Summary

  • Three public routing mirrors — bgp.tools, Hurricane Electric's ASN page and Qrator Radar — returned different IPv4 prefix counts and prefix sets for AS209874 when retrieved on 4 October 2026. Each mirror is a projection of the global routing table through its own vantage points and filters, so the disagreement points to inconsistent visibility or route filtering rather than one stable, verifiable announced footprint.
  • The operator's own materials describe NovaCloud-Hosting as a hosting and IP-transit provider run by Tech Tide Portugal Unipessoal LDA, selling dedicated servers, VPS and IP transit. Its ASN site and about page make infrastructure claims, and the IP-transit product page markets transit service without naming specific upstream providers on the captured pages.
  • None of the captured third-party routing records — bgp.tools, bgp.he.net, Qrator Radar or the iamroot.tech ASN database — list an Internet Exchange presence for AS209874, and no PeeringDB record is referenced anywhere in the captured set. For a transit seller, an absent peering footprint is a substantive gap: it suggests the service is delivered through purchased upstream capacity rather than settlement-free interconnection.
  • A routing incident at FFM2 in Frankfurt in July 2026 involving AS209874 drew outside attention to the operator, and BTW's prior coverage focused on the mirror disagreement that followed. This briefing goes one layer deeper: not what the mirrors said, but what the disagreement and the identity gap around the operator reveal about the routing system's accountability surface.
  • Registry and routing records tie AS209874 to the company name Tech Tide Portugal Unipessoal LDA, but no captured source names an individual or resolves the 'novacloud-admin' handle to a verifiable natural person. Customers buying transit from this AS are, in effect, contracting with a handle.
  • The operator is not without hygiene: rpki-client console mirrors (Amsterdam, Frankfurt) show AS209874 publishing ROAs as of 4 October 2026, indicating basic RPKI discipline despite the thin peering footprint.

What the mirrors disagree about

A prefix count is the most basic claim an autonomous system makes about itself: it is the set of address blocks the rest of the internet is asked to route to it. When bgp.tools, Hurricane Electric and Qrator Radar report different counts for the same ASN on the same day, at least one of three things is true: the operator is announcing different sets to different neighbours (selective export), some peers are filtering routes the operator believes are announced, or the mirrors themselves have visibility blind spots. None of the three explanations is benign for a customer. Selective export means reachability depends on which upstream a buyer happens to sit behind. Filtering means some networks may simply not see Novacloud's routes. Blind spots mean the operator's real footprint is unknowable from public data.

The operator's ASN site and product pages do not publish the announced prefix list themselves, so customers cannot independently reconcile the mirrors against the operator's own claim. The datacenter page describes facilities but names no IX ports or peers.

The identity gap

The directory handle under investigation here is 'novacloud-admin' — not a person. The corporate name, Tech Tide Portugal Unipessoal LDA, appears in routing records, but a Unipessoal LDA is a single-member company form in which ownership is concentrated and public visibility of the natural person behind it is limited. Across every captured source, from bgp.tools to Hurricane Electric to the operator's own site and about page, no individual is named as legally or operationally responsible for AS209874. That is not evidence of wrongdoing; it is evidence of how little the routing system requires anyone to say.

Evidence boundaries

This briefing rests on public mirrors and first-party pages captured on 4 October 2026, plus prior BTW coverage of the July 2026 FFM2 incident. Mirror snapshots prove what was displayed at retrieval time, not ground truth in the global routing table. No captured source resolves which mirror count is correct, whether the operator holds any IX ports at all, or who is behind the corporate handle. Those questions remain open, and the honest answer to each is currently: not publicly verifiable.