Infrastructure Zombies:
When Carrier Acquisitions Leave the Door Open

What began as a documented response to observed network anomalies at a single residential location in Northeast Georgia evolved into a national infrastructure survey over five months. The investigation crossed from device-layer forensics into BGP routing tables, ARIN records, physical plant maps, and federal disclosure channels.

The timeline below documents every significant milestone: filings to CISA, FBI, and IC3; ground confirmations; database construction; zombie ASN discovery; and — critically — the confirmed remediation event on May 19, 2026, when four anomalous BGP routes changed state simultaneously, 17 days after the FBI disclosure.

The national database was built from public carrier acquisition records — SEC merger documents, FCC franchise transfer filings, and ARIN/RDAP attribution — before any validation data was collected. Case selection was a priori: six acquisition cases were chosen based on publicly documented carrier histories, not based on what the data would show. States with zero records reflect the geographic footprint of those six cases, not filtering.

Every record represents a ZIP code that falls within a predicted carrier acquisition boundary — a location where, by methodology, the subscriber’s broadband infrastructure may be operating at the seam between pre- and post-acquisition plant.

A zombie ASN is a pre-acquisition Autonomous System Number that is still announcing IP prefixes in live global routing tables after the acquiring carrier should have assumed or decommissioned that routing authority. A zombie means the IP space is being routed by an entity that, by acquisition records, should no longer exist as an independent network — creating an unaccountable gap between who the public record says controls that IP space and who is actually routing it.

Beyond simple zombies, this investigation documented more complex conditions: retention anomalies (pre-acquisition ASNs kept active by the acquirer in parallel with the successor ASN), third-party control (routing authority held by an unknown external party), and what appear to be law enforcement sinkhole ASNs — legacy routing infrastructure repurposed for network monitoring.

The full ASN registry has been disclosed to CISA, the FBI, and CERT. The methodology is documented here — researchers are welcome to replicate it.

Not all findings are equal. A record inferred from acquisition geography carries less evidentiary weight than one confirmed by physical observation. The investigation uses a five-tier confidence ladder to distinguish what the methodology predicts from what has been directly observed. Confidence upgrades require independent corroboration — they are not self-assigned.

All findings were disclosed to carriers and government agencies through established responsible disclosure channels before any public publication. The goal is infrastructure remediation — not exposure. Carriers are given the opportunity to address conditions before they appear in public reporting.