Summary

  • The published card for Netnod Internet Exchange carries "AP" — the APNIC directory's service-region label — in its headquarters country, headquarters country code and registration jurisdiction fields, from a record imported out of that directory.
  • Everything else the card asserts about legal form, official website and number resources is either a single-directory inference or a citation of the operator's own homepage; the one test that would materially move the question is not a better confidence score but an ASN attributed to the exact legal entity and observed announcing routes.

Read the card at 17:47 UTC on 4 November 2026 and it looks complete. Name, display name, entity type, a source system, a confidence score of 0.82, a legal profile with legal name and legal type, a known role, one modelled resource, an evidence basis, a published status. Nothing is blank where a reader expects a value.

Then read the field labels against the values. Headquarters country: AP. Headquarters country code: AP. Registration jurisdiction: AP. Region: AP. Four different questions — where does this organisation sit, what country is it incorporated in, which legal system governs it, which part of the world does the directory put it in — answered with the same two letters.

Those two letters are not a country. They are the label on a service region at the Asia-Pacific registry, which is where this record came from. A card imported out of that directory has taken the source's own filing label and propagated it across the fields that describe a legal person's domicile. Nobody decided Netnod is headquartered in a region. A value travelled further than the question it answered.

The correct replacement is not in the record, and this article will not guess at it. What can be said precisely is that the card, as published, does not establish a headquarters country or a registration jurisdiction at all. It establishes that a directory filed this name under AP.

What a membership row can prove

Strip the card back and its one modelled resource is a membership: a very-small member of the APNIC directory, resource type registry membership, status observed. That is a real, checkable proposition. A name appeared in a public member listing, at a stated tier, in a stated service area. It is also the whole of the machine-readable substance.

A directory listing of that kind can tell you a name was filed. It cannot tell you where the company is registered, how it is legally constituted, who owns it, which domain it controls, which address space it holds, which routes it announces, whether it operates a peering fabric, or whether it operates a root-server instance. Those are separate questions with separate answers, held by separate institutions.

The card's own published guidance says as much: verify registration and website from official or company-registry sources, map numbers from routing and delegation data before making any footprint claim, and do not call this entity an ISP, a transit provider, a cloud provider or a managed-network operator unless a current public source supports it.

That guidance is sound. It is also an admission that, at the moment of publication, the guidance had not been carried out. The relationships, the inbound and outbound edges, the leadership contacts, the contextual references, the related events: all empty. Nothing wrong with an empty list. Everything wrong with an empty list sitting under a record a reader will read as finished.

Two documents, twenty claims, one source chain

The card's evidence basis holds exactly two documents: a paginated APNIC public member listing and Netnod's own site, cited over plain HTTP rather than HTTPS. Neither was obtained for this article. Five retrieval attempts — capacity refusals, an HTTP 503 whose outcome stayed unknown, a fallback route with no retrieval capability exposed, and a terminal permission error — returned no retained text of either page. That is a limit of this piece, stated once, and not a finding about either document.

Now count the claim layer. Twenty claims sit against this entity. Ten are locale extracts of BTW's own 18 October 2026 briefing about Netnod; ten are backlinks to that same article. Not one of them is a registry extract, an operator filing, a routing observation or an independent measurement of anything the card asserts about legal form, jurisdiction or network identity.

Twenty claims and one source chain. Extracts and backlinks of a single prior BTW piece are not twenty confirmations of a fact; they are one publication, restated in ten languages and filed twice. A reader counting rows would conclude the opposite of what the data supports.

The score problem

0.82 is the most persuasive-looking number on the card and the least defensible. It is stored against a record whose legal form — private company — traces to a single member-directory row, with no constitutive document behind it. No method is published, no scope, no calibration, no statement of which claim the figure scores. It cannot be read as an 82 per cent probability that the legal form is right. It is not a measurement of anything; it is a value assigned during record construction and then displayed with three significant figures.

Meanwhile the website field is empty, and the only domain on the card sits in an alias field. That is the card, in one line, declining to assert an official site. An alias is a lead. It is not a verified channel, and an HTTP-only URL in an evidence basis proves that a string was captured, not who controls the host today.

None of this says the operator is anything other than what it has long said it is. It says the card does not know.

One check that would move the question

Forget a better score. There is exactly one operationally decisive test available to anyone: find a current ASN attributed to the exact legal entity behind this card, then confirm that ASN is originating routes in current BGP data.

A positive result establishes a routed-network identity beyond a membership relationship. That is a substantial upgrade in evidence quality, and it is a short afternoon's work for anyone with registry and looking-glass access. It does not prove payment, exchange-fabric operation or root-server operation — those need their own documents — but it converts the card from a filing into a network.

A negative result leaves the question open, not closed. Operations can run through another legal entity, another identifier or another name. Silence in one register is not absence in the world, and anyone who publishes a negative as a finding will be wrong in public.

Four readers, four different holes

A network engineer deciding whether to connect needs an attributable technical identity and current operational data: an ASN, announced prefixes, a route-server address or a looking glass, all dated. A buyer needs a verified contracting entity, an official contact channel, terms and service evidence established separately from the membership. A regulator needs incorporation, jurisdiction and the authority that actually applies — which four repetitions of AP do not supply. A reader who simply wants to know whether to trust the operator needs current, independent, claim-specific corroboration.

Membership status substitutes for none of these. That is the practical cost of the promotion: a single directory field has been dressed as a general-purpose verdict, and the readers most likely to act on it are the ones with the least time to check.

What the card should do next

The fix is not deletion. It is relabelling, and the record already contains the instructions.

Keep AP attached to the directory's own service region and out of the headquarters, country-code and jurisdiction fields until a company-registry extract replaces it with the registry's own terminology. Promote the alias to a website only when a current, company-controlled, encrypted source establishes the domain, and leave it labelled an alias until then. Publish an as-of date beside every field. State, per field, exactly which document would change it. Invite documentary correction from the operator — and validate it before publishing, because an operator's correction is evidence of a claim, not proof of it.

Then record the update so the correction is auditable instead of invisible.

That is a boring programme, and it is the only one that turns a confident-looking card into a trustworthy one. The alternative is what exists today: a record whose most precise-looking number scores a guess, whose country field holds a region, and whose twenty claims all trace back to a single piece of our own writing.

A card that cannot say which country an organisation is registered in has not yet earned the right to say anything else about it with a decimal point.