๐ TI-2026-021C โ "The Architecture of Impunity" โ What This Tells Us About Internet Trust
๐๏ธ Executive Summary
TI-021A documented the closed loop. TI-021B identified the actors. This part asks the systemic question: what does this structure teach us about the internet's trust architecture?
The answer is uncomfortable: every mechanism designed to prevent abuse was present and functioning. RIPE registration was valid. Abuse-mailbox was responsive. ISO 27001 certification was current. Companies House filings were up to date. And none of it prevented a self-referential abuse loop from operating for at least two years.
The problem is not that controls are absent. The problem is that controls verify form while abuse requires understanding function.
๐งฑ The Five Layers of Compliant Abuse
Layer 1: RIPE Registration Compliance
RIPE NCC requires a functional abuse-mailbox on every inetnum object. report@abuseradar.com passes the automated check โ it accepts mail, it responds with a ticket number. RIPE's system validates that the mailbox exists and responds. It cannot validate that the response means anything. When the abuse desk and the abuser are the same entity, the response is theatre.
Layer 2: ISO 27001 Shield
IPXO holds ISO 27001 certification. This is the gold standard for information security management. But ISO 27001 audits processes โ it confirms that you have a risk register, an incident response plan, a change management process. It does not confirm that your customers are legitimate. A company can be ISO 27001 certified and simultaneously lease IPs to criminal operations, because the certification scope does not include customer vetting.
Layer 3: Jurisdictional Stack
Lithuania (IPXO incorporation) โ UK (WHG hosting) โ Belize (Internet Utilities shell) โ US (physical servers) โ UAE (BGP routing announcement). No single regulator can see the complete picture. Lithuanian authorities see a compliant IP marketplace. UK authorities see a hosting company. Belizean authorities don't look at all. US authorities see individual IP assignments. Each jurisdiction sees a legal fragment.
Layer 4: LIR Privilege
A RIPE Local Internet Registry (LIR) can create and modify inetnum objects, assign IP blocks, and set abuse contacts. This is infrastructure-level trust. IPXO has LIR status. The trust is: "you will manage IP registrations responsibly." The exploit is: you use that trust to register attackers as "Private Customer" and point abuse contacts to yourself.
Layer 5: Programme Committee Access
IPXO's VP serves on the RIPE Programme Committee โ the body that shapes policy discussions. This is not evidence of corruption; many commercial operators participate in RIPE governance. But it means the entity benefiting from policy gaps has institutional access to policy-making. At minimum, this is a conflict of interest that RIPE's framework does not require disclosure of.
๐ The Pattern โ A Template for Abuse Infrastructure
This investigation documents a reproducible architecture. Any actor with sufficient capital can replicate it:
- Obtain LIR status โ requires: membership fee, basic documentation, any company in a RIPE service region
- Create a marketplace โ lease IPs to clients with minimal vetting
- Register clients as "Private Customer" โ RIPE permits anonymized registrations for end-users
- Incorporate shell in opacity jurisdiction โ Belize, Seychelles, BVI, Panama: all offer anonymous IBCs
- Create self-referential abuse desk โ brand it professionally (AbuseRadar), point all abuse-mailbox entries to it
- Host via multiple transit providers โ WHG uses ColoCrossing and Vultr transit, physical servers in US/EU
- Route BGP announcements through neutral ASNs โ announcements geo-located anywhere regardless of physical location
Total cost: ~โฌ50K/year (RIPE LIR fees + Belize IBC maintenance + server hosting). Revenue: uncapped โ bulletproof hosting premium over commodity hosting is typically 5-10x.
๐ณ๏ธ The Conspiratorial Read
โ Why has nobody shut this down if the evidence is this clear?
Because "shut down" requires a specific jurisdiction to act, and no jurisdiction has both the authority and the motivation. Romania (where the honeypot sits) can report but not enforce on Lithuanian/UK/Belizean entities. UK Companies House registers companies but doesn't regulate IP address use. RIPE NCC is a registry, not a regulator โ it administers number resources but has limited enforcement power. Lithuania protects its tech sector. Belize doesn't respond. The structure is designed for exactly this outcome.
โ Is IPXO itself malicious, or is it a platform with bad actors on it?
The evidence does not support declaring IPXO as an intentionally criminal enterprise. However: when your platform's compliance features (Private Customer redaction, self-operated abuse desk, offshore shell managing registrations) function as an end-to-end abuse enablement system โ the distinction between "platform with bad actors" and "platform designed for bad actors" becomes a question of corporate knowledge, not infrastructure design. What we can say: the design is optimized for exactly this use case.
โ What would fixing this actually require?
Three structural changes, none of which are technically difficult: (1) RIPE requires that abuse-mailbox operators be independent of the resource holder โ an organizational separation mandate. (2) ISO 27001 certification scope for IP marketplaces includes customer vetting and abuse-response effectiveness metrics. (3) LIRs face annual audit of anonymized registrations โ "Private Customer" entries sampled for legitimate use. All three are politically difficult because they would reduce revenue for legitimate IP marketplaces alongside abusive ones.
๐๏ธ Read Between the Lines
โก The bigger picture that emerges:
- This is one honeypot in one apartment. If these 30 IPs found us, they found every SSH server on the internet. The scale of the abuse enabled by this structure is not 30 IPs โ it's the entire pool of "Private Customer" registrations across IPXO's 14 million managed addresses.
- You're reading this because one person decided to correlate SSH keys. No commercial threat-intel platform (Recorded Future, CrowdStrike, Mandiant) publishes this level of structural analysis. They sell indicators. We're documenting the architecture that makes indicators insufficient.
- The "compliance" is real and that's the point. This is not a darknet service. It has a website, ISO certification, a VP on industry committees, and Companies House filings. It operates in plain sight precisely because every compliance checkbox is checked. The abuse lives in the gaps between checkboxes.
- RIPE NCC already knows. These IPs have been reported thousands of times by abuse@-automated systems worldwide. Reports go to report@abuseradar.com. Reports are acknowledged. Nothing changes. RIPE's automated compliance checks confirm the mailbox works. The gap between "works" and "effective" is where this structure lives.
- The next dossier series won't be about a honeypot anymore. When you understand the architecture, you can identify every provider using this template. The question stops being "who is attacking us?" and becomes "who is selling impunity?"
๐ Linked Dossiers
- TI-021A "The Nowhere Registry" โ the technical proof of the closed loop
- TI-021B "The Key That Didn't Lie" โ operator attribution via SSH forensics
- TI-020A "Cartographers of Nowhere" โ theoretical framework (geo-discrepancy as forensic signal)
- TI-020C "The Roll-Up" โ WHG/IPXO corporate overview
- TI-019K "The Quadrant" โ w1n Ltd parallel architecture (same pattern, different actors)