
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 442 networks and 1,771 prefixes, as published 2026-10-15. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
3 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.
| Prefix | Advisory | Published |
|---|---|---|
23.234.106.242 | #StopRansomware: Medusa Ransomware | 2026-08-18 |
23.234.89.195 | #StopRansomware: Medusa Ransomware | 2026-08-18 |
23.234.93.112 | #StopRansomware: Medusa Ransomware | 2026-08-18 |
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere