Autonomous system
AS8868 IRCDN Khallagh Borhan Market Development for Creative Industries Co
Unclassified RIPE
Summary
IRCDN (Khallagh Borhan)
hosting cdn legacy
IRCDN is held by Khallagh Borhan Market Development for Creative Industries Co, a Tehran company registered as a RIPE Local Internet Registry. The handle, and the shape of the network, point to a domestic Iranian content-delivery and hosting operation.
What it's used for
- Serving content from within Iran. About 3,072 IPv4 addresses across ten /24s, all from modern RIPE
185/8ranges, reached through a small number of Iranian upstreams. No IPv6 is announced.
Notable
- No reverse DNS is delegated at all. The
in-addr.arpazones for the announced blocks return no nameservers, so the space is genuinely dark in reverse rather than merely missing individual PTRs. The strongest evidence for what the space carries is therefore unavailable, and the classification rests on the handle, the registration and the topology — medium confidence, not high. - The prefixes are all self-registered to the holder (
IR-KHALLAAGH-*netnames), in one RIR, one country, behind domestic transit. Scattered185.x/24s with no rDNS is the address-broker silhouette, but the registration chain here is coherent and first-party: this is a real, small Iranian operator, not brokered space. - Only two observed BGP neighbours. A network with genuine CDN reach would normally show far more; this reads as a single-market CDN or hosting platform sitting behind Iranian transit rather than a global edge.
- The low AS number is misleading. The AS object dates from 2015 and the first prefix was seen in BGP in 2016, so 8868 is a reissued number, not an early-internet allocation. There is no legacy history to tell about this holder.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
No exchange port on file. Many exchanges publish no participant list, so this is not proof of absence.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-11-01, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 3 prefixes · 3.07K addresses IPv6 0 prefixes
| Country | Name | Prefixes |
|---|---|---|
| IR | Iran (Islamic Republic of) | 3 |
Registry
Allocation record
- Registry
- RIPE
- Handle
AS8868- Registry name
- IRCDN
- Registrant
- ir-khallaagh-1-mnt
- Abuse contact
- Itunit.isd@gmail.com
- Registered
- 2015-10-09
- Last changed
- 2022-11-21
- Allocation
- allocated
Routing security
RPKI and IRR
- RPKI
- 100% valid · 10 valid, 0 with no ROA
- ROAs
- 11 authorising AS8868
- ASPA
- no ASPA record
- IRR
- 100% registered · 10 of 10 announcements
- Route objects
- 21 naming AS8868
Reputation
Classification and threat
Unclassified Not in the curated lists. Most of the ~80,000 allocated ASNs are not.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 447 networks and 1,843 prefixes, as published 2026-11-02. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
No IC3 indicators Nothing from the FBI IC3 feed.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere