asn.dev

Autonomous system

AS12788 NBI-KIEV Kyiv, Ukraine

Unclassified RIPE

IPv4 addresses 7.68K 5 prefixes
IPv6 prefixes 0 counted as prefixes, not addresses
Countries 1 mostly UA
Exchanges 0 recorded by PCH
Upstreams 3 1 downstream
Flagged prefixes 0 none

Summary

NBI Internet

Ukraine · AI-generated

isp hosting business

Two addresses in this network answer to the reverse name STOLEN-IP.

What it's used for

  • A Kyiv internet provider. 7,680 addresses across five IPv4 prefixes, six observed BGP neighbours, and no IPv6 announced.

Notable

  • Every block sits in 80.78, from 80.78.32.0/20 down to two /24s.
  • Four of the five carry the netname UA-NBI-INET-20010704; 80.78.62.0/24 is named Rozvytok.
  • The AS handle is NBI-KIEV Kyiv, Ukraine.
  • Reverse names take three forms: 80.78.36.0 answers as net36.0-127.nbi.com.ua, 80.78.51.255 as 80-78-51-255.nbi.com.ua, and both 80.78.43.254 and 80.78.50.0 as STOLEN-IP.nbi.com.ua.

Interesting

  • STOLEN-IP is a message, not a hostname. Somebody at this network set a reverse name on specific addresses to say they consider them taken — announced by another party, or used without authorisation. Reverse DNS is one of the few places an operator can leave a note that anyone investigating an address will actually read, and this is what that looks like.
  • net36.0-127 encodes a subnet boundary in the name: the address, then the range it belongs to. The generator that wrote these names had the subnetting plan in hand, so the reverse zone publishes how the /20 is carved up.
  • Rozvytok as a netname is a plain word with no country prefix and no date, sitting among four identically-dated records. It is what a block gets when somebody names it after the project rather than filling in the form the same way as last time.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.

Interconnection

Peering at a glance

Full topology · Graph

Internet exchanges

No exchange port on file. Many exchanges publish no participant list, so this is not proof of absence.

Transit providers

3 upstream, 1 downstream and 4 adjacent networks observed; most-used upstreams first.

ASNetworkPaths seen
AS48648K-Link LLC100
AS6939Hurricane Electric LLC17
AS29074FAUST ISP LTD.4

Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-18, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.

Address space

Summary

Shape and geography

IPv4 5 prefixes · 7.68K addresses IPv6 0 prefixes

CountryNamePrefixes
UAUkraine5

Registry

Allocation record

RIPE · via Atlas (registry + RDAP)
Registry
RIPE
Handle
AS12788
Registry name
NBI-KIEV
Registrant
mnt-ua-nbi-inet-1
Abuse contact
abuse@nbi.kyiv.ua
Registered
2002-07-12
Last changed
2025-08-14
Allocation
allocated

Routing security

RPKI and IRR

Full detail
RPKI
100% valid · 2 valid, 0 with no ROA
ROAs
2 authorising AS12788
ASPA
no ASPA record
IRR
100% registered · 2 of 2 announcements
Route objects
2 naming AS12788

Reputation

Classification and threat

Unclassified Not in the curated lists. Most of the ~80,000 allocated ASNs are not.

Spamhaus DROP

Not on ASN-DROP The network as a whole is not listed.

No DROP prefixes None of its announced space is on the DROP prefix list.

Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 443 networks and 1,784 prefixes, as published 2026-10-19. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.

FBI IC3

No IC3 indicators Nothing from the FBI IC3 feed.

IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.

Elsewhere

Cross-check