Turk Telekom IP Ranges
Turk Telekom is Turkey's largest fixed-line carrier, and AS9121 is the autonomous system its subscriber lines answer from. The RIPE NCC holds the aut-num under the as-name TTNet, after the retail internet subsidiary the company trades through, with the organisation handle ORG-TT3-RIPE. The allocations behind it are RIPE PA blocks co-maintained by AS9121-MNT, and their netnames record when each was issued, from TR-TELEKOM-960902 on the legacy 195.174.0.0/15 space to TR-TELEKOM-20051027 on the 88.224.0.0/11 consumer block created in October 2005.
- Provider
- Turk Telekom
- Primary ASN
- AS9121
- Category
- ISP
- Headquarters
- Ankara, Turkey
- Announced IPv4 prefixes
- 321
- Registry
- RIPE
Known IP ranges
These prefixes are currently announced to the global routing table by AS9121 (TTNet Turk Telekomunikasyon Anonim Sirketi). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
88.224.0.0/11
78.160.0.0/11
95.0.0.0/12
85.96.0.0/12
81.212.0.0/14
195.174.0.0/15
212.174.0.0/15
212.156.0.0/16
85.101.128.0/17
88.235.0.0/17
2a00:1d32::/32
2a00:1d36::/32
2a00:1d33::/32 (IPv6)
What does a Turk Telekom IP mean in a privacy test?
On AS9121 the hostname carries the answer, so a reverse lookup is the first thing to run. Addresses come back as their own four octets, written in forward order in front of one of three suffixes: dynamic.ttnet.com.tr, static.ttnet.com.tr or static.turktelekom.com.tr. A dynamic name is an ordinary subscriber line, and Turk Telekom's own help pages describe that as the default arrangement, with the address assigned by the system on each connection and changing when the line reconnects - which makes a repeat sighting weak evidence of the same household. A static name means the opposite and means something specific: somebody bought the Statik IP add-on Turk Telekom sells against a modem, listing remote desktop, game servers, web and mail hosting, FTP, VoIP and VPN among the uses. In a log that makes a static name the more interesting one, because it marks a line whose owner deliberately arranged to stay reachable at a fixed address.
The RIPE objects behind AS9121
Turk Telekom keeps its machine-readable data in the RIPE database and keeps it current. The allocations are RIPE-NCC-HM-MNT objects with AS9121-MNT as co-maintainer, and the netnames carry their own issue dates - TR-TELEKOM-960902 on the legacy 195.174.0.0/15 space against TR-TELEKOM-20051027 on 88.224.0.0/11 - which is a fast way to tell an old PTT-era block from a 2000s consumer allocation. Matching route objects sit alongside them under the same maintainer at /16 and /17, described as TurkTelekom on the 88.224.0.0/11 subnets and as TTnet or TTnetTurkTelekom on the older 195.174.0.0/15 space, and the AS-SET AS-TTNET, described in RIPE as the TTnet Autonomous System, gathers several hundred member ASNs.
Two things are absent. There is no geofeed attribute on the allocations and no self-published geolocation file, so a Turkish address that lands in the wrong city has no operator document to correct it against; the only contact the objects offer is the abuse remark pointing at abuse@turktelekom.com.tr. Its PeeringDB record is also much narrower than the network is, declaring a selective policy with a ratio requirement, a looking glass at lg.turktelekom.com.tr/lg/, and just two public peering points - AMS-IX and DE-CIX Frankfurt, each at 200G - against seven interconnection facilities. That record describes where Turk Telekom meets the rest of the internet, not where its subscribers sit.
Reading dynamic against static on AS9121
Start with the suffix. An address sampled in 78.160.0.0/11 and another in 85.96.0.0/12 both answered with their own dotted quad in front of dynamic.ttnet.com.tr, while one in 88.224.0.0/11 returned static.ttnet.com.tr and one in 212.156.0.0/16 returned static.turktelekom.com.tr - the same scheme under two parent domains, one of them still the retail TTNet brand the aut-num is named after. The suffix is the allocation type stated by the operator, which is more than most access networks put in reverse DNS.
Static, on this network, is a purchase. Turk Telekom sells Statik IP as a paid add-on attached to the modem rather than to a computer - its own page puts it as the address being given to the modem you connect through, not to your computer - and lists remote desktop, game servers, web and mail hosting, FTP, VoIP and VPN among the reasons to take it. A static. PTR therefore marks a line that can host a listening service or terminate a tunnel, while a dynamic. one generally cannot keep either up. Neither suffix separates Turk Telekom's own infrastructure from a subscriber, so for that question use the origin ASN and remember the group also announces from AS47331, registered as TTNET TTNet A.S.
Related tools
Frequently asked questions
What IP ranges does Turk Telekom use?
They are announced under AS9121, held at the RIPE NCC with the as-name TTNet under the organisation handle ORG-TT3-RIPE. The largest blocks in the routing table are listed above. Matching route objects are registered in the RIPE database under AS9121-MNT at /16 and /17, with descriptions reading TurkTelekom, TTnet or TTnetTurkTelekom depending on the block.
Why does a Turk Telekom IP appear in my privacy test?
On AS9121 the hostname carries the answer, so a reverse lookup is the first thing to run. Addresses come back as their own four octets, written in forward order in front of one of three suffixes: dynamic.ttnet.com.tr, static.ttnet.com.tr or static.turktelekom.com.tr. A dynamic name is an ordinary subscriber line, and Turk Telekom's own help pages describe that as the default arrangement, with the address assigned by the system on each connection and changing when the line reconnects - which makes a repeat sighting weak evidence of the same household. A static name means the opposite and means something specific: somebody bought the Statik IP add-on Turk Telekom sells against a modem, listing remote desktop, game servers, web and mail hosting, FTP, VoIP and VPN among the uses. In a log that makes a static name the more interesting one, because it marks a line whose owner deliberately arranged to stay reachable at a fixed address.
What is the difference between dynamic.ttnet.com.tr and static.ttnet.com.tr?
The suffix records how the address was allocated. Dynamic names mark ordinary subscriber lines whose address the system assigns at each connection and changes when the line reconnects. Static names mark addresses on Turk Telekom's paid Statik IP add-on, which is attached to the modem and sold for uses such as remote desktop, servers and VPN. A third suffix, static.turktelekom.com.tr, is the same scheme under the newer parent domain.
Does Turk Telekom publish a geofeed?
No. There is no geofeed attribute on its RIPE allocations and no self-published geolocation file, so a Turkish address that resolves to the wrong city has no operator statement to correct it. What the RIPE objects do carry is an allocation date built into the netname, such as TR-TELEKOM-960902 and TR-TELEKOM-20051027, and an abuse address at abuse@turktelekom.com.tr.
Can a server or a VPN exit run on a Turk Telekom address?
On a static one, yes. The Statik IP product exists so that a subscriber can be reached at an address that does not change, and Turk Telekom lists servers and VPN among its uses, so a static name is a plausible home for a listening service. On a dynamic address it is impractical, since the address moves with the session. AS9121 is an access network rather than a hosting one, so neither case means Turk Telekom is renting out compute.