Summary

The two-tier picture is now internally consistent. The upper tier — the registration layer around DFINFRA, AS210860 and ORG-EDG14-RIPE — is frozen: the aut-num object was last modified on 27 October 2021 according to mirror records, and AS210860's routing behaviour has been zero-visibility since 26 March 2026 https://ipinfo.io/AS210860. The lower tier — the operational layer — is alive: AS197909 originates nine prefixes (four IPv4, five IPv6), all RPKI-valid, and carries the legacy /15 among them https://bgp.he.net/AS197909.

What this split proves is limited but precise. It proves that routing activity and registration activity have decoupled: the record points one way, the routing table points another, and both are independently observable. It does not prove who controls the address space in any corporate sense — the mirrors themselves disagree on whether ORG-EDG14-RIPE is named EDEKA DIGITAL GmbH or EDEKA Verwaltungs- und Beteiligungs GmbH, and prior BTW coverage documented a 5 August 2025 Hamburg commercial register merger that explains the divergence as one company at two dates https://btw.media/en/governance/rir-watchdog/ripe-ncc/story/dfinfra-as210860-routing-evidence-september-2026. Prior coverage also characterised the /15 estate as corporate, on-premises EDEKA IT services rather than a commercial offering https://btw.media/en/governance/rir-watchdog/ripe-ncc/story/dfinfra-as210860-zero-announced-prefixes.

The operational evidence is unusually clean by routing-watchdog standards. ping.pe reports a single origin for the /15 with no MOAS ambiguity https://records.ping.pe/193.20.0.0/15; Whisper's directory records the prefix as RPKI-valid with a clean MOAS flag https://canon.whisper.security/prefix/193.20.0.0/15; and Hurricane Electric attributes the /15's neighbour prefixes (94.154.2.0/24, 185.240.72.0/22, 193.35.80.0/22) to EDEKA Rechenzentrum Sued Betriebs GmbH alongside the /15 itself https://bgp.he.net/AS197909. A single-origin, single-ROA legacy block routed by one AS across 338 peers is about as unambiguous as public routing evidence gets.

The evidentiary ceiling remains the registry layer. Because the authoritative RIPE endpoint could not be read first-hand in this cycle, statements about as-names, organisation identifiers and modification timestamps are mirror observations with stated retrieval dates — durable enough to establish pattern, not enough to certify current registry state. That limitation is not a reason to discount the finding; it is the finding. A network whose visible reality lives in the routing table while its paperwork sits untouched since 2021 is exactly the kind of divergence that registry-governance analysis exists to catch.