Summary

  • Registry records identify an autonomous-system resource and may contain declared policy, but they do not establish current service continuity.
  • Route collectors measure visibility from particular observation systems; inferred neighbours describe observed path adjacency, not necessarily a commercial relationship.

The operational mistake in reading AS210837 is to turn several partial observations into one complete conclusion. A registry entry can remain present after routing changes. A historical route can remain visible in an archive after a current query returns no qualifying prefixes. A neighbour list can show an adjacency without proving who paid whom, who controlled the underlying links or whether the relationship still exists. Conversely, a blank result from one measurement service can reflect timing, filtering or collector coverage rather than a shutdown.

For a regional Internet operator, that distinction is not academic. The public routing surface is one way to observe how traffic may reach a network, how an upstream relationship may be exposed and where a configuration or administrative change could affect reachability. But it is only an observation surface. It is not the service itself, and it is not a substitute for operator records.

The first layer: what the registry can establish

The RIPE NCC RDAP record and the RIPE Database aut-num record are the administrative starting point for AS210837. They are the appropriate sources for the identity of the number resource, its declared attributes and any associated registration or policy fields. They can establish what the registry says about the object at the time of retrieval. They cannot, by themselves, establish that the organisation is currently originating routes, that customers are being served, or that the declared policy is being realised on the global Internet.

That boundary matters because registry and network operations change on different clocks. A database object may be edited after an operational change, before an operational change or not at all. A last-modified field, where present, is a property of the database record; it is not automatically the timestamp of a service migration, an upstream disconnection or a corporate transfer. The registry therefore answers an identity question: which resource is recorded, under which attributes, and with what administrative history?

It does not answer the continuity question: is the same operating surface still announcing, forwarding and serving traffic?

The distinction is visible in the RIPE NCC RDAP record for AS210837 and the RIPE Database aut-num representation. Those sources should be read as registry evidence, not as a live service-level probe.

The second layer: what collectors can see

RIPEstat’s announced-prefixes, routing-history and routing-status endpoints address a different proposition. They report what the relevant routing-data system observed for the ASN over a query period or at a particular measurement point. The observation may include prefixes, time windows, first-seen or last-seen information, visibility indicators and peer-related measures, depending on the endpoint and response version.

A historical observation is evidence that the ASN was visible to participating collectors during the relevant interval. It is not evidence that every customer could reach the network throughout that interval. Nor does a current absence from one response prove that all announcements stopped everywhere. Collector systems have their own peers, filters, update schedules, aggregation rules and query defaults. Two services can therefore disagree without one of them being wrong about the interval it measured.

This is the mechanism behind the apparent contradiction already associated with AS210837: an earlier routing record reported a material prefix footprint, while a later lookup did not return the same current prefix view. The difference is important because it marks a change or uncertainty in the observable routing surface. It is not, on its own, a finding of shutdown, withdrawal, transfer or continued operation.

The RIPEstat announced-prefixes response, routing-history response and routing-status response should therefore be aligned by retrieval time and effective query window before they are used to make a continuity claim. A result without that temporal alignment is weaker than it appears: it may compare a historical interval with a present snapshot, or a default API window with a separately selected period.

The third layer: adjacency is not a contract

The ASN-neighbours endpoint adds another useful but limited observation. It can identify ASNs that appeared adjacent to AS210837 in collected AS paths and may provide measures of frequency, direction or observed relationship. That is evidence of path adjacency in the collector’s data. It is not automatically evidence of a transit contract, a customer relationship, a settlement-free peering agreement, common ownership or an enduring upstream dependency.

This distinction is operationally consequential. If an observed neighbour disappears, several mechanisms remain possible: the route may no longer be visible to the collector; the path may have changed; filtering may have removed the observation; the ASN may have stopped announcing; or the commercial relationship may have changed. The observation alone does not select among those mechanisms.

The RIPEstat ASN-neighbours response is therefore best treated as an inferred-adjacency layer. It becomes more informative when the same adjacency is persistent across a defined interval, appears across independent collectors and is consistent with declared policy and operator evidence. Even then, the public data describes the path, not the contract behind it.

Why third-party views do not close the gap

BGP.Tools and Cloudflare Radar provide additional routing views, but they do not turn the problem into a single authoritative dashboard. Their collector populations, refresh schedules, classifications, cache behaviour and presentation intervals may differ from RIPE’s. A profile label may be registry-derived. A route count may be assembled from a particular observation set. A page that is empty or unavailable may reflect the service’s data or access path rather than the state of AS210837.

The BGP.Tools AS210837 profile and Cloudflare Radar routing view are useful as independent observation surfaces when their timestamps and methodology are recorded. They should not be treated as independent confirmation merely because they are hosted by different organisations. Independence depends on the underlying measurements, not only on the domain name.

That is the core evidence-chain problem. Multiple interfaces can repeat the same registry-derived identity, while multiple routing products can share related upstream data or differ because they observe different parts of the network. Counting pages is not the same as counting independent measurements.

The continuity test an operator would need

A defensible continuity assessment for AS210837 would begin with a fixed observation window and a clear distinction between the propositions being tested.

First, establish administrative identity: the aut-num object, its associated organisation or contacts where publicly recorded, its status and any relevant change events. Second, establish route visibility: which prefixes were observed, by which system, during which interval, with what first-seen and last-seen boundaries. Third, establish temporal persistence: whether observations recur across the window rather than appearing as isolated records. Fourth, compare inferred adjacency: which AS paths expose the ASN, whether those paths persist across collectors and whether the result is consistent with declared policy.

Fifth, seek operator-side evidence: announcements, maintenance notices, customer records, upstream confirmations or other records that can connect public routing visibility to actual service continuity.

Each step answers a different question. Administrative identity asks what resource is recorded. Route visibility asks what a measurement system saw. Persistence asks whether that observation survives time. Adjacency asks how the ASN appeared in observed paths. Operator evidence asks whether those observations correspond to an operating service.

The test fails if those layers are silently substituted for one another. A registry match cannot replace a route observation. A route observation cannot replace evidence of customer service. A neighbour cannot be promoted into a contractual upstream without corroboration. And a missing current result cannot be promoted into a shutdown finding without an independently supported mechanism.

Where leverage can exist even when continuity is unresolved

Uncertainty about current operation does not mean the resource is irrelevant. A registered ASN and its associated address and routing history can remain part of the region’s risk surface even when the current operating state is unclear. If the ASN later appears in announcements, the ability to originate or influence reachability for those prefixes can matter to customers, upstreams and monitoring systems. A configuration error, route leak or hijack can create consequences that are disproportionate to the visibility of the underlying company.

But the mechanism must be stated precisely. The risk is not that a registry record automatically controls traffic. The risk is that a party with the ability to originate, modify or influence route announcements may affect how other networks select paths to an announced resource. Whether that capability is currently exercised, by whom and under what authorisation requires current routing and operator evidence.

This is also why continuity and control should not be collapsed into one label. A company may retain an administrative association while a network is operated through another arrangement. A route may be originated by an infrastructure partner without proving a transfer of legal ownership. A historical association may remain in public indexes after the operating surface has changed. Each possibility has different consequences for accountability and remediation.

What the current record does not establish

The available public evidence supports a bounded conclusion. AS210837 has an identifiable registry and historical routing evidence, while the relationship between that history and its current operational surface requires careful, time-aligned verification. The evidence does not by itself establish that ROYA Communications has shut down, withdrawn all routes, transferred the ASN, moved its network to another origin or continued unchanged.

That uncertainty is not a weakness to be hidden. It is the result that follows when the measurement layers answer different questions and the operator-side bridge between them is absent. A responsible investigation should preserve the distinction rather than manufacture a definitive status from a convenient empty response.

The next useful observation is not another unqualified lookup. It is a reproducible comparison: save the raw responses, record UTC retrieval time, specify the query interval, compare at least two collector systems, preserve exact prefixes and AS paths, and then seek evidence that connects those observations to the operator’s actual service. Until that chain is complete, the correct description is an unresolved continuity question—not a confirmed outage and not a confirmed continuation. The public RIPE Database search view for AS210837 is available here, while the Cloudflare Radar AS profile is available here; both should be read within their respective data and presentation boundaries.