Summary

  • The RIPE registry and RPKI layer for AS210328 show dated 2026 activity: the organisation object ORG-ZA238-RIPE was edited on 2026-05-13, the aut-num routing policy toward AS48693 on 2026-08-21, and two of three prefixes carry live ROAs.
  • The commercial surface shows no movement since 2022: a PeeringDB record last updated 2022-07-27 self-reporting zero prefixes, an unchanged dollar-priced catalog, and routing observation showing a transit-only network with no observed peers or downstreams.

Prior BTW reporting on this subject closed four questions. The identity-chain investigation (4 October 2026) established that no retrieved public document links the DIAMOND brand, the domain, the ASN, the sponsoring LIR and the corporate registry entity into one verifiable chain, and that the OGRN number in the RIPE organisation object maps to a two-employee marine-aquaculture micro-entity in Yuzhno-Sakhalinsk, not to a Moscow interconnection business [13].

Other reports mapped the dependency layer through the sponsoring LIR, measured the 512-address routing footprint, and tested the operator's delivery claims: its own website, DNS and mail could not be located on the address space it sells [14]. This report asks a different question — the temporal one. What has actually changed in AS210328's registry, RPKI and commercial layers through 2026, and what does that drift pattern tell a buyer?

What the ledger shows

The RIPE aut-num object for AS210328 carries a last-modified timestamp of 2026-08-21T04:38:32Z. The edit set the import policy to from AS48693 accept ANY and the export policy to to AS48693 announce AS210328, formalizing a single Ukrainian transit counterpart as the network's only declared routing relationship [6][7]. The organisation object ORG-ZA238-RIPE was itself edited on 2026-05-13T06:12:47Z, and the aut-num remains sponsored by ORG-DNJ1-RIPE — a LIR that operates a different autonomous system [1][6][7].

The RPKI layer shows the same selective activity. The rpki-client validation console lists exactly two ROAs under asID 210328, both from the RIPE repository: one covering 77.91.65.0/24 and one covering 185.136.15.0/24, each with maxLength 24 [5]. ping.pe independently corroborates the resulting validation split: 77.91.65.0/24 VALID, 185.136.15.0/24 VALID, and 185.218.138.0/24 NOT-FOUND — announced but with no covering ROA [4]. Hurricane Electric's BGP toolkit agrees on the same picture: three originated prefixes, two announced, two RPKI-valid, 512 IPv4 addresses in total, no IPv6 originated [1].

These are dated, verifiable administrative acts. Someone edited the routing policy in August 2026. Someone edited the organisation record in May 2026. The RPKI authorizations for two of the three prefixes are live and current. This is not a dead registry entry.

What the storefront shows

The commercial surface tells the opposite story. The almazcloud.network homepage still presents the operator as DIAMOND ("ALMAZ" in Russian), a "brand new progressive cloud services provider", with a five-product catalog priced in dollars: CLOUD CONNECT from $499 per month per physical 10G port, marketed with claimed direct physical peering to Yandex, Sberbank and ROSTELECOM; BGP ANNOUNCEMENTS from $99 per month per prefix; NO-BGP GRE TUNNEL from $99 per month per 100Mbps; CORPORATE CLOUD VPN from $9 per user; and CLOUD RESELLING from $99 per connected cloud [10].

PeeringDB record 19111 — the only first-party, self-entered link between the DIAMOND brand and the ASN in any registry — was last updated on 2022-07-27T05:36:11Z. It self-reports zero IPv4 prefixes and zero IPv6 prefixes, contradicted by live routing observation, alongside a claimed 10-20Gbps traffic level and a "Never via route servers" posture [9]. The record is four years stale against a routing table that shows three announced /24s.

And the routing table itself is static in shape. Hurricane Electric, ping.pe and IPregistry describe a transit-only topology: three upstreams — AS202425 (IP Volume inc), AS201814 (MEVSPACE sp. z o.o.), AS48693 (Rices) — and no observed peers or downstreams [1][4][8]. IPregistry, whose record reflects the 2026-08-21 registry update, states plainly that AS210328 has no direct peering agreements and no downstream networks [8]. The prefixes are registered to third parties, not to AO ALMAZ: 77.91.65.0/24 to IP-FI/Foton Telecom as sub-allocated PA space, and the two 185.x /24s to Vlad Cojuhari [1][4][6][7][8].

Reading the drift

Put the two clocks side by side and the pattern is specific rather than vague. The 2026 activity is concentrated in the asset layer: the routing policy toward the single declared neighbor, the organisation record's metadata, and routing authorizations for two of three prefixes. Nothing in the evidence shows new customers, new peers, new capacity, a PeeringDB refresh, a catalog change, or any service of the operator's own running on its address space.

IPinfo's classification of the ASN as "Inactive" with zero addresses is an outlier against three corroborating routing-observation sources and its own 2021-era update dates, but the corroboration it fails to join is itself telling: no mirror shows market motion [2]. IPregistry also records an assigned-but-unannounced IPv6 /48, 2001:67c:29c::/48, held by AO ALMAZ — further inventory without delivery [8].

The honest reading is ledger tending. Registry and RPKI edits keep an asset administratively clean: policies current, authorizations valid, records consistent. That is consistent with several postures — quiet wholesale operation that leaves no collector-visible footprint, dormancy with good hygiene, or stewardship of address space kept lease- or transfer-ready. It is not consistent with the marketed product: a cloud platform selling 10G physical interconnects, BGP announcement service and corporate VPN would leave a wider, denser and more recent observational trace than three /24s with one formal neighbor and no downstreams.

What each evidence family can and cannot establish

Registry last-modified timestamps prove an edit occurred. They do not reveal who made it or why; a policy change in August 2026 is an administrative fact, not a commercial one. A ROA proves routing-authorization intent, not service delivery; the absence of a ROA on the third prefix proves only that no authorization exists, not that the prefix is unused. PeeringDB and catalog staleness cannot, on this evidence alone, be distinguished between dormancy, quiet operation and asset stewardship. "No observed peers or downstreams" is a collector observation, not proof of nonexistence.

And the identity-chain gap documented on 4 October 2026 still caps the weight any registry edit can carry: an edit inside a chain nobody has closed remains inside an unverified operation.

For buyers of low-cost compute in the AI era, the ordering is practical. Dated registry and RPKI evidence is the most reliable administrative-posture signal: it is cryptographically and procedurally anchored, and its timestamps are meaningful. Mirror snapshots — classification pages, aggregator records — are lower-tier and can be stale or contradictory, as the IPinfo/IPregistry divergence here demonstrates; "no data" in one mirror does not mean absence of a network, and neither mirror substitutes for the routing table. Neither family proves delivery.

Delivery is shown only by live routing toward customers, downstream presence and fulfilled capacity — exactly what the observable record of AS210328 does not show.

The conclusion of this temporal check is therefore neither "live network" nor "dead network." It is a narrower, more useful finding: through 2026, someone is tending the ledger of AS210328 with dated, verifiable edits, while every signal of a functioning market for its services has remained frozen since 2022. Administrative motion and commercial motion are different motions, and in this case they point in different directions.

Sources