Summary

  • Six autonomous-system numbers carry Nebius-linked holder names, and five of them announce 28 prefixes between them — 17 IPv4 and 11 IPv6 — in the registry window that closes on 2026-10-20.
  • AS215169, registered as CoreNebiusNet Nebius B.V. inside a 1,024-number block assigned by the RIPE NCC, announces no prefix at all across that window, which makes it a held identity rather than an observed operating network.
  • RPKI origin validation was not retrieved for any of the 28 prefixes, so nothing in this account describes the security state of those routes.

Start with one word, because the rest of the audit turns on it. In registry language a number "announces" — or "originates" — a block when it is the network telling the rest of the internet where those addresses live.

A number that announces nothing has not done that. It holds a registration and says nothing about where the addresses sit. The difference is like a name on a deed against a house with the lights on: one is a claim on paper, the other is something a passer-by can actually see.

That is the practical reason to read a group by its registered identities rather than by its name. When a customer, an auditor or an acquirer asks who holds a provider's address space, the answer is not the provider — it is whichever entity registered each block.

A group that appears as six identities has six separate answers, and those answers can move apart in a transfer or a corporate split without the brand changing at all. Anyone who has to sign a contract with a provider, check its footprint before an acquisition or work out who answers after an outage is reading this layer, whether or not they call it by that name.

What the registry shows, before any interpretation, is a portfolio of identities rather than a single carrier. Four of the six holder strings are built the same way — a function label followed by the Dutch company name: NebiusMAD Nebius B.V., NebiusCloud Nebius B.V., NebiusPA10 Nebius B.V. and CoreNebiusNet Nebius B.V. A fifth reads NEBIUS-UK Nebius B.V. The sixth breaks the pattern entirely: NJ-US-NEBIUS - Nebius Inc., the only one of the six whose block was assigned by ARIN rather than the RIPE NCC.

Each row below rests on two public records read on 20 October 2026: the AS overview for the number, which reports the holder string, the block the number was allocated from, the assigning registry and whether the number is announced; and the announced-prefixes record, which lists what the number actually originates. The overview fields carry a single observation stamp, 2026-10-20T08:00Z. The prefix lists cover 2026-10-06T08:00Z to 2026-10-20T08:00Z.

AS number Holder string as registered Block Assigned by Announced Prefixes (IPv4 / IPv6)
AS203326 NebiusMAD Nebius B.V. 203264–204287 RIPE NCC Yes 3 / 2
AS213291 NebiusCloud Nebius B.V. 212380–213403 RIPE NCC Yes 1 / 2
AS214415 NebiusPA10 Nebius B.V. 213404–214427 RIPE NCC Yes 9 / 4
AS215169 CoreNebiusNet Nebius B.V. 214428–215451 RIPE NCC No 0 / 0
AS401712 NJ-US-NEBIUS - Nebius Inc. 401309–402332 ARIN Yes 1 / 0
AS211318 NEBIUS-UK Nebius B.V. 210332–211355 RIPE NCC Yes 3 / 3

The distribution is uneven in a way that matters. AS214415 is the centre of gravity: its announced-prefixes record lists thirteen prefixes, nine IPv4 and four IPv6. AS211318 lists six, split evenly at three and three. AS203326 lists five, and AS213291 lists three. AS401712 lists one.

The address arithmetic is what makes those counts legible. Twenty-eight prefixes sound substantial, but add the seventeen IPv4 blocks together and they cover 16,640 addresses — slightly more than a single /18, and less than one /16. The largest IPv4 blocks here are /21s of 2,048 addresses each, and several entries are /24s of 256, so the announced set is many small pieces rather than a few large ones, and every piece has to be announced, routed and tracked on its own.

AS214415's IPv4 presence is concentrated in three separated neighbourhoods: 213.239.160.0/21 and 213.239.168.0/21, four consecutive /24s at 185.175.108.0 through 185.175.111.0, and 66.201.1.0/24, 66.201.2.0/24 and 66.201.4.0/22. Those four /24s cover 1,024 addresses, exactly what a single /22 at 185.175.108.0 would cover; the registry records four announcements instead of one aggregate. On the IPv6 side the same number draws on three distinct blocks — 2a13:5940:120::/44, 2a13:5944:20::/44 and two /48s inside 2a13:5947 — which is a wider footprint than the IPv4 side in topology terms even though the address counts dwarf it.

The two largest RIPE holders overlap inside one /19, and the overlap does not tile cleanly. Within 213.239.160.0 through 213.239.191.255, AS214415 announces the /21s at .160 and .168 while AS203326 announces /24s at .176 and .177 plus a /21 at .184. The range 213.239.178.0 to 213.239.183.255 — six /24s, 1,536 addresses — appears in neither number's list during this window. That is not an error to correct or a leak to allege. It is simply what the two records say when laid side by side, and it is the kind of detail that a single aggregate announcement would have hidden.

AS401712 is the outlier in every dimension the record exposes. Its block, 401309–402332, came from ARIN rather than the RIPE NCC, its holder string names a company rather than a function label, and it announces exactly one prefix: 104.204.96.0/24, 256 addresses. A single /24 is the smallest IPv4 footprint in the cluster by an order of magnitude, and it is also the only piece of Nebius-linked IPv4 announced from North American registry space.

The sixth number is the one that justifies the audit. AS215169 is registered to CoreNebiusNet Nebius B.V., holds block 214428–215451, and is marked as not announced. Its announced-prefixes record returns an empty list across the full two-week timeline. That record also carries an earliest_time of 2000-08-01T00:00:00, which is the response's default floor rather than evidence of a withdrawal date; read carefully, the record establishes silence in the observed window and nothing about history.

The allocation shape reinforces that AS215169 was carved out deliberately. All six blocks are exactly 1,024 numbers wide, and three of the RIPE NCC blocks are consecutive: 212380–213403 for AS213291, 213404–214427 for AS214415, 214428–215451 for AS215169. A contiguous administrative run produced three separately registered identities. Two of those identities operate networks. One does not, and was set aside inside the same run of the ledger.

Three limits belong in the same breath as the findings. RPKI origin validation was not retrieved, so this article cannot say whether any of the 28 announced prefixes has a valid, invalid or absent origin authorisation — a distinction that decides whether a route is protected or merely permitted. The aut-num objects themselves were not obtained either, so registration dates, maintainers and sponsoring LIR are unknown here. And whether the four Nebius B.V. holder strings correspond to one legal entity or several is not established by registry fields; the strings are administrative labels, not corporate structure.

What the records do support is narrower and more useful than a network map: six registered identities, five operating networks, one held reservation, one non-RIPE allocation, and a two-week silence where an operator might have expected traffic. Prefix counts cannot be converted into capacity, revenue or customer scale, and none of the numbers above measure service quality. But the difference between a number that announces and a number that does not is a documented fact about organisational intent, and it is available to anyone who reads two records per identity — a few minutes of work that answers a question otherwise put to a press office.

The group's registered entities are collected in BTW's Nebius directory entry.