Summary

  • A registration name is an attribution lead, not a control link. The defensible chain runs record, validated contact, observed operation, responsible controller, and a missing link stays unresolved.
  • BTW's record for AS211386 documents the label and four gaps: no statement from LINX or Microsoft confirming or denying ownership, unknown purpose and timing, no contact or personnel records, no infrastructure or service evidence.

BTW's directory record for this registration is short enough to read in one sitting, and that is the first thing worth knowing about it. The card lists one resource — AS211386, resource type ASN, resource class virtual, status observed — under a legal name, AZURE London Internet Exchange Ltd., with two aliases: London Internet Exchange Ltd. and LINX-ROUTE-SERV-AZURE London Internet Exchange Ltd. It was last updated on 16 June 2026 and carries a confidence score of 0.7 (BTW directory record Only for Strategic Circle).

Those two aliases do all the persuading. Anyone who reads the string LINX-ROUTE-SERV-AZURE immediately pictures a London Internet Exchange route server in Microsoft's cloud, which is a serious piece of infrastructure to picture. The record's own role note is blunter than the alias: “The registration name implies a route-server function for the London Internet Exchange (LINX) within Microsoft Azure, but no operational documentation, routing activity, or official statements from LINX or Microsoft confirm that role. Currently, the entity only exists as a registry entry.”

An autonomous system number is not a network. It is a permission slip: an entry in a regional registry that says a named holder may originate routes under that number, and that the registry keeps a maintenance path for whoever holds it. The permission slip's value is the origination authority. The maintenance path's value is that a person can be found when the number is misused, reassigned, or needs correction.

Accountability therefore runs along a chain with four links: the record, a validated authorisation and contact route attached to it, an observed operation on the wire, and a controller shown to have caused that operation. Break any link and the case stays open, no matter how recognisable the label is. A name is not the second link. A company name in an alias field is not the second link either, and no amount of familiarity with the companies involved converts one into the other.

The record says what the file contains, and it says it in four parts: no official statement from LINX or Microsoft confirming or denying ownership; an unknown purpose and timeline for activation; no contact or personnel records tied to the registration; and no network infrastructure or service evidence. Read as a description rather than a lament, that is a clean picture of a permission slip with a persuasive label and no documented maintenance path.

There is context worth having, provided it is not mistaken for a control chain. ComputerWeekly reported that LINX described a collaboration with Megaport as bringing a “powerful expansion” to the Linx Cloud Connect service, which offers direct access to integral cloud services through a trusted network infrastructure, said to ensure low-latency access, consistent uptime and greater control over data traffic, benefits often difficult to achieve over the public internet (ComputerWeekly). LINX therefore has a documented commercial interest in steering its members' traffic toward cloud platforms. The passage does not name AS211386. It does not describe a route server. It does not state who holds any ASN.

Detection splits into two surfaces that are easy to confuse and expensive to conflate. The first is record health: whether the delegation's maintenance path still resolves, whether object changes arrive with matching authorisation, and whether anyone on the other end of that path replies. The second is behaviour: whether the number appears originating a prefix, at which collector, and over what window. Correlating the two produces a case. Either one alone produces a headline.

Prevention sits upstream of both, and it is duller than either: validate the delegation, the controller's identity, the authorisation trail and a usable escalation route before the number carries anything that matters. A route-server number is the kind of asset where that diligence should be easy to demonstrate and is instead hardest to find.

BTW profiled this registration on 26 May 2026 as a dormant ASN worth watching because its name attached it to a leading exchange and a major cloud provider. That framing made the number an early-warning indicator. This briefing asks a narrower and more useful question: if the number were used, who would be in a position to answer for it, and what evidence would establish that?

Fifteen research retrievals in this run — RIPE's RDAP aut-num record, RIPEstat's as-overview, announced-prefixes and rpki-validation endpoints, bgp.tools, bgpview.io and PeeringDB — returned no inspected field text, so this article asserts no as-name, no delegation status, no maintainer, no last-modified date, no prefix-origin observation and no RPKI state for AS211386, and characterises activation in neither direction.

The repair is unglamorous and entirely within reach: a named maintainer who can be contacted, a dated record that answers a query without a research project, and an attestation covering the number before it carries traffic. Until that exists, the label is doing work the documentation has not done — and the difference between a persuasive name and a custodian is exactly the difference between seeing an event and being able to respond to it.