Record: ology.com and 23.191.137.0 — 2026-09-11

What was asked

The owner read the site served from Site A and found its story “aspirational but unfulfilled”, and asked four things: what is known about ology.com and the block; whether the history of domain ownership can be reconstructed; whether the certificate names any IP addresses, and whether that data is on a page; whether the sampled addresses come from one physical host; and why the block reads as unused.

Everything below was gathered on 2026-09-11, from the project’s own work products plus public registries, RPKI, BGP data, certificate transparency, the Internet Archive, and a few traceroutes.

The block, layer by layer

The domain

• Registered 2002-05-02, registrar GoDaddy, four client-hold statuses, registry expiry 2029-03-07: the registration is paid years ahead.
• Name servers are AWS Route 53 (awsdns-*), mail is Amazon SES (inbound-smtp.us-east-1.amazonaws.com), and a google-site-verification record is present: the domain is administered on AWS, by someone who is still paying attention to it.
• Certificate transparency (certspotter; crt.sh was returning 502) shows 16 issuances in 2026 for ology.com and the subdomains above, so renewal automation is live — but the hosts in this block still serve the March 2025 certificates, expired since early June 2025.

The history, from the Internet Archive (captures every year since 1998):

So the ownership history is partly reconstructible. The registry redacts the registrant, and no free source reconstructs the holder list; what can be recovered is the property’s behaviour over time — a corporate site, then a social network, then an ad-supported content site, then a dormant application — plus the current administration on AWS. That answers “who and why” only in outline: the domain has been commercially motivated since 2002, and the current holder maintains it without publishing who they are.

Why it reads as unused

Because the project’s map is built from the delegation files, which record what registries delegate, and this space has never been delegated. It is ARIN’s own /8 (NET23), and ARIN marks this sub-block reserved and holds no RDAP object for the addresses. There is no RPKI ROA either, so the space is announced and used with no registry record and no cryptographic claim at all. The registry answer is not wrong: nothing here has been assigned. It is simply not the whole story — a company has been operating 2,048 of those addresses since October 2021.

One physical host? No

Two independent measurements say the block is served by several hosts in several places, behind one configuration:

• Round-trip floors differ by a factor of ten between /24s: 7 ms (23.191.148.0/24), 9 ms (.144), 34 ms (.150), 53 ms (.145), 58 ms (.151), 71 ms (.147, .149). One host cannot be 7 ms and 71 ms away from the same observer at the same time.
• The visible last hops differ: traces toward .150 and .151 end in Vultr’s network (netname CONSTANT), while .149 is reached over Arelion transit. Filtered hops leave .144, .145 and .148 unresolved, which is itself a difference in filtering behaviour.
• Yet the content is identical everywhere: 482 measured addresses, one body digest, one certificate, one catch-all 301 to HTTPS. One configuration, many hosts — a fleet, or a set of sites sharing a template, not a single server with a sloppy DNS entry.

Per-vhost certificates confirm the configuration is name-based: asking for feed.ology.com or beacon.ology.com returns that name’s own (also expired) certificate, while api.ology.com falls back to the default. By bare IP the server answers 400 over HTTPS, which is what a name-based vhost does when it does not recognise the name it was addressed by.

Answers, in one line each

• The certificate names no IP address: SAN is DNS:ology.com only, and the certificate data now appears on each probe page and each block page.
• Not one host: floors spread 7–71 ms across /24s, and the paths end in different provider networks.
• The host organization is the domain’s own company: AS400050, “Ology Newswire, Inc.” per bgp.he.net, announcing since 2021-10-21, with its own nameserver in the block — and with no record in ARIN, PeeringDB, RADB, or RPKI.
• The block reads as unused because it was never delegated; the annotation comes from the delegation file, and the routing, DNS, and content all tell a different story.
• “Aspirational but unfulfilled” is measurable: every name in the block fails TLS with an expired certificate (since June 2025) while certificate renewals for those same names continue in 2026 elsewhere.

What is still unknown, and the next measurements

• Who the registrant is. A paid privacy-free registry lookup, or the registrar’s records, would be needed; the project will not buy them.
• Why ARIN has no ASN record while the ASN has been announced for five years, and whether the announcement is authorised. ARIN’s own inbox is the authority; the project does not write to it.
• Whether the newer certificates are deployed on hosts elsewhere: a TLS handshake against each name from a second vantage point would show it.
• What the application does. It needs JavaScript; the project reads headers and certificates, not scripts.

Addendum: the follow-up investigation — 2026-09-11

The registrant, and what each route costs

The public record stops at a privacy service: the registrar’s own whois shows Registrant Organization: Domains By Proxy, LLC, Registrant Name “Registration Private”, 100 S. Mill Ave, Suite 1600 — GoDaddy’s proxy. The registration is locked, prepaid to 2029-03-07, and the registrant is not published.

Prices move; they should be checked before spending anything. The free route was the productive one.

The operators, named by their own documents

Three named operators behind one domain across twenty-four years. The registrant of record today is still hidden, but the operators are public because they published their own legal notices.

What the application is, and why it looks dead

• The site is a Vue single-page application (chunk-vendors, app.js, Bootstrap and core-js inside). Its only data sources are three feed URLs, https://feed.ology.com/feed/<topic>/latest.jsonl for politics feeds, and a link to ology.substack.com. No websockets, no analytics identifiers, no other endpoints: nothing is hidden in the client.
• The feed times out. A request to feed.ology.com/feed/politics-mainstream/latest.jsonl returns nothing after 35 seconds, so the application waits for data that never arrives. That is the whole of “the site does not work”.
• The named services are configured and unhappy: feed, list, link, and api answer 400 at the root, beacon answers 403, archive answers 500. Names of that shape — feed, list, beacon, link — are a publishing stack: content feeds, a mailing list, open tracking, and click tracking.
• The publication moved to Substack: Public Square Networks, by Ology Newswire, launched five years ago, with two posts, June and July 2021, and nothing since.

The timeline the evidence supports

2021: the venture starts — Substack posts in June and July, the ASN’s first announcement in October. 2021-2025: the stack runs, on rented hosts in more than one place, with per-name certificates. May-June 2025: those certificates lapse and are not replaced on these hosts. 2026: still reachable, still paid for (the registration runs to 2029), still broken.

The port-knock hypothesis, tested as far as it can be

The idea: meaningful behaviour might require hitting several addresses in a particular order with particular keys. What the evidence says:

• The key in this stack is the name, not a sequence. Addressed by IP, every address gives the same 301 and the same expired certificate; addressed by name, the services answer differently (400, 403, 500) and present their own certificates. Whatever is selective here is selected by Host/SNI.
• No state changed under our probing. Three passes over the same addresses (two 21 minutes apart, one later) gave byte-identical answers; nothing changed after other addresses had been touched. A knock sequence that latches a door would have to be a sequence we did not guess — but it would also have to leave no trace in any of those passes.
• What could still be tested: ordered probes with distinctive markers, comparing a given address’s answer before and after a chosen sequence; longer observation over days, to catch a schedule; endpoint enumeration on the named services (public paths only). What cannot be tested is the space of sequences and keys, which is unbounded — so a negative result would be weak evidence and a positive one would be accidental.

Assessment: nothing in the client, the services, or the certificates is shaped like a covert channel, and the mundane reading now has a name, a timeline, and a business. The genuinely unexplained part has narrowed to paperwork: an ASN and a block of address space in daily use since 2021 that no registry admits to knowing about.

Addendum 2: the registrant’s company, the block’s shape, and the cost — 2026-09-11

A correction first

The first addendum said ARIN held no record of the ASN or the organization. That was wrong, and the fault was the tool: the port-43 whois client returns “No match found” for the organization handle ON-70 and for AS400050, while ARIN’s own REST API serves the organization record. The earlier control tests (AS15169, AS16509 and several ASNs in the same 32-bit block resolved) showed the client worked for those, which made the absence look real. It was not.

What ARIN does and does not hold, checked through the REST API:

• An organization record exists: handle ON-70, name “Ology Newswire, Inc.”, PO Box 834, Monticello, Indiana 47901, registered 2021-09-10, last changed 2022-01-14, with the remarks https://ology.com, Virtual Public Square, Ology Newswire, Inc.
• No network object exists for these addresses: an address in the answering range resolves to ARIN’s own parent NET-23-0-0-0-0 (NET23, 23.0.0.0/8), while a neighbouring /24 that ARIN allocated in 2024 does have its own object (23.191.152.0/24, holder “TBNETWORK”). The addresses are in ARIN’s space, unassigned, and ARIN’s registry says so.

So the picture is not “no records anywhere”. It is: a registered company, with a registered organization handle, using unassigned space inside ARIN’s own legacy /8.

Why so many addresses: the block’s shape

The block is 3,840 addresses — fifteen /24s — and it is not a CIDR. That shape is the answer, and it is an artifact of history rather than a choice:

• Across all ARIN records, 3.3 per cent are not CIDRs. Inside 23.0.0.0/8, 2,573 of 6,094 records — 42 per cent — are not CIDRs. The /8 is dominated by pre-CIDR assignments, where a holder received “fifteen class C networks” rather than a prefix.
• The block sits among others of the same kind: 23.191.130.0 (1,536), 23.191.137.0 (3,840), 23.191.153.0 (5,888), all reserved, none a CIDR, none with a date or country — legacy holes in ARIN’s own space.
• Around them ARIN is still allocating: 23.191.136.0/24 (2024-10-10) and 23.191.152.0/24 (2024-10-11) went out to holders in the last two years.

The size was never the operator’s decision. There is no sign they asked for 2,048 addresses, and no sign they need them: the announced set is eight of the fifteen /24s, one per site they run. The block is a legacy hole, not a statement of scale — which also removes the block’s size as evidence for any scheme that would need many addresses.

The company, from free registries

• Indiana corporation: OLOGY NEWSWIRE, INC., entity 202108261519136, registered 2021-08-26 (city-data’s rendering of the Indiana business registry). A PO Box in Monticello, Indiana.
• ARIN organization ON-70: registered 2021-09-10, three weeks later, two weeks before the ASN’s first announcement on 2021-10-21. The sequence is a company being set up: incorporate, get a registry handle, announce.
• The earlier operators were funded: Ology Media, Inc. shows a 2010 Series A (Crunchbase), and in May 2012 it launched an Android app with Zumobi, announced by press release.

What it costs to keep this alive

Estimates from public price lists; treat them as an order of magnitude, and check current pricing before relying on any of them.

Over five years the infrastructure is plausibly $5,000-20,000, plus whatever the founder’s time was worth. The point of the estimate is not the precision: it is that the floor is tiny. A prepaid domain, a registry handle nobody bills, unassigned legacy space, and a couple of small VMs is a few tens of dollars a month — which is exactly how an abandoned startup’s infrastructure stays reachable for five years without anyone noticing or caring.

The promotion footprint

The written intent is explicit in the launch posts: a decentralized publishing network — “Public Square Networks implement free speech in the American sense, providing each publisher with a means of establishing identity, attaching verified political status to that identity if desired, and publishing into one or more networks”, with “global identity and content addressing” that survives any single service. The name on the ARIN record, “Virtual Public Square”, is the same idea in three words.

The audience was never there: the manifesto post shows single-digit reactions, and the Substack has published nothing since July 2021. That is the “aspirational but unfulfilled” reading, in the founder’s own words, with dates.

Note for completeness: a WordPress plugin named “Virtual Public Square” appears in search results and is unrelated to this company.

What this leaves

The anomaly has shrunk to one sentence: a small, registered, apparently abandoned publishing venture runs its last hosts on unassigned address space inside ARIN’s own legacy /8, announced by an ASN whose organization record exists but whose network record does not. Everything else — the size of the block, the spread of hosts, the dead feed, the expired certificates, the tiny bills — is now ordinary, and the ordinary reading has names, dates, and prices attached.

Addendum 3: whose domain this is, and how many owners it has had — 2026-09-11

The owner asked, of the 2002 registration date: “Could this be singular ownership, with different attempts over the years? Or is there evidence this changed ownership to different humans?”

Neither reading survives on its own. The registration is continuous; the ownership is not. The 2002 date is the record’s age, not one party’s tenure: ology.com had a life before it, went quiet, and was registered again in 2002 by a Texas IT consultancy. The operators since 1998 are mutually unrelated.

The owners, era by era

Three unrelated parties have held this name since 1998: an Internet provider in Rhode Island, an IT consultancy in Dallas, and a media startup in New York. Each handoff between them shows up as an interval in which the domain served nothing at all — a registrar placeholder and a lapsed registration for the first, a GoDaddy parking page for the second.

The 2002 date is a registration date, not a tenure

• The Internet Archive holds ology.com from 1998 and 1999 as Brainiac’s site, and in 2000 as a myinternet.com member placeholder — that is, the earlier registration was sitting unused at a registrar.
• The registrar’s record gives a creation date of 2002-05-02. A domain that lapsed and was registered again takes the new date, so the earlier registration ended and this one began: the 1998 party is not the 2002 party.
• Between 2005-08-23 (OLOGY, LLC’s last capture, still selling IT services) and 2007-06-16 (a GoDaddy parking page) the domain stopped being used by anyone. That seam is where the IT consultancy’s tenure ends.
• The media property appears on 2008-12-19, so the domain passed from the consultancy (or from whoever held it after) to the media company inside a window the archive does not fill.

The one human who does span the modern era

There is a single thread through the last decade of this domain, and it is not a founder’s:

So the modern chain is one technologist’s continuing project wearing three corporate names: the New York media company he was VP of Technology at, the Indiana publishing LLC that followed it, and the Indiana corporation that holds the ARIN handle today. The 2021-07 dates are the tell — the engineer’s move, the ARIN contact registration, the GitHub organization, and the incorporation all fall within about ten weeks, while the domain, the feeds and the Substack carry on across the change.

A correction to the first addendum

The first addendum’s table said NewPress, LLC named the legal pages from “2012”. That span was too wide, and it came from my own tooling: when a requested snapshot does not exist the Internet Archive silently serves the nearest one, so my “2015” reads of the terms and privacy pages were really 2013 and 2019 pages. Reading the captures by the timestamp the archive actually served gives the bounded version used above: Ology Media, Inc. on 2012-03-15 and 2013-01-14, NewPress, LLC from 2018-08-22 onward, and nothing in between that names either company. The changeover therefore sits in an interval the archive does not illuminate, and the first addendum should not have implied a date for it.

What this changes about the anomaly, and what it does not

• It strengthens the ordinary reading. A twenty-four-year-old registration, a technologist who has run several publishing attempts on it since 2013, and a venture whose own manifesto posts drew single-digit reactions is a plain story about persistence, not a cover story. The address space in ARIN’s reserved /8 is then one of those attempts rather than a stranger’s.
• It does not explain the one remaining oddity: that the space is unassigned in ARIN’s own legacy /8 and announced by an ASN with no network record. Ownership history says who; it does not say why the space, or why the feeds time out while the hosts still answer.
• It raises the standing of the “different attempts” reading of the register: the same operator has put a blog, a social network, an ad-supported content site and a signed-article network on this name. A party that iterates in public on one domain is a plausible party to be running one more experiment on unassigned space.

What is still unknown

Every personal name in this addendum comes from a source its subject published or sat for — a conference biography and a registry contact field for the current operator, a press interview and a fundraising profile for the earlier chief executive. The résumé is cited by address rather than by name, because its author is a former employee rather than a principal, and no private contact details are reproduced anywhere here. Nothing in this ownership history suggests wrongdoing on anyone’s part, and the finding does not change the characterization of site A: an ordinary operator, on an ordinary budget, on an address range that is not ordinary at all.

Addendum 4: what the hidden-purpose pass added — 2026-09-12

The owner asked whether the site is a cover, and that pass is written up separately in records/04-ology-hidden-purpose.md. Two of its findings belong here, because they correct this record’s emphasis rather than the cover question:

• The domain’s public DNS is not served from the block. The delegated nameservers are AWS Route 53; ns1.ology.com (23.191.145.2) and ns2.ology.com (23.191.147.3) are ordinary A records inside the reserved range that still answer authoritatively from a stale copy of the zone, SOA serial 20240501 (2024-05-01), in which id.ology.com still points at the block and archive.ology.com does not exist. The migration to Route 53 happened around May 2024 and the old pair was never turned off. A forgotten authoritative copy of a live domain inside unassigned ARIN space is reachable by anyone who asks it directly, and is worth recording as a security curiosity in its own right.
• The operation is maintained but not healthy. Certificate Transparency shows automated issuance through 2026-09-03, and ns1 presents a certificate issued 2026-07-30, but every other sampled host in the eight announced /24s still presents the ology.com certificate that expired 2025-05-31, and ns2 presents one that expired 2026-08-30. Issuance is current; the web tier’s deployment has been frozen since March 2025.

This record’s earlier language about an “abandoned deployment” should be read with that correction: the web fleet is frozen, the operation is not entirely dormant.

Commits

• 7613baf docs: follow the registrant and the application behind site A
• cdb2589 docs: the registrant’s company, the block’s shape, and the cost
• a6a3b99 docs: three owners and one technologist behind ology.com