Autonomous system
AS16509 AMAZON-02
Hosting DROP-listed space ARIN
Summary
Amazon.com, Inc. (AWS)
cloud hosting compute
One of the main Autonomous Systems behind Amazon Web Services (AWS), the largest public cloud provider. Addresses here belong to EC2 instances, load balancers, and other AWS-hosted infrastructure.
What it's used for
- Hosting a vast range of third-party services, APIs, and websites that run on AWS compute (EC2, ECS/EKS, Lambda behind NAT, etc.).
- Amazon publishes its cloud IP ranges as a machine-readable
ip-ranges.json, broken down by region and service.
Notable
- An IP in this ASN identifies AWS as the host, not the operator of whatever runs on it — it could be a Fortune 500 app or an abusive VPS.
- AWS uses several ASNs (e.g. AS14618 Amazon US-East, AS16509 globally); which one announces a given prefix varies by region and history.
Interesting
- AWS launched in 2006 with S3 and EC2, effectively creating the modern infrastructure-as-a-service market.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 148 exchanges in 42 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| IX.br (PTT.br) São Paulo | São Paulo, Brazil | 187.16.221.239 |
| DE-CIX Frankfurt | Frankfurt, Germany | 80.81.194.152 |
| Indonesian Internet Exchange (IIX-Jakarta) | Jakarta, Indonesia | 123.108.9.182 |
| IX.br (PTT.br) Fortaleza | Fortaleza, Brazil | 45.68.74.144 |
| LINX LON1 | London, United Kingdom | 195.66.225.175 |
| AMS-IX Amsterdam | Amsterdam, Netherlands | 80.249.210.100 |
| Jakarta Internet Exchange | Jakarta, Indonesia | 119.11.184.88 |
| Neutral Internet Exchange | Amsterdam, Netherlands | 193.239.119.131 |
Transit providers
102 upstream, 124 downstream and 314 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-10, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 7,900 prefixes · 157M addresses IPv6 7,965 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 15,865 |
Registry
Allocation record
- Registry
- ARIN
- Handle
AS16509- Registry name
- AMAZON-02
- Registrant
- Amazon.com, Inc.
- Abuse contact
- trustandsafety@support.aws.com
- Registered
- 2000-05-04
- Last changed
- 2012-03-02
- Allocation
- assigned
Routing security
RPKI and IRR
- RPKI
- 99.6% valid · 24,599 valid, 90 with no ROA 2 RPKI-invalid
- ROAs
- 24,795 authorising AS16509
- ASPA
- no ASPA record
- IRR
- 90% registered · 22,180 of 24,691 announcements 4 other origin
- Route objects
- 40,701 naming AS16509
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
9 DROP matches Announced space overlapping the DROP prefix list.
| Announced | DROP entry | Record |
|---|---|---|
| 172.111.132.0/24 | 172.111.128.0/17 | SBL688605 |
| 172.111.144.0/24 | 172.111.128.0/17 | SBL688605 |
| 172.111.149.0/24 | 172.111.128.0/17 | SBL688605 |
| 172.111.166.0/24 | 172.111.128.0/17 | SBL688605 |
| 172.111.172.0/24 | 172.111.128.0/17 | SBL688605 |
| 172.111.180.0/24 | 172.111.128.0/17 | SBL688605 |
| 172.111.190.0/23 | 172.111.128.0/17 | SBL688605 |
| 204.106.128.0/18 | 204.106.128.0/18 | SBL105808 |
| 204.106.192.0/19 | 204.106.192.0/19 | SBL106078 |
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 431 networks and 1,775 prefixes, as published 2026-10-11. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
2 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.
| Prefix | Advisory | Published |
|---|---|---|
198.74.112.85 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
23.238.217.23 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere