14 companies running their own network

Almost every company on this site's list sits behind someone else's network. Their website is on AWS or Google Cloud, their traffic passes through Cloudflare or Akamai, their VPN terminates at a managed provider — and none of that shows up as anything distinctive, because it isn't. What's rare is the opposite: a company that runs enough of its own infrastructure to need an Autonomous System Number of its own.

An ASN is the internet's actual unit of network ownership. Having one means a Regional Internet Registry — ARIN, RIPE NCC, APNIC, or one of the others — has approved you to announce IP address blocks and participate directly in BGP routing, rather than sitting inside a block someone else announces on your behalf. Getting one is a real, non-trivial step: paperwork, a justification, an ongoing registration. The registered holder name on that record is public data, filed for the same reason a company's registered office address is public — so another network operator knows exactly who to call when a route between two networks breaks.

We resolved every subdomain in OSIC's FTSE 100, FTSE 250 and S&P 500 catalogue to the network it currently sits on, then flagged every case where the network's own registered holder name matches the company itself — and checked every match independently, live, against the registries directly (RIPE, ARIN and the RIPEstat aggregator that mirrors all five), not just our own stored data.

The full list

"Subdomains" counts distinct hostnames in OSIC's dataset resolving to that company's own ASN — a slice of their footprint, not a claim about the whole estate. Three companies show "primary site" instead: for those three alone, it's the actual main website OSIC sampled, not a side system.

The expected two: telecoms running the network they sell

BT Group's own registry entry for AS2856 literally names the product: "BTnet UK Regional network," BT's commercial private WAN service. The eleven hostnames sitting on BT's own two ASNs (AS2856 and AS5400, both registered to British Telecommunications Limited) are backend systems for BT's consumer TV and broadband products — load balancers (ecgslb-wlms.bt.com), a TV streaming API gateway, and what looks like an internal broadcast management system, all under bt.com itself. For a company whose entire business is operating a network, this is the least surprising entry on this list — and a useful proof the method works before the more interesting ones.

Vodafone Group's AS3209 is registered simply as "International IP-Backbone of Vodafone," run out of Vodafone GmbH's Eschborn, Germany address. The hostnames on it are video CDN edge nodes (*.cdn2.id.vtv.vodafone.com) — Vodafone TV's own delivery network, not rented from a third party. A second ASN, registered to Vodafone Group Services GmbH, carries two group datacenter systems.

Multi-region banks, mirrored in their own routing

HSBC doesn't run one network — it runs at least three, separately registered, one per major region it actually operates a licensed bank in: HSBC Technology & Services (USA), HSBC HongKong, and a UK-registered HSBC-UK. Nineteen hostnames sit across the three, including online-banking backend systems, a business trade-tracking platform, and VPN infrastructure. The registration boundaries line up with the regulatory ones — a US-chartered bank, a Hong Kong one and a UK one, each with its own network, is the internet-infrastructure version of the same ring-fencing regulators require of HSBC's banking entities.

Standard Chartered's AS38166 is registered to Standard Chartered Bank (Hong Kong) Limited, carrying a DMZ host and a system named h2h.sc.com — "host-to-host," standard terminology for a direct corporate-banking payment integration. The same pattern as HSBC, one region instead of three.

The genuinely surprising ones

None of the following sell networking. Between them they sell defence hardware, soap and mayonnaise, surgical implants, textbooks, petroleum, fund management and IT support — and every one of them still runs enough of its own global enterprise infrastructure to hold a registered network.

BAE Systems' AS26577 is registered to BAE Systems Inc., the US defence subsidiary. Ten hostnames, all under us.baesystems.com: VPN authentication, and a PLM (product lifecycle management) portal used to manage engineering data for physical hardware. Internal engineering infrastructure for a US defence contractor, sitting on a network BAE registered itself rather than a managed provider's.

Unilever holds two, for two completely different corners of the business. One ASN is registered simply as Unilever PLC, carrying what look like manufacturing-site network gateways (hueveagw04.unilever.com, plebyagw02.unilever.com — plausibly Hungary and Poland plant codes). The second is registered to Conopco, Inc. — Unilever's US operating entity, a name that appears on Unilever product packaging and US legal filings but nowhere on Unilever's own marketing. It carries two session-border-controller hostnames, the kind of equipment that handles enterprise VoIP calls.

Smith & Nephew's two ASNs are registered under the company's own literal name (one specifically to its Endoscopy division). The five hostnames include hybrid cloud/on-prem bridge servers — and owamail.smith-nephew.com, which is exactly what it looks like: Outlook Web Access, the company's own email, reachable through the company's own network rather than a hosted mail provider's.

Pearson plc's AS29016 is registered to Pearson Shared Services Ltd. Four hostnames: an accessibility-testing tool, an internal platform named axis, and a couple of document-generation systems. Quiet, back-office infrastructure for an education publisher.

Schroders' AS206166 is registered to Schroder Investment Management Limited. Two hostnames, both named like internal London production application servers. The smallest footprint on this list by subdomain count, but the registration is unambiguous.

BP's AS2535 is registered to BP America, Inc. — one hostname, a single internal system. The thinnest evidence on this list: one subdomain is a much weaker signal than BAE's ten or HSBC's nineteen, but the registration itself is exactly as unambiguous as any of them.

Computacenter is arguably the least surprising of this group — it sells enterprise IT services for a living, so running enterprise network infrastructure is closer to home turf than BP's or Pearson's. Its French entity's ASN carries an extranet, a VPN, and an internal ticketing system, registered to a real address at Tour Ariane in Paris La Défense; a second, German-registered ASN carries one more internal host.

Not quite: the one that rides on a parent company's network

What doesn't show up

Equally informative is who's absent. Shell, GSK, AstraZeneca, Diageo, National Grid, Rio Tinto, Sage Group, Tesco, Barclays, Lloyds Banking Group, NatWest, RELX and Reckitt — some of the largest companies on this site's entire list, several of them (National Grid especially) literally in the business of operating national infrastructure — show zero self-registered ASN anywhere in this dataset. Every piece of their footprint OSIC can see sits on Microsoft, Amazon, Google, Cloudflare, Akamai or a similar third party. Running your own network is a deliberate infrastructure choice a company makes, not something that happens automatically once you're big enough to afford it.

Method & caveats

Built from subdomain_probe's ASN resolution — every subdomain OSIC has discovered via Certificate Transparency and direct crawl, across every domain a company owns, not just its primary site — cross-referenced against each ASN's registered holder name (Team Cymru's IP-to-ASN mapping, which mirrors RIR data), then independently re-verified live against RIPEstat and the RIR registries directly for every match before publishing. A few things worth holding in mind:

• This only shows what's visible for hostnames OSIC has actually discovered and resolved. A company could hold an ASN never announced for any publicly-known hostname — invisible to this method, not evidence of non-ownership.
• Presence shows a slice, not the whole estate. BAE Systems' ten hostnames are specifically the us.baesystems.com subtree, not a claim about BAE's global network.
• Nobody on this list runs their actual public homepage on their own network except the three S&P 500 companies at the bottom of the table. Every FTSE 100 entry here is internal or back-office infrastructure — VPNs, webmail, engineering portals, plant gateways — sitting behind a public website that, like everyone else's, is on a managed cloud or CDN.
• ASN registration is a live, if rarely-changing, record. This is a snapshot, not a permanent fact.

Full ASN attribution for every company: ASN map.