Autonomous system
AS22168 SHADOWSERVER-FOUNDATION
Unclassified ARIN
Summary
The Shadowserver Foundation
security nonprofit research monitoring
The AS handle SHADOWSERVER-FOUNDATION is held by The Shadowserver Foundation.
What it's used for
- The address space carries infrastructure for a nonprofit security organization that gathers and analyzes data on malicious Internet activity, including malware and botnets.
- The AS announces 8960 IPv4 addresses across 27 prefixes and 2 IPv6 prefixes, with only 3 observed neighbours, indicating a small, specialized network rather than a transit or access provider.
Notable
- Registrants for the announced prefixes include Legaco Networks B.V., Cogent Communications, LLC, Internet Utilities, and IPXO Incident Response Team, suggesting the space is leased or aggregated from multiple upstream providers rather than owned outright by the foundation.
- The address inventory is fragmented across various /24 and /23 blocks from different registrants, consistent with a research organization acquiring specific ranges for monitoring or scanning purposes.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
No exchange port on file. Many exchanges publish no participant list, so this is not proof of absence.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-25, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 2 prefixes · 768 addresses IPv6 2 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 4 |
Registry
Allocation record
- Registry
- ARIN
- Handle
AS22168- Registry name
- SHADOWSERVER-FOUNDATION
- Registrant
- The Shadowserver Foundation, Inc.
- Abuse contact
- abuse@shadowserver.org
- Registered
- 2023-03-17
- Last changed
- 2023-03-17
- Allocation
- assigned
Routing security
RPKI and IRR
- RPKI
- 93% valid · 27 valid, 2 with no ROA
- ROAs
- 33 authorising AS22168
- ASPA
- no ASPA record
- IRR
- 93% registered · 27 of 29 announcements
- Route objects
- 49 naming AS22168
Reputation
Classification and threat
Unclassified Not in the curated lists. Most of the ~80,000 allocated ASNs are not.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 443 networks and 1,779 prefixes, as published 2026-10-24. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
No IC3 indicators Nothing from the FBI IC3 feed.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere