Probe 23.191.149.107
← all phase 4 probes · block page · 23.0.0.0/8 map · the record
anomaly in 23.191.137.0 (reserved, arin). Phase 3 saw http_response; phase 4 saw http_response.
Where this address sits
| Block | 23.191.137.0 - 23.191.151.255 (3,840 addresses) |
|---|---|
| Registry, status | arin, reserved (not operator-held) |
| RDAP custody | parent object — the registry's answer covers a parent range, 23.0.0.0 - 23.255.255.255 |
| RDAP holder | NET23 · American Registry for Internet Numbers · — |
| Block UUID | 16583269-1874-5ca6-98f5-979f02f8634a |
| Probes in the block | 216 (98 of them responded, refused, or reset; 482 of 494 measured addresses answered) |
What was observed
| Phase 3 (one GET) | http_response, status 301, 162 ms |
|---|---|
| Phase 4, port 80 | http_response, status 301, server nginx, 162 bytes, digest 9e17cb15dd75bbbd… |
| Phase 4, unrelated Host | http_response, status 301, body identical |
| Phase 4, HTTPS | certificate_unverified, certificate ology.com, issuer R10, valid Mar 2 12:14:32 2025 GMT to May 31 12:14:31 2025 GMT, verified False |
| Certificate names | subject alternative names: DNS:ology.com — no IP address in the certificate; SHA-256 cca6c482734b510076c86e333b24c458… |
| Reverse DNS | none |
| Round trips | [89, 79, 85] ms; floor 79 ms, median 85 ms, jitter 10 ms, band none |
The tests, and what each one says here
| Test | Question | Observed | Reading |
|---|---|---|---|
| 1. Registry custody | Does a registry object cover this address? | parent object: the registry's answer covers a parent range, 23.0.0.0 - 23.255.255.255 | The registry has no object for this block: it is inside a parent allocation, so no holder is recorded for these addresses. |
| 2. Ranging (isolation) | Do the two immediate neighbours answer too? | -1 23.191.149.106: http_response, +1 23.191.149.108: http_response | At least one neighbour answered too, so whatever this is covers more than one address: a range, not a single endpoint. |
| 3. Catch-all | Does an unrelated Host header get the same answer? | unrelated Host: http_response, same body | An unrelated Host header received the identical page: the server is not listening for a name, which is what a default or parked configuration looks like. |
| 4. Uniformity | Does the block answer with one page? | 482 measured address(es) in this block served exactly this page (digest 9e17cb15dd75…). | One page repeated across many addresses is configuration; a page that varied by address would be deliberation. |
| 5. Identity | Do certificate, reverse DNS, and registry agree? | certificate ology.com, reverse DNS no reverse DNS, registry organization American Registry for Internet Numbers | The certificate names a domain, the address has no name of its own, and the registry names a different party. The layers do not tell one story. |
| 6. Stability | Does it answer the same way on a second pass? | Not measured for this address: the pass has not been repeated. | Stability is one of the discriminators, and a single pass cannot measure it. |
| 7. Distance | Does the smallest round trip sit on a light-speed floor? | floor 79 ms, jitter 10 ms, band none | The smallest of 3 round trips was 79 ms, with 10 ms of jitter. That is below both floors (238.7 ms to geosynchronous orbit, 2564.4 ms to the Moon), so neither distance explains it. |
| 8. Self-explanation | Does the content explain its own purpose? | Content: <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>nginx</center> </body> </html> | The content is a default page, a redirect, or a hosting panel. Nothing in it explains a purpose or invites contact. |
| 9. Concealment | Is it silent, inconsistent, or changing? | phase 3 http_response, phase 4 http_response | A page was served with the same answer to any Host header, so nothing is being withheld from a casual probe. |
The verdict this probe inherits
Site A: Incidental, with curious not excluded. Confidence: Medium for the verdict; high that this is not concealment.
- The answering range is exactly the eight /24s announced by AS400050, and ology.com resolves into it: a named, public, ordinary web host rather than a hidden one.
- One certificate covered 237 addresses and expired in May 2025: an abandoned deployment, not an active watch post.
- The whole range answers with one page and any Host header, which is configuration, not deliberation.
- Group 1 is not excluded: a party watching a range would answer it exactly like this. The awareness test has not been run.
What would change it: Withdrawal of the announcement with the answers persisting would break the reading; evidence of the service reacting to our probes would move it to curious; a renewed certificate and a live site would make it an ordinary service with a stale record.
The layers, as recorded
| Delegation file | see the block page |
|---|---|
| Registry object | none for the addresses: ARIN returns its own parent 23.0.0.0/8 (NET23), while neighbouring /24s it allocated in 2024 do have objects |
| Routing | AS400050 Ology Newswire, Inc. (ARIN organization handle ON-70, Monticello, Indiana; no network object for these addresses), announcing 23.191.144.0/24 - 23.191.151.0/24, eight of the block's fifteen /24s, first seen 2021-10-21, visibility 322-324 of 324 RIS peers |
| Authorization | no RPKI ROA (validation status unknown) |
| DNS pointing here | ology.com, feed/list/beacon/link/api/archive.ology.com -> 23.191.144.8/.9; ns1.ology.com -> 23.191.145.2 |
The verdict is a property of the site, not of this probe: the evidence is block-scale, and no per-address verdict was reached. That is a gap in the work, not a finding about this address.
The full evidence is in the work products (dataflow.out/05_ip_probe_http.json and dataflow.out/06_ip_probe_characterize.json); the registry's verbatim RDAP answer is kept locally and not published.