🧱 The cleanest possible building, full of rooms nobody will name

World Host Group is not a shell. That is what makes it interesting. It is a genuine, private-capital-backed roll-up — thirty-odd acquired hosting brands, some 700,000 customers, a chief executive with a real name (Sebastian de Lemos), balance-sheet backing from Oakley Capital and Equivia Partners, and a UK company number you can pull up in seconds (14644356). When A2 Hosting became hosting.com in 2025, this was the machine behind the rebrand. By every conventional measure it is the respectable end of the industry.

And yet its autonomous system, AS14670, is country-plastic. Point at one of its addresses and ask the question five ways and you get five answers: a US customer geofeed, a GB corporate registry, a BGP origin flickering between the United Arab Emirates, South Africa and Britain, a Netherlands/US RDAP contact, and a block of addresses that wears the shape of Latin America. The same finger, the same instant, five jurisdictions. The corporation is real. The geography is improvised.

💸 Follow the indirection: IPXO, AbuseRadar, and the tenant called 'Private Customer'

Here is the machinery that makes abuse frictionless without anyone obviously committing it. Several of these addresses carry the RDAP organisation 'Private Customer' and route their abuse complaints to report@abuseradar.com — AbuseRadar being the dedicated complaints desk operated for IPXO, the largest IPv4 leasing marketplace. The chain is elegant: a real holder leases dormant address space; an operator rents it; the complaint travels to a neutral third-party desk; and the actual tenant disappears behind the words 'Private Customer.' Each layer is individually defensible. Stacked, they are a laundry.

IPXO's own co-founder said the quiet part in an industry post: in a single quarter of 2022 the platform handled more than 22,000 IP-abuse incidents. That is the scale of the byproduct. And riding this leased, redacted, third-party-desked address space was a single scanner identity — one shared SSH fingerprint (libssh2_1.11.0, HASSH 14b2ddda…) seen across 671 machines in 50 countries, hammering root with a blank password 24,239 times. The most damning detail is almost funny: many of the attacking hosts carry 25 unpatched CVEs of their own. The censors of the internet's doors had left their own wide open.

🏛️ The Official Scaffolding — Institutional Anchors

Nothing at this scale operates without anchors in official structures — Regional Internet Registries, company registrars, state telecoms, regulators, financiers, carriers, and law enforcement. These are the documented anchors (sourced). The inferred ones live in the conspiratorial section below.

WHG is the most heavily institutionalised actor in the whole investigation, and that is the unsettling part. It is anchored in the UK Companies House and accredited as a RIPE NCC LIR; its brands sit in the ICANN registrar ecosystem; its money is regulated — Oakley Capital (overseen by Luxembourg's CSSF, present on the London market) and Equivia Partners are the documented backers. The leasing layer, IPXO, is a UK-registered company embedded in ARIN and RIPE abuse-policy discourse through co-founder Vincentas Grinius, with complaints outsourced to AbuseRadar / Internet Utilities. Even the transit is blue-chip: upstream Arelion (AS1299) carries the heritage of Telia and the backing of Swedish public-pension capital (Polhem Infra). Every anchor is real, regulated, and respectable. The abuse rides on top of all of it.

🎯 Actors & Entities

🌐 Infrastructure & Indicators (IOCs)

Threat = composite 0–100 score from honeypot activity + multi-source enrichment.

🔎 Findings

🕳️ The Conspiratorial Read — Questions & Calibrated Answers

Each answer states what the evidence supports and labels where a claim is unproven. Questions are instruments: they pry loose the partial truths the flat record hides.

🔗 Linked Dossiers

• TI-020A — master thesis
• TI-019K "The Quadrant" — w1n Ltd — UK shell variant of the same arbitrage
• TI-020F — Western clouds + M247 — sibling respectable-front cases
• TI-020D — Omegatech also appears in the WHG/offshore overlap

📎 Sources & Evidence Chain (23 items)

Every claim above is anchored to a primary source. Full machine-readable evidence in Postgres dossier_intel (investigation 019M).