Chapter 1: The Timeline — Revised

Our first analysis in Part A noted that SERVPERSO-MNT was created six months before 1337 Services' RIPE organization, and framed this as suspicious pre-positioning. The deep investigation tells a different story.

SERVPERSO existed as a functional network operation for four years before 1337 Services became a customer. The April 2021 SERVPERSO-MNT creation was a maintainer reorganization within an already-running operation, not the founding of a front company. Two weeks after 1337 Services registered its RIPE org, Sarah Rossius formalized her own LIR status — possibly motivated by needing formal LIR credentials to properly serve 1337 as a customer, or simply coincidental timing.

Chapter 2: Sarah Rossius — The "Silly Smol Meow Meow ASN Maker"

RIPE LIR organization ORG-CR158-RIPE is registered to:

org-name:    Sarah Rossius trading as Servperso Systems
org-type:    LIR
country:     BE
reg-nr:      Not Applicable
address:     Place du marché 31 B22, 4651 Herve, BELGIUM
phone:       +3212860037
remarks:     "--- Silly smol Meow Meow ASN maker since 2019 ---"
remarks:     "ASN SPONSOR / IPv4 & IPv6 / IP Transit (VM/Tunnel/)"
remarks:     website: WWW.SERVPERSO.NET

The registration number is "Not Applicable" — Sarah Rossius operates as an unregistered sole proprietor, common for Belgian individuals below the €25,000 VAT registration threshold or under the activité complémentaire (complementary activity) regime. No Belgian Crossroads Bank for Enterprises (BCE/KBO) registration was found.

The self-description — "Silly smol Meow Meow ASN maker" — places SERVPERSO squarely in the European hobbyist networking community. These are individuals who obtain ASNs for educational purposes, run BGP tunnels, peer at internet exchange points, and provide sponsorship services for others wanting their own ASN. It's a legitimate subculture. And in this case, one of its members provides the IP allocation layer for a bulletproof hosting network.

The phone number (+3212860037) uses Belgian area code 012, corresponding to the Sint-Truiden/Tongeren area in Flemish Limburg — not the Liège province where Battice is located. This suggests a VoIP number, standard practice among technical operators.

Chapter 3: Place du Marché 31, Battice

Battice is a village in the commune of Herve, in the province of Liège, in the French-speaking region of Wallonia. The commune population is approximately 17,000; the village of Battice itself houses roughly 5,000 people. It sits on the N3 national road between Liège and Aachen, about 25 kilometers east of Liège.

Place du Marché — the market square — is the village center. OpenStreetMap confirms building 31 (OSM way ID 633901704, 50.6473°N, 5.8205°E) as a generic building with no commercial classification. The RIPE records use two different unit numbers: "2A" (NOC role SSN105-RIPE) and "B22" (LIR org ORG-CR158-RIPE) — both consistent with an apartment building above ground-floor shops.

This is not a datacenter address. This is not a virtual office. Based on all available evidence, this is Sarah Rossius's home.

Chapter 4: What SERVPERSO Maintains — The Full Picture

SERVPERSO controls two RIPE-allocated /22 blocks (2,048 IPv4 addresses total). Here is how they're divided:

Block 1: 45.154.96.0/22

Block 2: 194.28.96.0/22

Of approximately ten identified clients, 1337 Services GmbH is the only one with abuse indicators. Every other client is a legitimate small ISP, hobbyist network, or infrastructure project. The contamination is precise: one quarter of one /22, one client out of ten.

Chapter 5: The Toxic Quarter

45.154.98.0/24 is the single most concentrated block of criminal infrastructure on AS210558. Our intelligence platform tracks five IPs; reverse DNS reveals 211 PTR records across the full /24.

What the PTR Records Show

This is not speculative abuse. This is verifiable in public DNS. The PTR records themselves document the criminal character of this block: phishing, fraud, anonymization, brand impersonation, hate speech.

The entire /24 is on Spamhaus DROP (SBL687510). DROP is the nuclear option — it tells ISPs worldwide to silently discard all traffic from this prefix at their border routers. Spamhaus applies it when a block is "directly operated by or leased to criminal spam/attack groups."

The Two Notable Tenants

45.154.98.153 — hostname 45.154.98.153.powered.by.rdp.sh. AbuseIPDB: confidence 100%, 289 reports from 155 distinct reporters. Shodan reveals ports 80, 82, 83, 84 (web services), 9100 (Prometheus node_exporter), 9600 (Logstash monitoring). The monitoring stack indicates professionally managed infrastructure — someone is collecting metrics and aggregating logs. 50 OTX pulses list this IP as part of anonymization networks.

45.154.98.33 — hostname tor-exit-1.allium.top. AbuseIPDB: confidence 100%, 150 reports from 79 reporters, flagged as Tor exit. This is a relay operated by the entity investigated in TI-2026-033: the 2cb.li network, run by an anonymous operator using death-themed nicknames across 49+ Tor relays on 17+ ASNs.

A professional DevOps monitoring stack and a death-themed Tor exit relay. Same /24. Same Belgian maintainer.

Chapter 6: The Complicity Question

SERVPERSO's own abuse reporting page at servperso.net/abuse explicitly lists "bulletproof hosting" as a category of abuse complaint they receive. This is not a provider unaware of the problem. This is a provider who has categorized the complaints and continues to maintain the allocation.

There are three ways to interpret this:

1. Economic dependency: 1337 Services is a paying customer whose revenue Sarah Rossius cannot afford to lose. A micro-ISP operating from an apartment in Battice may not have the financial cushion to terminate a client paying for a /24 sub-allocation.
2. Contractual constraint: RIPE NCC policies on sub-allocation revocation may create friction. Once a sub-allocation is made, revoking it requires process — and 1337 Services would likely challenge any revocation.
3. Willful tolerance: The financial benefit outweighs the reputational cost. Bulletproof hosting pays well, and the reputational damage is limited to technical communities that most people never see.

All three may be simultaneously true. None of them constitute a defense.

Chapter 7: The Route Object — Four Parties, Three Countries

The BGP route object for 45.154.98.0/24 via AS210558 has three maintainers:

route:    45.154.98.0/24
origin:   AS210558
mnt-by:   SERVPERSO-MNT         → Belgium (LIR, IP allocation)
mnt-by:   lir-de-1337services-1-MNT  → Germany (client, route management)
mnt-by:   HYBULA-MNT            → Netherlands (hosting/transit)
created:  2022-03-08T22:45:21Z

Hybula B.V. is a Dutch cloud hosting company founded in 2017 that accepts cryptocurrency payments. Their presence as the third maintainer on this route object suggests they provide physical hosting or upstream transit for 1337 Services' infrastructure on this prefix.

The full chain from traffic to accountability:

Any law enforcement investigation of activity on this /24 must coordinate between the anonymous relay operator, the German company, the Belgian sole proprietor, and the Dutch hosting provider. This is not a bug. For the operator, this is the feature.

Chapter 8: The Geo Discrepancy

Our intelligence platform detects a consistent geographic disagreement across all five SERVPERSO-maintained IPs:

BGP says Belgium. Registration says Netherlands. For the two IPs where BGP routes through Belgium (45.154.98.19, 45.154.98.160), traffic may actually transit Belgian infrastructure — possibly through the WIIT Düsseldorf datacenter where SERVPERSO has a presence, or through Belgian peering. The rdp.sh geofeed URL in the RIPE inetnum object attempts to override geolocation databases with custom data — a technique used to manipulate where services like MaxMind place IP addresses.

Chapter 9: What We Now Know, What We Don't

Established Facts

• SERVPERSO is operated by Sarah Rossius, a Belgian individual in Battice/Herve, not a shell company
• SERVPERSO has been active since 2017 with genuine operations, IXP membership, and multiple legitimate clients
• 1337 Services became a customer in late 2021, within an already-established Belgian micro-ISP
• 45.154.98.0/24 was sub-allocated in March 2022 and has been consistently toxic since
• SERVPERSO knows about the abuse — their website categorizes "bulletproof hosting" complaints
• The sub-allocation has survived Operation Talent, hundreds of abuse reports, and Spamhaus DROP listing
• SERVPERSO remains actively maintained as of June 2026

Open Questions

• What is Sarah Rossius's online identity? No social media profiles confirmed beyond @servperso (Twitter, inaccessible). She may operate under a pseudonym in relevant communities.
• What does the client contract say? SERVPERSO's Terms of Service exist as a Belgian French PDF. Do they include an acceptable use policy? Is there a termination clause for abuse?
• What revenue does 1337 Services represent? A /24 sub-allocation's market value is significant — potentially €500-2,000/month. For a sole proprietor operating from a Belgian apartment, this could be substantial income.
• Has RIPE NCC intervened? RIPE's policies allow for mediation in disputes over IP space used for abuse. No RIPE NCC action against SERVPERSO or 1337 Services is publicly documented.
• What role does Hybula B.V. play? The Dutch hosting company's presence on the route object suggests physical infrastructure involvement. The exact nature — transit, colocation, hosting — is unclear.