🧭 Why a contradiction is more honest than a coordinate

Ask three respectable institutions where an attacker lives and you expect one answer. You get three. AbuseIPDB, reading the live behaviour of the address, says one country. Team Cymru, reading the global routing table, says another. The Regional Internet Registry, reading the paperwork, says a third. We were taught to treat that as a data-quality problem — a cell to clean, a value to reconcile, a coordinate to pin. This investigation does the opposite. It treats the disagreement as the truest thing in the record.

Because a coordinate can be bought. A country label is a product now, sold by the same lease marketplaces and shell-formation agents that sell the address itself. What cannot be bought is consistency across three independent observers who answer different questions. When all three diverge, you are not looking at noise. You are looking at the seams of a structure built specifically so that no single authority can say, under oath, where the act occurred. The gap is the fingerprint of intent.

📐 The number that should not be comfortable

Of 7,887 machines that attacked a single home honeypot in a Romanian apartment, 1,351 — better than one in six — could not keep their story straight about which country they were in. And those liars were not the quiet ones. They were 2.1× more aggressive than the honest, geographically-consistent attackers: 26,120 strikes versus 12,255. The machines that obscured their location were the machines that worked the hardest.

Sit with the implied geography. Among those 1,351, registration or routing passed through Seychelles 86 times, Panama 18, the British Virgin Islands 8, Belize 6. The single most common sleight-of-hand was a US-registered address routing out of Singapore (41 times); the second was an Iraqi-registered address surfacing in the United Arab Emirates (39 times). These are not the accidents of a tired router. They are the visible exhaust of an industry whose entire product is distance — legal distance, jurisdictional distance, the distance between a keystroke and a courtroom. The five parts that follow are five ways of buying that distance.

🏛️ The Official Scaffolding — Institutional Anchors

Nothing at this scale operates without anchors in official structures — Regional Internet Registries, company registrars, state telecoms, regulators, financiers, carriers, and law enforcement. These are the documented anchors (sourced). The inferred ones live in the conspiratorial section below.

Step back from the five clusters and a single law appears: nothing at this scale touches the internet without anchoring into official structures. Someone must allocate the addresses — a Regional Internet Registry (RIPE NCC, APNIC, ARIN, AFRINIC). Someone must incorporate the entity — ICANN-accredited registrars, the UK Companies House, Singapore's ACRA, Kazakhstan's KazNIC. Someone must carry the packets — state-heritage backbones and licensed telecoms. Someone must fund it — regulated private equity, listed companies, payment processors. The criminal layer cannot float free; it is bolted, at every load-bearing point, to the legitimate one.

Two anchors cross between clusters and deserve to be named once, loudly. First, money: the private-equity house Oakley Capital backs World Host Group (Part C) and previously owned Contabo (Part F, where KKR took majority control in 2022). One regulated investment firm, regulated by Luxembourg's CSSF and visible on the London market, sits behind hosting in two different clusters of this investigation. Second, governance: the African registry AFRINIC appears twice — behind Cloud Innovation Ltd in Part D and Internet Utilities Africa in Part E — the same contested RIR whose courtroom battles over hoarded IPv4 are themselves a chapter of internet history. And at the outer edge sits law enforcement as gravity: Operation Talent, Operation Deep Sentinel, and OFAC sanctions ring the darknet and crypto-laundering nodes that the offshore clusters quietly touch.

🕳️ The Conspiratorial Read — Questions & Calibrated Answers

Each answer states what the evidence supports and labels where a claim is unproven. Questions are instruments: they pry loose the partial truths the flat record hides.

🔗 Linked Dossiers

• TI-019K "The Quadrant" — w1n Ltd — the archetype five-jurisdiction bulletproof shell this dossier generalizes
• TI-019 "Shadow Nexus" — cloud-weaponization map whose ASNs this dossier quantifies
• TI-020B — ISAEV — offshore-shell architecture, worked example
• TI-020F — Western respectable-front architecture, worked example