asn.dev

Autonomous system

AS12989 BLACKHOST AS12989.NET

Hosting RIPE

IPv4 addresses 6.40K 16 prefixes
IPv6 prefixes 6 counted as prefixes, not addresses
Countries 1 mostly CA
Exchanges 4 recorded by PCH
Upstreams 1 0 downstream
Flagged prefixes 0 none

Summary

BlackHOST

Canada · AI-generated

hosting business infrastructure

Reverse names containing the letters in-addr.arpa, one of them ending in .db.

What it's used for

  • A hosting provider registered in Canada announcing mostly European address space. 4,608 addresses across 10 IPv4 prefixes, six IPv6 prefixes, and a single observed BGP neighbour.

Notable

  • Netnames span CA-BLACKHOST- dated 19940812, 19981229, 20050512 and 20190430, plus a bare BlackHOST and one UK-PINGTECHNOLOGYLABS-20040723 registered to another company.
  • Ten of eighteen sampled addresses returned names, most of the form black.host-254.30.54.86.in-addr.arpa.
  • Two end in .db: black.host-128.140.104.212.in-addr.arpa.db.
  • One is scanner-info.rootevidence.com.
  • The AS handle is BLACKHOST AS12989.NET.

Interesting

  • Those hostnames should not exist. in-addr.arpa is the internal suffix of a reverse lookup, not something that belongs inside the answer, and .db is the file extension of a zone file. Somebody built the reverse zone with a template that pasted the full query name and, in two cases, the filename of the zone itself into the record. It has been serving that way to anyone who looks.
  • Netnames dated 1994 and 2019 in one small inventory, with blocks in ranges allocated twenty-five years apart. Hosting providers assemble space from wherever it can be bought, so the registry dates map the acquisition history rather than the company's age.
  • One neighbour for a provider with sixteen announcements is unusual and worth noting, since everything advertised here depends on a single relationship.
  • A block registered to an unrelated UK company sits in the middle of the inventory.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.

Interconnection

Peering at a glance

Full topology · Graph

Internet exchanges

Recorded at 4 exchanges in 1 country, largest first.

ExchangeLocationTheir address
Any2 CaliforniaLos Angeles, United States206.72.211.80
DE-CIX New YorkNew York, United States2001:504:36::32bd:0:1
New York International Internet ExchangeNew York, United States198.32.160.203
Equinix Internet Exchange New YorkNew York, United States198.32.118.76

Transit providers

1 upstream, 0 downstream and 2 adjacent networks observed; most-used upstreams first.

ASNetworkPaths seen
AS30058FDCservers.net1,559

Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-13, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.

Address space

Summary

Shape and geography

IPv4 16 prefixes · 6.40K addresses IPv6 6 prefixes

CountryNamePrefixes
CACanada22

Registry

Allocation record

RIPE · via Atlas (registry + RDAP)
Registry
RIPE
Handle
AS12989
Registry name
BlackHOST
Registrant
BlackHOST-LTD
Abuse contact
abuse@black.host
Registered
2003-05-12
Last changed
2025-02-24
Allocation
allocated

Routing security

RPKI and IRR

Full detail
RPKI
97% valid · 29 valid, 0 with no ROA 1 RPKI-invalid
ROAs
29 authorising AS12989
ASPA
no ASPA record
IRR
97% registered · 29 of 30 announcements 1 other origin
Route objects
53 naming AS12989

Reputation

Classification and threat

Hosting Datacenter or cloud provider. Addresses are servers, not people.

Spamhaus DROP

Not on ASN-DROP The network as a whole is not listed.

No DROP prefixes None of its announced space is on the DROP prefix list.

Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 440 networks and 1,773 prefixes, as published 2026-10-13. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.

FBI IC3

1 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.

PrefixAdvisoryPublished
86.54.28.216#StopRansomware: Gunra Ransomware2026-08-10

IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.

Elsewhere

Cross-check