Autonomous system
AS16417 IRONPORT-SYSTEMS-INC
Unclassified ARIN
Summary
Cisco Systems Ironport Division
hosting enterprise infrastructure
One reverse name carries a hotel chain's brand, because the machine filters that chain's mail.
What it's used for
- A mail security service's network. Sixty prefixes announced from the United States, eight of them IPv6, twenty-nine thousand nine hundred and fifty-two addresses, through eighteen observed BGP neighbours.
Notable
- The AS handle is the acquired company's name with its legal form attached. The holder field names the parent and calls it a division, so the record holds both the company that was bought and the one that bought it.
- Most blocks share one netname: four letters cut from the parent and the acquisition, then a numeral. Three more use the acquired brand and two letters, and one adds the word for a network before its numeral.
- Three of eighteen queried addresses answered, all on a fourth domain that appears nowhere in the registry record.
- Two of those names begin with three letters for a mail security appliance, then a customer reference built from two letters and two numbers, one of them also carrying a state code.
- The third replaces that reference with a hotel chain's brand outright.
Interesting
- Running mail security for other companies means their names end up in your reverse zone. A recipient checking where a message came from sees the appliance, the provider, and sometimes the customer.
- Sixty prefixes and thirty thousand addresses for a filtering service is about reputation rather than capacity. Addresses that send mail have to be many, stable, and separable, so one customer's trouble does not sink another's delivery.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 2 exchanges in 2 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| Toronto Internet Exchange | Toronto, Canada | 206.108.35.62 |
| Equinix Internet Exchange San Jose (Bay Area) | San Jose, United States | 206.223.117.21 |
Transit providers
11 upstream, 1 downstream and 20 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-29, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 52 prefixes · 29.95K addresses IPv6 9 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 61 |
Registry
Allocation record
- Registry
- ARIN
- Handle
AS16417- Registry name
- IRONPORT-SYSTEMS-INC
- Registrant
- Cisco Systems Ironport Division
- Abuse contact
- netops-ironport@cisco.com
- Registered
- 2005-06-22
- Last changed
- 2012-03-02
- Allocation
- assigned
Declared
PeeringDB profile
- Name
- HPS // Cisco Cloud Email Security (CES) / IronPort
- Scope
- Not Disclosed
- Traffic ratio
- Balanced
- Peering policy
- Open
- IRR as-set
AS16417- Website
- http://www.cisco.com
PeeringDB records are maintained by the network operator and are not independently verified. Treat them as a statement of intent rather than of fact. For the observed and recorded view, see peering, which lists the exchanges Packet Clearing House has a port on file for.
Routing security
RPKI and IRR
- RPKI
- 75% valid · 89 valid, 29 with no ROA
- ROAs
- 95 authorising AS16417
- ASPA
- no ASPA record
- IRR
- 100% registered · 118 of 118 announcements
- Route objects
- 195 naming AS16417
Reputation
Classification and threat
Unclassified Not in the curated lists. Most of the ~80,000 allocated ASNs are not.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 448 networks and 1,849 prefixes, as published 2026-10-29. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
No IC3 indicators Nothing from the FBI IC3 feed.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere