Blog
Longer answers to the questions a report cannot fit in a panel. What a record can settle, what it cannot, and where a signal that looks decisive is worth less than it appears.
No news and no announcements. Each piece is about a decision somebody is in the middle of, and it names the registries, feeds and prefixes involved rather than talking around them.
-
How to check a subnet's history before you buy or lease it
A transfer updates the registry the same week the money clears. It does not update anything that already decided whether traffic from those addresses is worth trusting. What to check before you commit, in what order, and what each answer is actually worth.
-
Why your newly bought IP range is already blocked
The range went live on a Tuesday. By Wednesday, mail to a customer on Outlook is bouncing, a payment processor is declining signups from three of the addresses, and somebody at a client office cannot reach your endpoint at all. You have held the space for six days. None of it is about anything you did.
-
Telling a hijacked prefix from a legitimate transfer
A prefix that was announced by one network last month is announced by another today. That single fact fits a routine sale between two consenting parties, and it fits a hijack. Nothing visible in the current state separates them. The difference lives entirely in the sequence.
-
How to check if an IP address is a VPN, proxy, or Tor exit
A signup lands from a new country and something has to decide in milliseconds whether the address is a person at home or a rented exit hiding one. The signals that separate a VPN, a proxy, a Tor exit and a plain datacenter address, and why one feed's yes is not the end of it.
-
How to research an ASN: ownership, transit, and the space it announces
An AS number is a network's public identity, and almost everything worth knowing is readable from it: who runs it, what address space it announces, who carries its traffic, and whether any of that has been quietly rearranged. How to read a network end to end, and which parts to trust.
-
How to investigate an IP address: a repeatable method
An address turns up in a log, an alert, or an abuse report, and the pressure is to say something now. A procedure that turns a lead into a finding: what the address is, who routes it, what it has been doing, what changed, and the point where the evidence runs out.