Autonomous system
AS202422 GHOST
Hosting DROP-listed space RIPE
Summary
Gcore (G-Core Labs)
cdn edge cloud
A regional Gcore Autonomous System (G-Core Labs S.A., RIPE region). Part of the same CDN/edge/cloud network as Gcore's primary AS.
What it's used for
- CDN edge and cloud delivery within Gcore's European footprint.
Notable
- An IP here is a Gcore edge/cloud node, not the origin or tenant behind it.
- This is a sibling of Gcore's main ASN — see AS199524 for the fuller description.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
No exchange port on file. Many exchanges publish no participant list, so this is not proof of absence.
Transit providers
1 upstream, 1 downstream and 2 adjacent networks observed; most-used upstreams first.
| AS | Network | Paths seen |
|---|---|---|
| AS199524 | G-Core Labs S.A. | 15,659 |
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-21, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 204 prefixes · 68.09K addresses IPv6 0 prefixes
| Country | Name | Prefixes |
|---|---|---|
| LU | Luxembourg | 204 |
Registry
Allocation record
- Registry
- RIPE
- Handle
AS202422- Registry name
- GHOST
- Registrant
- GCL1-MNT
- Abuse contact
- abuse@gcore.lu
- Registered
- 2018-05-17
- Last changed
- 2018-09-04
- Allocation
- allocated
Routing security
RPKI and IRR
- RPKI
- 98% valid · 261 valid, 5 with no ROA
- ROAs
- 307 authorising AS202422
- ASPA
- no ASPA record
- IRR
- 95% registered · 254 of 266 announcements 11 other origin
- Route objects
- 373 naming AS202422
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
1 DROP match Announced space overlapping the DROP prefix list.
| Announced | DROP entry | Record |
|---|---|---|
| 202.78.164.0/24 | 202.78.164.0/24 | SBL694379 |
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 442 networks and 1,779 prefixes, as published 2026-10-22. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
5 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.
| Prefix | Advisory | Published |
|---|---|---|
5.188.230.69 | Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data | 2026-10-08 |
5.188.34.134 | Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data | 2026-10-08 |
92.38.163.102 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
92.38.148.58 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
92.38.180.39 | "First VPN Service" Used by Ransomware Actors to Compromise Systems | 2026-05-21 |
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere