Skip to content

What is visible from outside

An operator's internet footprint can be characterized without scanning it: resolve its public domain and find out, from the routing records (BGP), which autonomous system that presence lives in. It is a question of structural hygiene: does the operator run its own address space, or does its public presence sit on a foreign cloud, a telco, or a registrar?

Classification of 21 operators by the holder of the autonomous system hosting their public presence. Source: public DNS resolution and RIPEstat (BGP). The IP is used to resolve the autonomous system and then discarded: it is not published.

Where the sector lives

Only 3 of the 21 operators surveyed host their public presence in their own Argentine address space. The rest split between foreign cloud, mostly Amazon and Microsoft, CDN or hosting, and local telcos. Leaning on a large cloud outsources part of the perimeter to whoever has the scale to hold it; the cost is that it leaves the sector's presence concentrated in a few providers, so a problem in one of them, or in its supply chain, touches several operators at once.

It is also the layer where one slip turns the map into a target list, so what gets published keeps, per operator, only the autonomous system, its holder, and the hosting classification: no IP, no host, no port. The pipeline check fails the build if one appears.

Exposed industrial ports: the missing sub-layer

One question stays unanswered, and it is the most uncomfortable one: how many industrial control devices (Modbus, DNP3, S7) in the country are exposed to the internet. Counting hosts with port 502 open gives an inflated number. In Argentina, what answers on that port is usually a MikroTik router, a VPN concentrator, or a mislabeled web server: of 29 hosts swept by hand with 502 open, not one spoke Modbus.

The count that works filters by the detected protocol rather than the port, and that data, on both Shodan and Censys, sits behind a paid plan. So the sub-layer stays declared and not shown.

The same infrastructure, at night

Critical facilities and large power plants over the VIIRS Black Marble composite (NASA GIBS). Where a point falls on light, there is activity observable from orbit. Light source: NASA GIBS. Facility source: public coordinates and generation datasets.

A node map says where things are; the satellite says which ones are operating, without asking anyone. The contrast shows: the thermal plants around Buenos Aires and the refineries along the La Plata axis fall on the bright metropolitan patch, while the Añelo hub appears as a constellation of points deep in the Neuquén desert, the signature of flaring and field activity where no city explains it. It is the principle actividad.podeley.ar applies to track drilling in Vaca Muerta.

For an attack-surface analysis, that light confirms a facility is a live asset and not a row in a stale database. An attacker doing reconnaissance crosses exactly that, and today does it from a browser: what the attacker correlates for free, the operator has to assume is already correlated.

Where this reading fails

  • The network classification reflects the hosting of the public web front end, which may sit behind a CDN different from the rest of the infrastructure, and may resolve differently on another day. The sample is 21 operators chosen for relevance, not the sector's universe.
  • "Own infrastructure" does not mean "more secure" or "less": it means the operator controls its own address space. The risk reading depends on how it manages it, which this does not observe.
  • A pipeline, a transmission corridor, or an unattended station emits no light and does not appear in the night composite. Absence of light says nothing about absence of infrastructure.
  • The Black Marble composite is an annual reference, not last night's image, and it mixes energy activity with urban lighting. Separating one from the other takes the per-pixel radiance processing of actividad.podeley.ar, which is not redone here.

The system, what happened to it, and what is visible of it are all in. What remains is who responds when any of this occurs.