Probe 199.47.167.19
← all phase 4 probes · block page · 199.0.0.0/8 map · the record
anomaly in 199.47.160.0/21 (reserved, arin). Phase 3 saw connection_reset; phase 4 saw connection_reset.
Where this address sits
| Block | 199.47.160.0 - 199.47.167.255 (2,048 addresses) |
|---|---|
| Registry, status | arin, reserved (not operator-held) |
| RDAP custody | no object — the registry holds no object for this address |
| RDAP holder | — · — · — |
| Block UUID | 1bc49505-d08a-5360-a254-861537f8f526 |
| Probes in the block | 108 (3 of them responded, refused, or reset; 0 of 45 measured addresses answered) |
What was observed
| Phase 3 (one GET) | connection_reset, status —, 168 ms |
|---|---|
| Phase 4, port 80 | connection_reset, status —, server —, 0 bytes, digest —… |
| Phase 4, unrelated Host | connection_reset, status —, body different |
| Phase 4, HTTPS | connect_refused, certificate — |
| Certificate names | no certificate was presented |
| Reverse DNS | none |
| Round trips | [79, 82, 81] ms; floor 79 ms, median 81 ms, jitter 3 ms, band none |
The tests, and what each one says here
| Test | Question | Observed | Reading |
|---|---|---|---|
| 1. Registry custody | Does a registry object cover this address? | no object: the registry holds no object for this address | The registry holds nothing here at all, so no holder is recorded. |
| 2. Ranging (isolation) | Do the two immediate neighbours answer too? | -1 199.47.167.18: timeout, +1 199.47.167.20: connection_reset | At least one neighbour answered too, so whatever this is covers more than one address: a range, not a single endpoint. |
| 3. Catch-all | Does an unrelated Host header get the same answer? | no page on either Host header (connection_reset / connection_reset) | No page was served, so there is nothing to compare across Host headers. |
| 4. Uniformity | Does the block answer with one page? | Nothing was served, so uniformity cannot be compared. | There is no page to compare, so uniformity gives no signal here. |
| 5. Identity | Do certificate, reverse DNS, and registry agree? | certificate no certificate, reverse DNS no reverse DNS, registry organization — | No certificate was presented, so the only identity evidence is the reverse DNS and the registry record: two layers, not three. |
| 6. Stability | Does it answer the same way on a second pass? | Not measured for this address: the pass has not been repeated. | Stability is one of the discriminators, and a single pass cannot measure it. |
| 7. Distance | Does the smallest round trip sit on a light-speed floor? | floor 79 ms, jitter 3 ms, band none | The smallest of 3 round trips was 79 ms, with 3 ms of jitter. That is below both floors (238.7 ms to geosynchronous orbit, 2564.4 ms to the Moon), so neither distance explains it. |
| 8. Self-explanation | Does the content explain its own purpose? | No content: the address refused, reset, or said nothing. | There is nothing to read, so this test gives no signal. |
| 9. Concealment | Is it silent, inconsistent, or changing? | phase 3 connection_reset, phase 4 connection_reset | The address connection reset rather than answering: something is present and says nothing. That is the shape of a closed port on a host as much as of anything hidden. |
The verdict this probe inherits
Site D: Unexplained, narrowing to incidental. Confidence: Low; the device that resets is not identified.
- The responses come from individually used addresses inside 199.47.167.0/24, which is announced although the containing /21 has neither an announcement nor an RDAP object.
- Two refusals and four resets, scattered as singles and one adjacent pair, look like hosts that exist and reject port 80.
- Nothing identifies the filtering device, so the reading stays open.
What would change it: A traceroute or a measurement from an independent vantage point would place the reset source; a repeat pass would show whether the reset set moves.
The layers, as recorded
| Delegation file | see the block page |
|---|---|
| Registry object | none: RDAP holds no object at all |
| Routing | AS14902 holder not resolved, announcing 199.47.167.0/24 (the containing /21 is not announced), first seen not recorded, visibility not recorded |
| Authorization | not recorded |
| DNS pointing here | no reverse DNS |
The verdict is a property of the site, not of this probe: the evidence is block-scale, and no per-address verdict was reached. That is a gap in the work, not a finding about this address.
The full evidence is in the work products (dataflow.out/05_ip_probe_http.json and dataflow.out/06_ip_probe_characterize.json); the registry's verbatim RDAP answer is kept locally and not published.