Foilhat

Registry

Cluster stats

Netblocks	7
All fragments	8 blocks across 2 clusters
Cluster ID	206070000
Registry	PEERINGDB
Customers	find customers using this network →

Evidence & provenance ?

Attribution	Registry record
Shared handles	clustered on 4 shared RIR contact/maintainer handles
Registry names	2 distinct registrant names across these blocks
full provenance (JSON) → · how attribution works

Footprint over time

4 weekly snapshots · JSON

7 0 netblocks since 2026-07-05

2026-07-05 peak 7 2026-07-13

IP Ranges (7)

⬇ export CSV

CIDR	Org name	Registry	Status	Confidence
185.1.215.16/32	Foilhat	PEERINGDB	ASSIGNED	● high
193.110.12.150/32	Foilhat	PEERINGDB	ASSIGNED	● high
193.110.13.150/32	Foilhat	PEERINGDB	ASSIGNED	● high
2001:7f8:21:9::150/128	Foilhat	PEERINGDB	ASSIGNED	● high
2001:7f8:21:10::150/128	Foilhat	PEERINGDB	ASSIGNED	● high
2001:7f8:117::2:1485:1/128	Foilhat	PEERINGDB	ASSIGNED	● high
2a0a:3500::/32	FOILHAT-SE	RIPE	ASSIGNED	● low

Possibly related to this organisation

what's this?

Same name family

Separately-registered clusters whose names share “Foilhat” — often per-country or per-system registrations of the same brand, occasionally a different organisation sharing the name. Not counted in this organisation's own footprint.

FOILHAT-ANYCAST 1 blocks

Sub-allocations under carriers

IP blocks an ISP reassigned to a similarly-named customer — decoded from the ISP's own naming convention, not a direct registration.

FOILHAT-ANYCAST via IP Excess AB sub-allocation

Network trust

what's this?

RPKI hygiene: F how networks compare →

14.3% of checked blocks have valid RPKI ROA coverage (1 of 7)

Possible discrepancies (1)

These blocks are registered to Foilhat but cryptographically authorized for a different, unrelated network (1 distinct holder) — often M&A history, multi-homing, or outsourced/managed hosting, occasionally worth a closer look.

2a0a:3500::/32 /32

authorized for AS21485 — IP Excess AB

NIC Handles

AS21485 DUMY-RIPE DUMY-RIPE MNT-FOILHAT