Probe 103.241.73.191
← all phase 4 probes · block page · 103.0.0.0/8 map · the record
anomaly in 103.241.72.0/22 (reserved, apnic). Phase 3 saw http_response; phase 4 saw http_response.
Where this address sits
| Block | 103.241.72.0 - 103.241.75.255 (1,024 addresses) |
|---|---|
| Registry, status | apnic, reserved (not operator-held) |
| RDAP custody | parent object — the registry's answer covers a parent range, 103.0.0.0 - 103.255.255.255 |
| RDAP holder | APNIC-AP · APNIC Hostmaster · ALLOCATED PORTABLE |
| Block UUID | f1b1b599-c764-5049-a57b-2024287be8f8 |
| Probes in the block | 54 (1 of them responded, refused, or reset; 5 of 26 measured addresses answered) |
What was observed
| Phase 3 (one GET) | http_response, status 200, 339 ms |
|---|---|
| Phase 4, port 80 | http_response, status 200, server nginx, 1,326 bytes, digest cdf9d8eee8c4fe96… |
| Phase 4, unrelated Host | http_response, status 200, body identical |
| Phase 4, HTTPS | certificate_unverified, certificate baidu.sina.2022.5508085.com, issuer YR1, valid Jul 31 12:40:22 2026 GMT to Oct 29 12:40:21 2026 GMT, verified False |
| Certificate names | subject alternative names: DNS:2022.mid.jx.500.5508085.com, DNS:baidu.sina.2022.5508085.com, DNS:motogp.2022.rossi.5508085.com — no IP address in the certificate; SHA-256 8e501a78b6235c0b7c34c40d2135f77b… |
| Reverse DNS | none |
| Round trips | [182, 173, 180] ms; floor 173 ms, median 180 ms, jitter 9 ms, band none |
The tests, and what each one says here
| Test | Question | Observed | Reading |
|---|---|---|---|
| 1. Registry custody | Does a registry object cover this address? | parent object: the registry's answer covers a parent range, 103.0.0.0 - 103.255.255.255 | The registry has no object for this block: it is inside a parent allocation, so no holder is recorded for these addresses. |
| 2. Ranging (isolation) | Do the two immediate neighbours answer too? | -1 103.241.73.190: http_response, +1 103.241.73.192: http_response | At least one neighbour answered too, so whatever this is covers more than one address: a range, not a single endpoint. |
| 3. Catch-all | Does an unrelated Host header get the same answer? | unrelated Host: http_response, same body | An unrelated Host header received the identical page: the server is not listening for a name, which is what a default or parked configuration looks like. |
| 4. Uniformity | Does the block answer with one page? | 3 measured address(es) in this block served exactly this page (digest cdf9d8eee8c4…). | One page repeated across many addresses is configuration; a page that varied by address would be deliberation. |
| 5. Identity | Do certificate, reverse DNS, and registry agree? | certificate baidu.sina.2022.5508085.com, reverse DNS no reverse DNS, registry organization APNIC Hostmaster | The certificate names a domain, the address has no name of its own, and the registry names a different party. The layers do not tell one story. |
| 6. Stability | Does it answer the same way on a second pass? | Not measured for this address: the pass has not been repeated. | Stability is one of the discriminators, and a single pass cannot measure it. |
| 7. Distance | Does the smallest round trip sit on a light-speed floor? | floor 173 ms, jitter 9 ms, band none | The smallest of 3 round trips was 173 ms, with 9 ms of jitter. That is below both floors (238.7 ms to geosynchronous orbit, 2564.4 ms to the Moon), so neither distance explains it. |
| 8. Self-explanation | Does the content explain its own purpose? | Content: <!doctype html> <html> <head> <meta charset="utf-8"> <title>没有找到站点</title> <style> *{margin:0;padding:0;color:#444} body{font-size:14px;font-family:"宋体"} .main{width:600px;margin:10% auto;} .title{background: #20a53a;col | The content is a default page, a redirect, or a hosting panel. Nothing in it explains a purpose or invites contact. |
| 9. Concealment | Is it silent, inconsistent, or changing? | phase 3 http_response, phase 4 http_response | A page was served with the same answer to any Host header, so nothing is being withheld from a casual probe. |
The verdict this probe inherits
Site B: Two claims: incidental for the anomaly, nefarious for the activity. Confidence: Medium; abuse of a reseller's host cannot be separated from a deliberate operator without the provider's records.
- The /24 is announced by a hosting provider while the delegation file calls the whole /22 reserved: the anomaly itself is a records artifact.
- The activity is not: an automatic redirect page loading car.js, a throwaway domain farm in the certificate (baidu.sina.2022.5508085.com and two siblings), an unconfigured Apache host on the same /24, and no reverse DNS anywhere.
- Nobody needs that combination to be found.
What would change it: A hosting-abuse report, the provider's allocation record, or the content disappearing after a takedown would move the second claim.
The layers, as recorded
| Delegation file | see the block page |
|---|---|
| Registry object | parent only (APNIC's 103.0.0.0/8) |
| Routing | AS152194 CTG Server Limited (hosting), announcing 103.241.73.0/24, first seen not recorded, visibility not recorded |
| Authorization | not recorded |
| DNS pointing here | baidu.sina.2022.5508085.com -> 103.241.73.190 |
The verdict is a property of the site, not of this probe: the evidence is block-scale, and no per-address verdict was reached. That is a gap in the work, not a finding about this address.
The full evidence is in the work products (dataflow.out/05_ip_probe_http.json and dataflow.out/06_ip_probe_characterize.json); the registry's verbatim RDAP answer is kept locally and not published.