Project status

IP_telescope collects information about IPv4 addresses that are curious: addresses whose answers, or whose silence, do not match what the registry says should be there.

The first curiosity is a number trick. An ip_probe is an IPv4 address whose four octets are each prime and which is valid for routing across the Internet, such as 2.2.2.2. There are exactly 7,400,808 of them. The second curiosity is the quiet space: 49,572 of those addresses sit in blocks that no Regional Internet Registry operator holds, where nothing is supposed to answer at all.

Status

Phases 1, 2, and 3 are complete. Phase 3 ran on 2026-09-10: 49,572 probes in space no operator holds, each asked one HTTP question. Counts below verified 2026-09-10.

Every answer came from a block the registry calls reserved. The loudest is 23.191.149.0/24, inside ARIN block 23.191.137.0-23.191.151.255: 98 probes answered with an nginx 301 to HTTPS. RDAP records no operator for that block either — only its parent 23.0.0.0/8, which ARIN holds itself. Six addresses in reserved APNIC and ARIN blocks refused the connection, and one of those blocks (199.47.160.0/21) has no RDAP object at all.

What phase 4 found

The whole story, with the evidence and the verdicts, is on the findings page.

The four-prime pattern is not in the answers. Every service answered its non-prime control neighbours too, so the pattern was an artifact of where phase 3 looked, not a property of the services. The control sample turned 99 answering addresses into 237 in one block.

That result does not rule out a curious party watching a range, and the first draft of the theory wrongly said it did. The project owner corrected it on 2026-09-11: a party running the inverse exercise would watch a range and answer every address in it, and our probes would simply have fallen inside a block they monitor. Separating a watcher from an ordinary host needs the awareness test instead.

The owner's sharper test is isolation: an address that answers while the two addresses immediately beside it stay silent was placed there, while anything covering a prefix answers its whole range. On 2026-09-11 the pass measured 598 targets, 499 responded, and 6 responded alone — two of them found by the pass itself rather than by the prime pattern. None serves a page. The six are listed on the findings page, with what would separate them from ordinary single-address hosts.

The evidence, the verdicts, and the measurement that would overturn each one are in records/01-probe-characterization.md. The expected characterization was written first, in documents/07-characterization-theory.md.

The light-speed test found nothing either. A round trip to geosynchronous orbit takes 239 ms at best and to the Moon 2,564 ms; no address measured anywhere near either. The smallest connect to the ARIN site was 8 ms, which rules out both distances outright, and the refusals at 170–181 ms agree with an operator on the ground. The five-second budget put the lunar floor inside the window, so the 89 targets that stayed silent are evidence against the Moon too. What remains unseen is Sun–Earth L2 at ten seconds — the outer bound the project means to look at — and anything slower.

The RDAP enrichment of the 9,200 blocks answered for 8,556 and returned 404 for 27; 617 were left unanswered because rdap.afrinic.net was unreachable and the other registries rate limited the run. Those addresses are not treated as answered, so make enrich with --retry-failed asks again.

Run make probes, make blocks, make enrich, and make observe to reproduce each phase; see README.md and PHASES.md. Every work product that already exists is kept rather than rebuilt: the phase 3 pass costs nineteen minutes of live probing, so make all with everything present finishes in seconds and writes nothing.