Autonomous system
AS8757 NSFOC
Unclassified RIPE NSP
Summary
NSFOCUS
hosting security legacy
NSFOCUS, Inc. (NSFOCUS) — the international arm of the security vendor NSFOCUS, registered in Santa Clara, California. This AS is its anti-DDoS scrubbing cloud, not a conventional hosting or access network.
What it's used for
- Fronting customer web properties for DDoS mitigation and WAF. Traffic destined for a protected site is redirected into these prefixes, cleaned in a scrubbing centre, and forwarded to the real origin.
- rDNS across the space is uniformly
IP-ADDR.reverse.ip.nsfocus.cloud, which is the honest witness here: every address belongs to the platform itself, not to the customers behind it.
Notable
- The shape gives it away. Roughly 3,000 IPv4 addresses but around 157 observed BGP neighbours — a ratio no ordinary network produces. That is an anycast footprint: the same small blocks announced from many scrubbing PoPs worldwide, so the closest one absorbs an attack.
- Because of that, these addresses should not be geolocated to a single country. The RIPE objects carry a mix of US and GB registration details and the prefixes appear wherever a scrubbing centre does.
- An address here is a proxy in front of someone else's site. Whatever it serves, the content owner is not NSFOCUS.
Interesting
- Mitigation networks are structurally the inverse of eyeball networks: tiny address inventory, enormous peering surface. Peering breadth, not address count, is the thing being sold.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 7 exchanges in 6 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| IX.br (PTT.br) São Paulo | São Paulo, Brazil | 187.16.217.136 |
| DE-CIX Frankfurt | Frankfurt, Germany | 80.81.193.174 |
| LINX LON1 | London, United Kingdom | 195.66.225.49 |
| Equinix Internet Exchange Hong Kong | Hong Kong, China | 2001:de8:7::8757:1 |
| Megaport Frankfurt IX | Frankfurt, Germany | 62.69.146.97 |
| Megaport IX Ashburn | Ashburn, United States | 206.53.170.57 |
| MegaPort IX Singapore | Singapore, Singapore | 103.41.12.58 |
Transit providers
25 upstream, 4 downstream and 47 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-11, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 8 prefixes · 3.33K addresses IPv6 5 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 13 |
Registry
Allocation record
- Registry
- RIPE
- Handle
AS8757- Registry name
- NSFOCUS
- Registrant
- NSFOCUS-MNT
- Abuse contact
- abuse@nsfocusglobal.com
- Registered
- 2002-05-31
- Last changed
- 2018-09-04
- Allocation
- allocated
Declared
PeeringDB profile
- Name
- NSFOCUS, Inc.
- Network type
- NSP
- Scope
- Global
- Traffic ratio
- Heavy Inbound
- Peering policy
- Open
- IRR as-set
RIPE::AS-NSFOCUS- Present at
- 8 exchanges
- Facilities
- 7 facilities
- Website
- http://www.nsfocusglobal.com
PeeringDB records are maintained by the network operator and are not independently verified. Treat them as a statement of intent rather than of fact. For the observed and recorded view, see peering, which lists the exchanges Packet Clearing House has a port on file for.
Routing security
RPKI and IRR
- RPKI
- 100% valid · 19 valid, 0 with no ROA
- ROAs
- 5 authorising AS8757
- ASPA
- no ASPA record
- IRR
- 100% registered · 19 of 19 announcements
- Route objects
- 44 naming AS8757
Reputation
Classification and threat
Unclassified Not in the curated lists. Most of the ~80,000 allocated ASNs are not.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 431 networks and 1,768 prefixes, as published 2026-10-12. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
No IC3 indicators Nothing from the FBI IC3 feed.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere