🪪 A man who may not exist, and a company that barely does

The paperwork says his name is Igor Isaev — on the inetnum object, Isaev Igor Maratovich — and that he lives in Almaty, Kazakhstan. On 20 February 2026 the RIPE registry handed his autonomous system, AS200730, a single block of 256 addresses. Seventeen days earlier, on 3 February, someone had registered the domain that would become his abuse contact, novahost.kz. Visit it today and you find no company. You find the default page Plesk shows before a human has done anything — behind a self-signed certificate that expired on 4 November 2023, years before the domain it secures was even created. It is a storefront with the plastic still on the furniture, and a clock on the wall that runs backwards.

This is what a liability sink looks like. For roughly €130 a year, a registrar called Via-Registry will conjure a fresh autonomous system under a natural person's name — it advertises having done so more than a hundred times. The named individual absorbs the abuse complaints. The operator stays behind the curtain. And the curtain, in this case, is stitched in Russia: the network's maintainer object, ru-avm-1-mnt, belongs to one Aleksei Balalaev of Startovaya 7A, Novosibirsk — the same maintainer that quietly stands behind another Kazakh 'individual' AS, AS212835, registered to a different name entirely. One Russian hand, several Kazakh masks.

🌑 What lives at .146, and what hammers from .176

The block does two jobs, on two addresses, and the division of labour is the whole story. At 87.251.64.146 the passive-DNS record blooms with names that anyone who has read a takedown press release will recognise on sight: torzon4kv5sw….top, abacus….shop, drughub….top, kerberos-darknet.link. Torzon. Abacus. DrugHub. Kerberos. These are not random strings — they are the brand names of darknet drug marketplaces. Abacus vanished in a suspected exit scam in July 2025; DrugHub rose as a successor after the Archetyp marketplace was taken down in June 2025. To find their mirror domains co-resolving on a fresh Kazakh /24 is to find the back door of an economy that the headlines said was being dismantled.

And at 87.251.64.176, the engine room: 4,016 honeypot hits, 3,782 of them successful logins, almost all with the credential admin/admin, each session lasting under a second, and — this is the eerie part — no payload at all. Nothing was installed. Nothing was stolen. The machine logs in, confirms it can, and leaves. That is not burglary; it is a census. Something is methodically validating which doors in the world will open to the most obvious key, building a ledger of access that is itself the product. The honeypot was never the target. It was a tally mark.

🏛️ The Official Scaffolding — Institutional Anchors

Nothing at this scale operates without anchors in official structures — Regional Internet Registries, company registrars, state telecoms, regulators, financiers, carriers, and law enforcement. These are the documented anchors (sourced). The inferred ones live in the conspiratorial section below.

Trace ISAEV's anchors and the 'lone Kazakh' dissolves into a lattice of official bodies. RIPE NCC allocated AS200730; the sponsoring LIR runs through the broker Via-Registry / VIRTUA SYSTEMS SAS in France. The Russian maintainer ru-avm — Aleksei Balalaev's LLC 'STK' — is itself a registered RIPE object. NovaHost.kz is incorporated through KazNIC (registrar ICPS), and its nameservers ride JSC Kazakhtelecom (AS9198), Kazakhstan's state telecom — an official carrier underneath a darknet-adjacent façade. The upstream MEVSPACE peers at IXPs with Cogent, Arelion and Hurricane Electric and is flagged in the Tor Project's ISP guidance; its sibling AS210558 (1337 Services / RDP.sh) carries documented adjacency to Operation Talent, the DOJ/FBI/Europol/BKA action. And the marketplace brands on .146 sit inside an active enforcement field: Archetyp fell to Operation Deep Sentinel (BKA/Europol/Eurojust); the Garantex/Grinex exchange rails were hit by OFAC and DOJ sanctions. The money moves through BitPay, PayPal and the crypto processor Cryptomus.

🎯 Actors & Entities

🌐 Infrastructure & Indicators (IOCs)

Threat = composite 0–100 score from honeypot activity + multi-source enrichment.

🔎 Findings

🕳️ The Conspiratorial Read — Questions & Calibrated Answers

Each answer states what the evidence supports and labels where a claim is unproven. Questions are instruments: they pry loose the partial truths the flat record hides.

🔗 Linked Dossiers

• TI-020A — the master thesis this is a worked example of
• TI-019K "The Quadrant" — w1n Ltd — the UK parallel hosting darknet markets
• TI-020D — Omegatech / Seychelles — the offshore registration end of the same chain

📎 Sources & Evidence Chain (16 items)

Every claim above is anchored to a primary source. Full machine-readable evidence in Postgres dossier_intel (investigation 019M).