Record: the other misplaced sites — 2026-09-12

What was asked and how it was done

Phase 4 found four blocks that answered where the registry says nothing should. Site A (23.191.137.0, ology.com) has its own record. The owner asked for the other three to be explored a little further, plus the largest unowned block in the set. This pass used the same battery as site A — registry objects, routing history, certificates, reverse DNS, third-party scans, and single well-formed requests — with an explicit budget: no scans, no port sweeps, no credentials, no redirects followed into third parties, and one traceroute, to one address, which the owner approved for site D.

Site B — 103.241.72.0/22, APNIC says reserved, AS152194 announces it

The anomaly is a registry artifact; the activity is a throwaway domain farm.

A correction to our own phase-4 write-up. That write-up described this site as “a redirect page loading car.js”. The stored body is the “no site found” page — sha256[:12] = cdf9d8eee8c4 — and the host serves exactly that page today, byte for byte. It references no script, has no meta refresh, and no redirect. The only redirects observed are the standard per-vhost HTTP-to-HTTPS 301s for the farm’s own names. The earlier description is not supported by the evidence we kept.

Verdict. Unchanged, and now better grounded. The anomaly is an unlisted allocation: the delegation file says reserved while a commercial hosting reseller announces and rents the space. The activity is the familiar pattern — a small farm of throwaway numbered domains on a stock shared host, of the kind used for search-spam and redirection. It is abuse of a reseller’s hosting, not a hidden service, and the certificate set is tiny (three names), which is what a spam farm looks like rather than what infrastructure looks like.

Site C — 103.149.23.0/24, APNIC says reserved, AS4657 announces it

Verdict: incidental, high confidence — and the falsifier phase 4 named did not fire. That falsifier was “a refusal that moves between passes”; the refusal set is stable, on a range the announced operator really runs, with no page and no reverse DNS. Hosts that reject port 80 are ordinary. Nothing here is concealed, and nothing is unaccounted for except the delegation file’s stale reserved entry.

Site D — 199.47.160.0/21, no RDAP object, AS14902 announces a /24

This remains the one site with no named operator, and this pass gives it a shape without giving it a name.

Verdict: still unexplained, now with a shape. An ASN with no registry record, no PeeringDB entry and no holder name announces a /24 inside a block that has no registry object at all; the addresses have no reverse DNS; port 80 refuses; and one port accepts a connection and closes it without a word. That is consistent with a legacy allocation used quietly by an operator that never tidied its registry presence — and it is also consistent with something less ordinary. One request cannot identify a protocol that waits for a handshake we do not know, so the service on 9010 stays unidentified.

151.216.5.0 — the largest unowned block in the set, and a control

523,008 addresses in RIPE’s managed block (RIPE-NCC-MANAGED-ADDRESS-BLOCK, 151.0.0.0/8, allocated 2002-06-25), holding 2,916 of our probes, produced not one answer in phase 3.

• No ASN announces 151.216.5.0/24 (RIPEstat returns an empty ASN list).
• Four sampled addresses (151.216.5.1, .2, .3, .5) give no answer on port 80.

Silent, as unassigned space should be. This is worth keeping as a control: the ology.com block answering from inside ARIN’s own reserved /8 is the exception, not a general property of unowned space. If silence were rare, site A would be less interesting.

The four sites side by side

The one pattern worth naming is delegation staleness. In three of the four, and arguably all four, the delegation file says reserved while the routing table says the space is announced and in use. That is a registry artifact of legacy space, not a conspiracy: the registries’ extended delegation files carry coarse or stale entries, and the routing table is the better account of who operates an address. It also means that “the registry says reserved” is a weak anomaly test on its own — which is worth remembering before the next pass treats another reserved line as a finding.

Nothing connects the four sites. Different registries, different ASNs, different kinds of operator (a named corporation, a Hong Kong reseller, a Singapore carrier, an unnamed legacy holder), no shared certificate, no shared naming, no shared reverse DNS. The similarity that phase 4 found — an answer where the registry promises silence — comes from the registry side, not from a common operator.

What would move each verdict

The intrusion ledger for this pass

No scan, no port sweep, no credential, no zone transfer, and no redirect followed into a third-party site.

Commits

• (this record)