Summary

  • RIPE NCC recorded a 3 November 2026 transfer of 46.232.195.0/24, 256 addresses, from BNW TECHNOLOGY LTD to NXLayer Ltd. Exact recipient RDAP registration is stamped 08:03:08 UTC.
  • RIPE RIS already held 337 exact-prefix BGP route entries ending in AS197758 at noon UTC on 2 November, and 338 at 07:00 on transfer day. RIPE RDAP identifies AS197758 as NXLayer’s ASN. The public routing view led the registry receipt.

The route arrived before the receipt. At 12:00 UTC on 2 November, RIPE RIS had 337 BGP-state entries for the exact 46.232.195.0/24, each AS path ending at AS197758. At 07:00 the next morning, it had 338, again with the same origin. RIPE’s transfer list dates BNW TECHNOLOGY LTD’s handover of that /24 to NXLayer Ltd to 3 November. The recipient’s exact RDAP object was registered at 08:03:08 UTC. The observed origin AS is registered to NXLayer. The clocks therefore run in a clear order: NXLayer’s ASN was on the public route view at least twenty hours before the registry created the new /24 object.

That is a more interesting handover than the usual tale of a block changing owner and then appearing on the Internet. The transfer row is narrow: original block 46.232.192.0/21, transferred block 46.232.195.0/24, GB to GB, POLICY and PERMANENT. It records 256 addresses moved, not the full 2,048 in the /21. The transfer export gives a date, while the exact RDAP object gives the 08:03:08 timestamp. The route evidence comes from RIPE’s own RIS BGP-state snapshots. None of these records is a contract or a traffic meter; their strength is that the two public systems can be aligned to the minute without pretending they measure the same thing.

The day-before snapshot is the decisive one. Every one of its 337 route entries targets the exact /24 and ends its AS path in 197758. A second snapshot at 07:00 UTC on 3 November has 338 entries, still all ending in 197758, sixty-three minutes before recipient RDAP registration. RIPE RDAP names that autonomous system NXLAYER and lists NXLayer Ltd as registrant, with the AS object last changed on 7 May 2026. The post-registration query requested for 11:00 returned a 09:59:50 state: 338 exact-prefix entries, again all ending in 197758. This is a before-and-after observation, not a claim about which network moved the bytes at any individual moment.

The address arithmetic is equally revealing. Current RIPE RDAP does not return one surviving /21 allocation. A lookup at 46.232.192.0 yields 46.232.192.0–46.232.194.255, 768 addresses, named UK-XIFOS-20110217 and registered to BNW. The transferred 46.232.195.0–46.232.195.255 is the 256-address NXLayer object UK-NXLAYER-20110217. A lookup at 46.232.196.0 yields 46.232.196.0–46.232.199.255, 1,024 addresses, again under BNW. Those three nonoverlapping records reconstruct all 2,048 addresses in the old /21: 768 with BNW, 256 with NXLayer, 1,024 with BNW. The label UK-XIFOS on the two residual objects is a registration name, not evidence that some Xifos transaction appears in this transfer row.

The cutover timestamps are almost theatrical. The lower residual object is registered at 08:03:07 UTC. The NXLayer /24 and upper residual object are both registered at 08:03:08. RIPE’s database turns one /21 into a three-object 3+1+4 /24 partition across a one-second edge. RIS, meanwhile, already showed the /24’s route under NXLayer’s AS the previous day. Registry publication and route publication are separate clocks, and this case lets a reader see both hands move.

A buyer, operator or auditor looking only at RDAP would date the visible recipient object to 08:03 on 3 November and miss the prior BGP observation. A reader looking only at RIS would see AS197758 and could mistake route origin for proof that the resource transfer had already been registered. The exact transfer row and three current RDAP records fix the resource boundary; the three RIS snapshots fix the observed route origin at stated times. Together they reveal sequence, not the private reason for it. The missing item that would explain why the route preceded registration is an operational or transfer timetable from the parties.

RIPE NCC’s data is unusually good at exposing the mismatch. Its transfer export names the legal movement; RDAP shows the immediate three-piece partition; RIS preserves the earlier route state. The public record is strongest when those clocks are left in order. On 2 November, the route said NXLayer’s ASN. At 08:03 the next day, the registry’s /24 said NXLayer Ltd. The Internet did not wait for the paperwork to tell the same story.

RIPE NCC originals