Summary

Three edits, three different kinds of change

The first thing to establish is what each edit actually was, because the three are not the same kind of event.

The ROA is a cryptographic authorisation. The signed object for 185.136.15.0/24, published in the RIPE RPKI repository, declares that AS210328 is the legitimate origin for that prefix at maximum length /24, with a validity window starting 20 August 2026 06:30:28 UTC and ending 1 July 2027 https://console.rpki-client.org/rpki.ripe.net/repository/DEFAULT/fd/4e9414-bc4d-4f2c-b9f1-23f0c04d2c17/1/E442yFoubLa9bbHQX2sPzSASVTE.roa.html. Its observable effect is validation state: today, per-prefix validation for origin AS210328 shows 77.91.65.0/24 VALID, 185.136.15.0/24 VALID, and 185.218.138.0/24 NOT-FOUND https://records.ping.pe/210328. (Not all mirrors agree on these counts — one reports 1 valid and 1 invalid over 2 sampled prefixes — which is itself a caution about relying on any single validation snapshot https://iptrace.net/en/as/210328%5D.) The ROA makes RPKI-valid routing possible; it does not create routing.

The route object created the same day, 2026-08-20T06:19:29Z, records the intention that AS210328 originate 185.136.15.0/24 https://ipregistry.co/AS210328/185.136.15.0/24. Route objects are registry text, not routing. Notably, an earlier route object for the same prefix with origin AS205997 had been created in April 2026, and both carry the same maintainer. The prefix itself is registered to third parties under the same maintainer — mirror views conflict on whether its current netname is "Vlad-Cojuhari" (last-modified 2026-04-18) or "SOLUTIONS-FACTORY-NET" (dates from 2017) https://whois.ipip.net/AS210328/185.136.15.0/24.

The aut-num policy change is the clearest administrative rewrite. The current object, last-modified 2026-08-21T04:38:32Z, imports from AS48693 and announces to AS48693 https://whois.ipip.net/AS210328. Stale mirrors preserve the older generation: as-name ALMAZCLOUD, with import from AS12695 (CJSC Digital Network), dated December 2021 and later copies showing an org-object modification of December 2022 https://robtex.com/en/as-numbers/AS210328 https://ip.cc/topic/asn/AS210328/. So the formal transit relationship on record moved from one small operator to another — AS48693, Rices Privately owned enterprise, a Ukrainian network of roughly 2,560 IPv4 addresses — at some point culminating in the 21 August 2026 edit.

What the routing table says happened

The observable routing picture, as of the latest snapshots, is unchanged in shape. Hurricane Electric's view shows 3 prefixes originated, 2 announced, 0 IPv6, 2 RPKI-valid, 512 IPv4 addresses, 717 observed AS paths, and average path length 5.319, with exactly three neighbours: AS202425 (IP Volume inc), AS201814 (MEVSPACE sp. z o.o.) and AS48693 https://bgp.he.net/AS210328. RIPEstat's own view, stamped around 30 September 2026, shows the two announced prefixes — 77.91.65.0/24 (RU) and 185.136.15.0/24 (KZ) — and no expansion https://stat.ripe.net/resource/AS210328.

That means the August edits lined up with the network's de facto state rather than changing it: AS48693 was already an observed neighbour when the policy was formalised, and the ROA covers a prefix already being announced. Nothing retrieved shows a new announcement, a dropped one, or a change in transit structure attributable to the edits.

The May edit remains opaque

The organisation object ORG-ZA238-RIPE (AO ALMAZ, RU, registration number 1196501003357, org-type OTHER) carries last-modified 2026-05-13T06:12:47Z https://whois.ipip.net/AS210328. No retrieved source discloses which attribute changed. Comparison across mirror generations shows the org object has been edited at least twice since 2022 — one stale copy shows a last-modified of 2022-12-01 — so this is ongoing record maintenance, but its content is unverifiable from public mirror coverage alone https://ip.cc/topic/asn/AS210328/.

Verdict: hygiene, not turn-up

On the evidence available, the 2026 ledger edits are record-side and cryptographic maintenance: a new ROA that formalises origin authorisation for an already-announced prefix, a route object recording an already-observed relationship, and an aut-num policy edit that names in writing the transit operator already visible in the routing table. The footprint — two announced /24s, three transit providers, no peers, no downstreams, 512 addresses — is the same before and after. These edits did not turn anything up; they authorised what was already quietly running.

That is a meaningful finding for anyone reading BTW's earlier reporting on the "two clocks" of this network: the ledger's 2026 activity is not evidence of commercial revival. It is evidence that someone is still maintaining the paperwork of a network whose market-facing presence has been frozen since 2022.

Evidence boundaries

Three limits should be stated plainly. First, the specific content of the May 2026 organisation edit is not publicly disclosed by any retrieved source. Second, no before/after proof exists that 185.136.15.0/24 lacked a valid ROA before 20 August 2026; the dated object establishes its current validity window, not its novelty. Third, the absence of a routing-behaviour change rests on collector-dependent snapshots, not continuous monitoring; a brief change between observations would not appear.

Mirror disagreement — on the inetnum's netname, on RPKI validation counts, on peer-versus-transit framing — means every claim above should be read against the specific source cited.

Sources