Autonomous system
AS22616 ZSCALER-SJC1
Business ARIN Network Services
Summary
Zscaler, Inc.
security sase proxy
Zscaler's ZSCALER-SJC1 network — one of the company's busiest enforcement ASNs, at its San Jose region. Zscaler operates a global cloud security platform (SASE / Secure Web Gateway) that enterprise traffic is routed through on its way to the internet.
What it's used for
- Inspecting and filtering outbound web traffic for corporate customers (Zscaler Internet Access) from cloud enforcement nodes worldwide.
- Zero-trust access to private apps (Zscaler Private Access).
Notable
- An IP in Zscaler's space is typically a security proxy egress, not a datacenter server or an end user's own address — the real user sits behind it inside a corporate tenant.
- The node name hints at the user's region. Zscaler routes each user to their nearest enforcement node, so an active egress's location roughly tracks where the traffic originates. This
SJC1(San Jose) block is one of Zscaler's busiest actively-announcing ASNs and generally corresponds to corporate users in western North America (US, Canada, Mexico); theEMEAASN (AS62044) covers Europe / Middle East / Africa. Note that several sibling ASNs below (NEWYORK, ATLANTA, GRX) currently announce no IP space — reserved/placeholder handles, not live egress. - Zscaler announces from several ASNs, so
22616is one of several you may encounter: AS32921 ZSCALER-NEWYORK, AS40384 ZSCALER-GRX, AS53444 ZSCALER-SJC, AS53813 ZSCALER-INC, AS55242 ZSCALER-ATLANTA, AS62044 ZSCALER-EMEA, and AS62907 ZSCALER-CORP.
Interesting
- Because so many enterprises route through Zscaler, its egress IPs can appear in threat feeds purely due to volume — one shared egress carries thousands of distinct users.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 24 exchanges in 5 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| IX.br (PTT.br) São Paulo | São Paulo, Brazil | 187.16.212.4 |
| Equinix Internet Exchange Ashburn | Ashburn, United States | 206.126.236.212 |
| Seattle Internet Exchange | Seattle, United States | 206.81.81.179 |
| Coresite - Any2 West | Los Angeles, United States | 206.72.211.39 |
| Any2 California | Los Angeles, United States | 206.72.211.196 |
| Toronto Internet Exchange | Toronto, Canada | 206.108.35.7 |
| DE-CIX New York | New York, United States | 206.82.104.3 |
| Equinix Internet Exchange Chicago | Chicago, United States | 208.115.136.218 |
Transit providers
28 upstream, 1 downstream and 45 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-11, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 444 prefixes · 488K addresses IPv6 24 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 468 |
Registry
Allocation record
- Registry
- ARIN
- Handle
AS22616- Registry name
- ZSCALER-SJC1
- Registrant
- ZSCALER, INC.
- Abuse contact
- poc-abuse@zscaler.com
- Registered
- 2014-05-28
- Last changed
- 2014-05-28
- Allocation
- assigned
Declared
PeeringDB profile
- Name
- Zscaler AS22616
- Network type
- Network Services
- Scope
- Regional
- Traffic ratio
- Balanced
- Peering policy
- Open
- IRR as-set
AS-ZSCALER-AMER- Present at
- 23 exchanges
- Facilities
- 26 facilities
- Website
- http://www.zscaler.com
PeeringDB records are maintained by the network operator and are not independently verified. Treat them as a statement of intent rather than of fact. For the observed and recorded view, see peering, which lists the exchanges Packet Clearing House has a port on file for.
Routing security
RPKI and IRR
- RPKI
- 91% valid · 555 valid, 58 with no ROA
- ROAs
- 577 authorising AS22616
- ASPA
- no ASPA record
- IRR
- 99.7% registered · 611 of 613 announcements
- Route objects
- 1,157 naming AS22616
Reputation
Classification and threat
Business Corporate network, or multi-tenant SASE egress carrying staff browsing.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 432 networks and 1,768 prefixes, as published 2026-10-12. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
No IC3 indicators Nothing from the FBI IC3 feed.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere