🌀 How we found a circle where there should be a chain

The internet's abuse-handling architecture assumes a linear chain: a victim sends a complaint to an abuse desk, the abuse desk contacts the customer, the customer is accountable. This architecture works when the links are independent. It fails — silently, perfectly — when someone collapses the chain into a loop.

We started by asking a prosaic question: who is attacking our honeypot from "Private Customer" IPs, and where do complaints about them go? The RIPE database said: to report@abuseradar.com. Fine. AbuseRadar's own homepage said: "Abuseradar by Internet Utilities" and linked to netutils.io. Also fine, if you stop there.

We didn't stop there. netutils-mnt — the RIPE maintainer — is operated by Internet Utilities LATAM LTD. It maintains the RIPE registrations for the very IP blocks from which the attacks originate. And when we queried passive DNS for 191.101.33.115 — the single most aggressive attacker in the set — it resolved to netutils.io. The attack node and the maintainer's website share the same IPv4 address.

So: the entity that registers the IP, the entity that hosts the website of the maintainer, the entity that handles abuse reports, and the domain to which the IP resolves — are all one thing. A complaint about this IP is a letter written by the victim and delivered to the attacker.

📊 The Attack Census — 30 IPs, 9 ASNs, 6 Countries, Zero Accountability

Full census: 30 IPs. 18/30 (60%) show country discrepancy between at least two independent sources. Δ = disagreement count.

🏛️ The Corporate Chain — From Honeypot to Belize

Five jurisdictions touched by a single IP address. A complaint about 191.101.33.115 would need to pass through UK, Lithuanian, Belizean, and UAE (routing) regulatory channels. No single authority has jurisdiction over the complete chain.

🔑 SSH Key Forensics — The Operator Slipped

SSH key analysis — the strongest attribution signal available (shared keys = same operator) — reveals connections outside the "Private Customer" anonymization layer:

The "gereng" connection is critical: this IP is NOT labeled "Private Customer" — it exists outside IPXO's anonymization perimeter. It is registered to a unique handle on NOCIX (AS33387). This is the operator's name when they forget to hide.

💀 The Incident Response Team That Attacks

Two IPs registered to "IPXO Incident Response Team" on AS14670 generated significant attack traffic:

These are IPs explicitly assigned to the team that handles abuse complaints. They are either compromised (their own IRT infrastructure was taken over) or complicit. Either interpretation indicates systemic failure: either the incident response team cannot secure itself, or it is the incident.

🕳️ The Conspiratorial Read

🏗️ How This Report Was Made

👁️ Read Between the Lines

🔗 Linked Dossiers

• TI-020C "The Roll-Up" — WHG/IPXO overview (the corporate context)
• TI-020A "Cartographers of Nowhere" — master thesis on geo-discrepancy as forensic signal
• TI-019K "The Quadrant" — w1n Ltd — another bulletproof architecture using similar patterns
• TI-021B — The actors: every entity named and anchored
• TI-021C — The pattern: what this teaches about internet trust infrastructure

📎 Sources & Evidence Chain

Full machine-readable evidence in Postgres dossier_intel (investigation DOSSIER-PRIVATE-CUSTOMER-001). 21 evidence items, 7 findings, 8 infrastructure records, 6 connections.