AS211486 AAA-AS

AAA-AS is a very small Russian-geolocated stub network: three leased /24s, 768 addresses, three upstreams and nothing downstream. What stands out is not its size but its turnover — it has originated seven different /24s since April 2025, none held for more than a few months.

What it's used for

The routing view does not settle what the network sells, and there is little else to go on: no PeeringDB record, no IPv6 announced today, no space registered to the holder. It does settle the role. RIS observes 3 neighbours, all upstream — AS19318 (Interserver, US), AS201814 (MEVSPACE, Poland) and AS202425 (INT-NETWORK / IP Volume) — and none downstream. It buys transit three ways and originates space; nothing transits through it.

Every prefix it announces sits in someone else's registration. 77.91.71.0/24 and 77.91.122.0/24 are SUB-ALLOCATED PA under two different third-party LIR maintainers, sub-allocated in April and May 2026; 93.152.208.0/24 is ASSIGNED PA under a Bulgarian maintainer with EvroNet's support team as technical contact. Registry country codes on those blocks read IL, NL and BG while all three geolocate to Russia. Third-party registrants, mismatched registry countries and no allocation of its own is the leased-address pattern, not an operator running space it holds.

Notable

• The footprint rotates. Since the current registration the AS has originated 88.210.62.0/24 (Apr–Dec 2025), 216.162.44.0/24 and 94.26.0.0/24 (both Feb–May 2026), 85.11.187.0/24 (Mar to 14 Aug 2026), then 93.152.208.0/24 and 77.91.71.0/24 (May 2026 onward) and 77.91.122.0/24 (13 Aug 2026 onward). Never more than three at once, drawn from different LIRs, each swapped out within months.
• The AS number is recycled. The RIPE org object dates to 2025-03-27 and the aut-num to 2025-04-01, but RIS first saw AS211486 on 2021-04-15 announcing 185.133.194.0/24 and an IPv6 /48, both dark since late summer 2023. Sightings of this number older than April 2025 describe the earlier holder.
• The holder is a private individual rather than a company — a RIPE org at a street address in Shakhty, Rostov Oblast — and the published abuse contact is a free mail.ru mailbox, not a role address on an operator domain.
• Of the three upstreams, AS202425 (IP Volume inc, NL) is listed in Spamhaus ASN-DROP. AS211486 itself is not, and as of 2026-08-18 none of its current prefixes appear in Spamhaus DROP. Upstream reputation and customer reputation are separate questions.

Interesting

• 77.91.122.0/24 carries the netname Mevspace, matching one of the three upstreams, so that block and the transit under it appear to come from the same source. 77.91.71.0/24 is registered with the netname NEW and country IL.
• Three transit providers and space from three separate LIRs is a lot of routing machinery for a network that would fit inside a single /22.