Autonomous system
AS6389 BELLSOUTH-NET-BLK
Residential ARIN
Summary
AT&T Southeast (BellSouth.net)
isp legacy
BELLSOUTH-NET-BLK is one of the largest consumer eyeball networks in the United States. Registered to AT&T Enterprises, LLC, it is the former BellSouth.net network — the internet arm of the BellSouth regional Bell operating company, absorbed by AT&T in 2006 and now the AT&T Southeast broadband footprint.
What it's used for
- Residential broadband across the old BellSouth nine-state territory in the US Southeast: DSL, U-verse and fibre subscribers.
- Small-business access riding the same access network.
- Announces on the order of four million IPv4 addresses — mostly full
/16s such as65.14.0.0/16,74.228.0.0/16and74.238.0.0/16, aggregated into a few dozen large prefixes.
Notable
This is eyeball address space at national scale. A very large IPv4 count carried in a handful of big, contiguous blocks is the signature of a consumer access network: addresses are handed to household CPE from regional pools, so geolocation resolves to metro areas across the Southeast rather than to a single site. Traffic is evening-peaked and download-heavy.
Note carefully which AT&T entity this is: AT&T runs many autonomous systems, and AS6389 is specifically the BellSouth-inherited consumer network, not AT&T's global backbone or its mobility network.
Interesting
The AS number was registered in 1996, when BellSouth.net was standing up dial-up service — one of the RBOCs racing to sell internet access to their own telephone customers. The corporate name on the record has changed twice since; the routing has been continuous.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
No exchange port on file. Many exchanges publish no participant list, so this is not proof of absence.
Transit providers
1 upstream, 1 downstream and 2 adjacent networks observed; most-used upstreams first.
| AS | Network | Paths seen |
|---|---|---|
| AS7018 | AT&T Enterprises, LLC | 3,185 |
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-22, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 582 prefixes · 4.43M addresses IPv6 0 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 582 |
Registry
Allocation record
- Registry
- ARIN
- Handle
AS6380- Registry name
- BELLSOUTH-NET-BLK
- Registrant
- AT&T Enterprises, LLC
- Abuse contact
- abuse@att.net
- Registered
- 1996-03-28
- Last changed
- 2024-12-05
- Allocation
- assigned
Routing security
RPKI and IRR
- RPKI
- 52% valid · 28 valid, 26 with no ROA
- ROAs
- 29 authorising AS6389
- ASPA
- 1 declared providers
- IRR
- 52% registered · 28 of 54 announcements
- Route objects
- 29 naming AS6389
Reputation
Classification and threat
Residential Fixed-line consumer ISP. Addresses here are homes.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 442 networks and 1,779 prefixes, as published 2026-10-23. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
No IC3 indicators Nothing from the FBI IC3 feed.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere