Arelion IP Ranges
Arelion is the Stockholm carrier that traded as Telia Carrier until 2021; the RIPE record for AS1299 still carries the as-name TWELVE99, the description Arelion, f/k/a Telia Carrier, and a remark stating that as of 1 June 2021 the company and its affiliates are no longer part of or affiliated with Telia Company. The address space sits with RIPE under the organisation object ORG-TCA32-RIPE, and each allocation is named for the day it was made, so 62.115.0.0/16 reads SE-TWELVE99-20010809 and 213.248.64.0/18 reads SE-TWELVE99-20010420. Both are Swedish registry records for a backbone whose interfaces sit on four continents.
- Provider
- Arelion
- Primary ASN
- AS1299
- Category
- Transit
- Headquarters
- Stockholm, Sweden
- Announced IPv4 prefixes
- 122
- Registry
- RIPE
Known IP ranges
These prefixes are currently announced to the global routing table by AS1299 (TWELVE99 Arelion Sweden AB). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
62.115.0.0/16
89.126.0.0/17
213.248.64.0/18
209.170.64.0/18
208.12.160.0/19
80.239.224.0/19
199.163.128.0/19
202.163.0.0/19
213.155.128.0/19
205.241.224.0/19
2001:2030::/28
2607:41c0::/32
2407:1600::/32 (IPv6)
What does an Arelion IP mean in a privacy test?
An address inside Arelion's own space is almost always a router interface rather than anybody's connection. This is a transit business, so the address a person is actually carried under belongs to the customer network at the far end of the link, and the ordinary place AS1299 turns up is as a hop in a traceroute between you and the site rather than as your visible address. When a lookup does return AS1299 for the address you are testing, the two plausible readings are a machine sitting on a small direct assignment, or a geolocation database that has attributed the wrong side of an interconnect. The city such a lookup reports comes from Arelion's own geofeed, which places each link network at the point of presence terminating it, so a result of Ashburn or Warsaw describes where the fibre lands and not where anyone is sitting.
The geofeed Arelion attaches to its RIPE records
Arelion puts a geofeed: attribute on its RIPE inetnum objects, the RFC 9092 mechanism for pointing a whois record at a location file, and both 62.115.0.0/16 and 213.248.64.0/18 name the same URL: https://api.arelion.com/public/v1/geolocation. The file is plain text in RFC 8805 column order - prefix, ISO 3166-1 country, ISO 3166-2 region, city, postal code - with the postal field left empty, so a row reads 209.170.84.88/29,US,US-VA,Ashburn,. Most rows are /28s, /29s and /30s, because what is being placed on the map is individual interconnect and link networks rather than large blocks of end users. The city strings are typed by hand and never cleaned: PARIS and Warsaw sit in the same file, and so do the misspellings PRAUGE for Prague and Elbag for Elblag. Match on the prefix and read the city as a label.
What the feed does not carry is who is behind the link. There are no organisation names, no AS numbers and no customer identities in it, and it covers only space registered to Arelion, so a customer prefix carried over AS1299 will never appear. Traffic engineering is published separately at arelion.com/our-network/bgp-routing/bgp-communities: 1299:50 and 1299:150 lower local preference against a default of 200 for customer routes, 1299:666 triggers a global blackhole while 1299:661 discards only inside the region the route was announced in, and the origin communities 1299:30000, 1299:35000 and 1299:37000 mark a route as learned from a customer in Europe, North America or Asia Pacific while the 20000, 25000 and 27000 series mark one learned from a peer. A prefix tagged with a peer community rather than a customer one is a network Arelion does not sell transit to, checkable live at lg.twelve99.net, the looking glass named in its PeeringDB record.
Backbone link or customer edge, read from the hostname
Reverse DNS is the fastest way to tell which side of an Arelion address you are looking at, because the two roles live in different zones. Backbone interfaces answer under ip.twelve99.net with a short city code and a router number: sto-b7-link.ip.twelve99.net in Stockholm, ash-b2-link.ip.twelve99.net in Ashburn, brx-b3-link.ip.twelve99.net in Brussels, riga-b5-link.ip.twelve99.net in Riga. Interfaces facing a paying network answer under ip.twelve99-cust.net instead, and they carry the customer name with an interconnect order number: hetzner-ic-340780.ip.twelve99-cust.net, equinix-ic-387753.ip.twelve99-cust.net. A lookup that returns nothing means the address has no record, not that the zone is missing.
That naming settles the ownership question on its own. A hostname in the customer zone is Arelion's end of a link, and whatever crossed it came from the network named in the label, whose own space and abuse desk are where a report belongs. Nothing on this ASN is a subscriber line, so there is no carrier-grade NAT layer and no shared household pool to reason about; the assignments Arelion does make to customers are routed rather than translated, and a host answering on them is a hosting or enterprise customer under its own contract. Connections aimed at the link addresses themselves land on a router interface, which is why they answer a traceroute and nothing more.
Related tools
Frequently asked questions
Is Arelion the same network as Telia Carrier?
It is the same AS number and the same address space under a new owner and a new name. The RIPE record for AS1299 keeps the as-name TWELVE99 and the description Arelion, f/k/a Telia Carrier, and carries a remark stating that as of 1 June 2021 Arelion and its affiliates are no longer part of or affiliated with Telia Company.
Why does an Arelion address show up in a privacy test?
An address inside Arelion's own space is almost always a router interface rather than anybody's connection. This is a transit business, so the address a person is actually carried under belongs to the customer network at the far end of the link, and the ordinary place AS1299 turns up is as a hop in a traceroute between you and the site rather than as your visible address. When a lookup does return AS1299 for the address you are testing, the two plausible readings are a machine sitting on a small direct assignment, or a geolocation database that has attributed the wrong side of an interconnect. The city such a lookup reports comes from Arelion's own geofeed, which places each link network at the point of presence terminating it, so a result of Ashburn or Warsaw describes where the fibre lands and not where anyone is sitting.
Where does Arelion say which city one of its blocks is in?
In a geofeed. Its RIPE inetnum objects carry a geofeed attribute pointing at api.arelion.com/public/v1/geolocation, a plain-text file in RFC 8805 column order giving a country, region and city for each prefix. Most entries are /28s to /30s, because they describe individual link networks at a point of presence rather than user blocks.
What does a hostname ending in twelve99-cust.net mean?
It is an Arelion interface facing a customer rather than a backbone link, and the label names the customer and the interconnect order number, as in equinix-ic-387753.ip.twelve99-cust.net. Backbone-internal interfaces use ip.twelve99.net with a city code instead, such as sto-b7-link.ip.twelve99.net.
Does Arelion put subscribers behind carrier-grade NAT?
There are no subscribers on this network to put behind one. AS1299 sells transit and direct assignments to other networks, so addresses here are router interfaces or customer-side hosts, and none of it is a residential access pool.