AS12389 — Rostelecom Threat Intelligence

Network Threat Summary

AS12389 (Rostelecom) has 57,072 malicious IP addresses with 643,260 abuse reports across 1 countries. First activity recorded 2022-08-21, most recent activity 2026-07-28.

Threat Profile: The primary attack categories observed from this network are suspicious activity, severe abuse, moderate threat. This autonomous system is among the most prolific threat sources globally, with an exceptionally high concentration of malicious IP addresses. Affected countries include RU.

Risk Assessment: CRITICAL - This autonomous system is a major source of malicious activity, ranking in the top 1% of threat networks globally. Consider blocking the entire ASN or implementing strict rate limiting.

Top Attack Categories

• Suspicious Activity 366,549 reports
• Severe Abuse 48,295 reports
• Moderate Threat 19,811 reports
• Aggregated Threat 14,193 reports
• High Threat 14,057 reports

Top Affected Countries

• RU 555,092 reports

Most Reported IPs

• 85.95.166.40 549 reports
• 178.185.136.57 543 reports
• 176.211.42.202 538 reports
• 81.177.101.45 531 reports
• 85.93.45.33 528 reports

Lookup an IP or Network

Check any IP address for threat intelligence or browse other ASNs.

Access ASN Intelligence via API

Integrate AS12389 threat data into your security stack with our REST API.

See how we classify and verify threats →