Alpha Strike Labs — the /22 is interleaved, not block-foreign
by shop owners for shop owners.
How the PARC feed for Alpha Strike Labs (AS208843) came about — and why only the per-IP ASN check finds the ~1,700 real IPs: one /22 is interleaved with foreign ASNs address by address, not split block-wise.
Alpha Strike Labs GmbH (Germany) runs an internet-wide security research scanner from its own ASN AS208843. Not an SEO tool. Identified via ASN ownership (BGP/RDAP) — but the catch: one of the two /22 blocks is interleaved with foreign ASNs at the IP level. Only the per-IP check of every single address yields the clean ~1,700 IPs. Part of our PARC Security feed.
alphastrike.json — view feed alphastrike.io →
The needle in the haystack — both ways
We checked every one of the 2,048 addresses in both /22 blocks listed under AS208843 individually for their origin ASN (massdns against Team Cymru, multiple passes). Result:
45.83.64.0/22 1,022 / 1,022 → all AS208843 ✓ clean block
194.187.176.0/24 254 / 254 → all AS208843 ✓
194.187.177.0/24 133 / 254 → rest AS215778/42969 ⚠ interleaved
194.187.178.0/24 119 / 254 → rest AS215778/42969 ⚠ interleaved
194.187.179.0/24 167 / 254 → rest AS215778/42969 ⚠ interleaved
45.83.64.0/22 belongs entirely to Alpha Strike. But 194.187.176.0/22 is not split block-wise — the lower three /24s are interleaved address by address between AS208843 and the foreign AS215778/AS42969. Both naive shortcuts are wrong:
- Take the whole /22 → ~344 foreign IPs in the feed (false positives).
- Drop the whole /24s (what this page said before, based on one sample per /24) → ~419 real Alpha Strike needles lost.
Only a genuine per-IP ASN check gets it right: keep every address that itself announces AS208843.
The result
~1,700 IPs = 45.83.64.0/22 + 194.187.176.0/24 (both fully AS208843) + 419 individual /32 needles in 194.187.177–179. Unlike cloud scanners (rented IPs without their own ASN), Alpha Strike sits on its own registered infrastructure — the ownership proof is solid, but only address by address.