Observed ip_probe results

Each of the 106 addresses phase 4 examined has its own page, with the tests applied, what each test saw, and the reading that follows.

This page records what the project has actually observed: which addresses answered, what answered there, and what the evidence supports. The expected characterization — the four explanations and the tests that separate them — is written down separately, in the characterization theory. The full evidence and reasoning are in the phase 4 record.

Everything below is dated. Nothing here is a conclusion about intent: it is what the measurements show, and what would overturn each reading.

What the passes produced

The four sites that responded

Three of the four sit in space the delegation file calls reserved while the routing table says it is announced and in use. That is a registry artifact of legacy space rather than a conspiracy — which is worth remembering before the next pass treats another reserved line as a finding. Nothing connects the four sites: different registries, different operators, no shared certificate, no shared naming. The other-sites record has the second pass over Blocks B, C and D, the correction to our own description of Block B, and the control case — 151.216.5.0, the largest unowned block in the set, which is silent.

The first block, 23.191.137.0-23.191.151.255, has since been investigated in depth — the domain that answers from it, the network that announces it, why the registry calls it reserved, whether one host or many serve it, and how many hands the domain has passed through since 1998: see the ology.com and 23.191.137.0 record, and the layers side by side on the 23/8 map page. Whether all of it is a cover for something else is tested separately in the hidden-purpose record: the client is the operator's own published source, and no hidden hostname, port or endpoint was found.

The control sample, and a correction to our own theory

Phase 4 probed non-prime control addresses beside every anomaly, because the four-prime pattern is our pattern, not necessarily anyone else's. The controls answered as readily as the probes did: 99 answering addresses became 237 in one block.

The first reading of that result was wrong, and the project owner corrected it on 2026-09-11. The draft argued that a party running the inverse exercise would answer only on the four-prime addresses, so answering the neighbours argued against that explanation. The owner's objection: a party watching a range would answer its whole range, and our probes would simply have fallen inside a block they monitor. That is the more sensible expectation, and it means the control sample separates nothing between a curious party and an ordinary one.

What the control sample does settle is the extent of each live range, and that no service exists because of the prime pattern. Separating a watcher from an ordinary host needs the awareness test: a response that changes because of our probing, a baseline from a second vantage point, or content that engages the pattern. None has been observed yet.

Isolation: the strongest hint

The project owner proposed a sharper test on 2026-09-11. A service that covers a prefix lights its whole range — an operator's host, a stale registry record, and a party watching a block all look the same from outside, because they all answer their neighbours. But an address that answers while the two addresses immediately beside it stay silent is different in kind: something was put on that address, on purpose. That is the shape a post office would have.

So the pass now measures the two immediate neighbours of every responder. On 2026-09-11 it measured 598 targets, of which 499 responded and 6 responded alone. Two of the six were addresses the prime pattern never pointed at: the pass found them on its own.

None of the six serves a page: no content, no certificate, no reverse DNS, and a round trip that agrees with an operator on the ground. Four of them have a small responding cluster two to four addresses away, which is what individually used addresses look like — a host that exists and rejects port 80 — rather than a service covering a range.

The verdicts did not change, but they sharpened. Site 103.149.23.0/24 is incidental, and now precisely: six single addresses in use inside an announced prefix. Site 199.47.160.0/21 stays unexplained, narrowing to incidental: the responses come from individually used addresses in 199.47.167.0/24, announced although the containing /21 has neither an announcement nor a registry object. No curious-party candidate emerged — what emerged is a short list of six addresses worth the next measurement: more ports, a traceroute to place the reset source, an exact sweep of the two /24s, and a repeat to see whether the six persist.

Checking those ranges turned up the mirror image, recorded as an observation and not a finding: inside the live ARIN range — /24s 144 to 151, which match the eight announced by AS400050 exactly — six addresses stayed silent while everything around them answered.

The light-speed test

A round trip cannot be faster than light, so distance is the one measurement an Earth-bound explanation cannot fake. One round trip takes 239 ms to geosynchronous orbit and 2,564 ms to the Moon. The project measures single round trips rather than whole requests, because a request costs two round trips and a responder at lunar distance would need 5.1 seconds to answer a GET while completing a connect in 2.6 seconds.

No address measured near either quantum. The smallest connect to the ARIN site was 8 ms, which rules out geosynchronous orbit by a factor of thirty and the Moon by a factor of three hundred; the refusals at 170–181 ms agree with an operator on the ground in Singapore. Jitter ran from 1 ms to 1004 ms with no steady address, which is what a long terrestrial path looks like.

The five-second budget put the lunar floor inside the window, so the 89 targets that never answered are evidence against the Moon as well as the ones that did. What remains out of sight is Sun–Earth L2 at ten seconds and beyond, which is the outer edge of the range the project means to look at.

A caution the project now records: a latency band is not a signature. Thirty-one of the 99 phase 3 answers fell within a quarter of the geosynchronous quantum and every one was ordinary long-haul routing. Satellite broadband subscribers sit in that band legitimately.

Stability

Two characterization passes ran 21 minutes apart on 2026-09-11. All 241 answers, all 241 page digests, and every control outcome were identical: not one address changed state. Stable behaviour is what ordinary services look like, and it is mild evidence against a moving operation. A 21-minute window is a first data point, not a proof.

What is still open

• The awareness test needs a second vantage point on another continent: a terrestrial server answers a nearby observer faster, a distant one does not care, and the project has one host, on the US west coast. The owner has a hosted server in Oregon, recorded as a deferred option and not in use: it shares the project host's coast, so it is weak for the geosynchronous band, though it could still speak to the lunar floor, where the quantum is three orders of magnitude larger than the geography. A cloud virtual machine in a distant region is the stronger deferred option, because a region is a known place; it is recorded, not attempted.
• Site 199.47.167.0/24 stays unexplained until the resets are attributed: a traceroute or an outside measurement would place the device.
• Live ranges are sampled, not mapped to the address.
• The criteria for "curious" remain provisional. They changed once already, on the owner's correction.

Looking inside the large assigned blocks

Phase 3 only asked addresses that no operator holds, so a service hiding inside an operator's own block would never have been probed. On 2026-09-12 the project looked inside four large blocks — 73.0.0.0/8 as a control, 59.192.0.0/10 (delegated to an individual's name), 43.0.0.0/9 (a hyperscaler range) and the 151.3.0.0 legacy blob — using the owner's allocation heuristic: addresses are handed out from low to high, so the search walks the top first, with B and C prime and descending and the fourth octet a prime above 128 and descending.

A passive census of 256 top-end addresses, taken from what a third party has already seen, found exactly one host. The single HTTP question was then asked of 44 addresses: all 32 addresses at the very top of the four blocks stayed silent, and so did the bottom controls. The one live host, 151.79.241.149, is an internet-exposed Zyxel USG FLEX 100 console still presenting the factory self-signed certificate it shipped with in 2021. Two of the four blocks have no route at the top at all, which is worth knowing: unannounced space cannot host a reachable service, whatever else it may be good for. The block-peek record has the method, the tool, the ledger, and what would change the reading.