TI-2026-022D โ โThe Russian Handโ
How Russian operators extend control across borders through RIPE maintainer chains, Kazakhstan shell ASNs, and Ukrainian front companies.
Executive Summary: The public story of internet ownership is simple: an ASN belongs to a company, a company belongs to a jurisdiction, and a jurisdiction gives investigators a place to start. The forensic story is uglier. In this dossier, control does not sit where the paperwork says it sits. It sits in RIPE maintainer objects, in contact fields reused across countries, in routing patterns that drift toward Russia while legal wrappers point elsewhere, and in attack telemetry that ties those wrappers to live abuse infrastructure.
The central figure is Vorozhtsov Igor of Novosibirsk, a named controller behind protonserv-mnt, created on 2019-02-01. Through that maintainer, the records connect to FOP Dmytro Nedilskyi in Ukraine, to TOV E-RISHENNYA, and to the four-country IP 185.156.73.233 โ an address that appears Dutch by geolocation, Russian by BGP country, Dutch by RDAP, and Ukrainian by ASN registration. Around it sits a broader ecosystem: ISAEV Igor, SOLDATOV Alexey Valerevich, Bashinskii Vadim Ruslanovich, and the reusable Russian maintainer ru-avm-1-mnt, all exhibiting the same operational trick: Kazakhstan paperwork, Russian route gravity, Western-facing geography.
The claim here is narrow and evidence-driven: cross-border control is being exercised through administrative objects that most abuse workflows barely inspect. This dossier does not need a theory of Kremlin command to make its point. It only needs the records, the route paths, the names, the reuse, and the telemetry. Together they show a durable pattern: ownership is being laundered through maintenance rights.
Chapter 1: The Maintainer
The first mistake most investigators make is to look at the company name before they look at the maintainer. That is backwards. In the RIPE world, the company name is public theater; the maintainer is operational power. It is the object that can update routes, edit registration fields, and keep a networkโs administrative skin alive after the underlying story has changed. If you want to know who truly holds the wheel, you do not begin with the logo. You begin with who can edit the records.
This is why protonserv-mnt matters. On paper, one can see Ukrainian entities and European-looking registrations. In control-plane terms, the decisive question is simpler: who maintains the objects? Our record set places Vorozhtsov Igor behind protonserv-mnt, created on 2019-02-01. The maintainer then appears as the quiet bridge between Russian contact gravity and Ukrainian-facing registration. The bridge is not hypothetical. It is encoded into the administrative object model itself.
That model has a structural weakness: RIPE maintainer objects do not verify beneficial ownership in the way financial compliance departments like to imagine. They verify the right to operate the object, not the social truth of who ultimately benefits. That distinction is everything. It means a Russian operator can sit behind a maintainer touching a Ukrainian sole proprietor, a Ukrainian LLC, or a Kazakhstan-registered individual without any field ever plainly saying: โcontrol rests here.โ The power is present. It is merely written in the wrong part of the record for most people to notice.
| Layer | What the public sees | What the maintainer reveals |
|---|---|---|
| Legal wrapper | Company or individual in one jurisdiction | May be editable by an actor elsewhere |
| ASN registration | National story attached to a number | May conceal cross-border admin control |
| Abuse handling | Email alias, form field, registrar contact | Often reuses the same operator ecosystem |
| Operational truth | Rarely obvious from one field | Emerges from maintainer reuse |
Chapter 2: The Novosibirsk Connection
Novosibirsk appears here not as scenery but as administrative gravity. Vorozhtsov Igor is not an abstract actor. He has a phone number, +79139052140, an email, vigorv@mail.ru, and a named association with protonserv-mnt. He is the kind of operator who should not be easy to miss, and yet the architecture around him is built precisely to keep attention one layer away from him. The paperwork offers other jurisdictions to stare at while Novosibirsk keeps the administrative key.
Actor Card โ Vorozhtsov Igor
Location: Novosibirsk, Russia
Contact: +79139052140 ยท vigorv@mail.ru
Control object: protonserv-mnt
Associated fronts: FOP Dmytro Nedilskyi (AS211736), TOV E-RISHENNYA
Lead telemetry IP: 185.156.73.233 ยท 39 hits ยท threat score 78 ยท abuse score 100
Shared indicator: abuse email abusepwnx@gmail.com reused across multiple networks
The honeypot data tightens the case. The lead address associated with this corridor, 185.156.73.233, is not just administratively strange. It is operationally dirty: 39 honeypot hits, threat score 78, and abuse score 100. Even more important, it does not stand alone. Entity-link analysis ties it by shared HASSH to 77.90.185.17 in Lithuania and 80.94.95.118 in Romania. That means the Novosibirsk story is not only about paperwork. It is about a toolset, an operator fingerprint, and a regional pattern of movement.
Novosibirsk matters for another reason. It also sits inside the wider ecosystem around ru-avm-1-mnt, the Proton66 lineage, and Russian operational clusters already visible elsewhere in this series. Separate names. Separate ASN wrappers. Same city orbit. The question becomes unavoidable: how many times does Novosibirsk have to appear before it stops being background and starts being the center of gravity? The dossier does not need to exaggerate. The repetition does the work.
- Vorozhtsov is tied to
protonserv-mnt. protonserv-mntcontrols objects attached to Ukrainian-facing entities.- The lead IP tied to this chain is high-abuse and active in honeypot telemetry.
- The same IP shares HASSH lineage with Lithuanian and Romanian nodes.
- The contact pattern overlaps broader Novosibirsk-centered abuse infrastructure.
Chapter 3: The Ukrainian Front
Once the Novosibirsk controller is visible, the Ukrainian entities stop looking like endpoints and start looking like instruments. FOP Dmytro Nedilskyi, tied to AS211736, and TOV E-RISHENNYA do not appear in this record as self-contained Ukrainian infrastructure stories. They appear as controlled legal surfaces โ wrappers through which Russian administrative influence can act without presenting itself under a Russian label at the decisive point of first inspection.
This matters because a sole proprietor in Ukraine carries a different risk profile in public imagination than a Russian operator in Siberia. It sounds smaller. More local. More accidental. It also diffuses immediate geopolitical suspicion. A Ukrainian front can absorb attention precisely because it appears to live inside the victim geography rather than outside it. But the maintainer chain says otherwise. If the object authority runs through the Russian side, then the Ukrainian story is incomplete by design.
| Entity | Visible role | Observed control significance |
|---|---|---|
| FOP Dmytro Nedilskyi | Ukrainian sole proprietor / AS211736 | Acts as a legal face for infrastructure with Russian maintainer gravity |
| TOV E-RISHENNYA | Ukrainian LLC | Appears inside same Russian-linked control environment |
| protonserv-mnt | Administrative object | The bridge that ties Ukrainian wrappers back to Russian control |
The uncomfortable question is not whether Ukrainians can own infrastructure. Of course they can. The uncomfortable question is whether war, sanctions, and political shock have created a cover layer in which a Ukrainian registration can function as anti-suspicion camouflage for actors operating from Russia. That possibility is not rhetorical flourish. It is precisely what the maintainer system permits when beneficial ownership is not directly verified and cross-border administrative rights remain technically valid.
Chapter 4: The Four-Country IP
If this dossier needed one exhibit to survive on its own, it would be 185.156.73.233. It is the sort of address that turns theory into something embarrassingly concrete. By geolocation, it appears in the Netherlands. By BGP country, it appears in Russia. By RDAP, it appears again in the Netherlands. By ASN registration, it belongs to a Ukrainian framework. One IP. Four sovereign stories. One abuse trail.
In a clean world, one of these layers would dominate the others. In the corridor world, none of them does. Each layer is useful for a different institutional audience. The Dutch face soothes platform heuristics and commercial trust. The Russian route gravity tells a deeper network story. The Ukrainian wrapper offers a politically disarming administrative shell. The result is not confusion by accident. It is jurisdictional arbitrage by architecture.
| Attribution Layer | Country | What it offers the operator |
|---|---|---|
| Geolocation | NL | Western-facing normality |
| BGP origin country | RU | Underlying route gravity |
| RDAP | NL | Administrative respectability |
| ASN registration | UA | Alternative legal face |
| Telemetry | Abusive | Operational truth |
Lead Host Profile โ 185.156.73.233
Threat score: 78
Abuse score: 100
Honeypot hits: 39
Entity links: Shared HASSH with 77.90.185.17 (Lithuania) and 80.94.95.118 (Romania)
Interpretation: Not an isolated anomaly; part of a corridor-shaped operator cluster.
Why does this matter so much? Because every enforcement regime starts by asking where something is. The corridor answers: โWhich version of where do you want?โ That is the real service being sold. Not just bandwidth. Not just address space. Plausible multiplicity. An IP that can be Dutch in one workflow, Russian in another, and Ukrainian in a third is not merely miscataloged. It is politically buffered.
Chapter 5: The Brand Parasite
Names matter because trust is lazy. protonserv is not Proton AG, and no evidence in this dossier suggests any connection to ProtonVPN or the Swiss company behind the Proton brand. That is precisely why the name is useful. It sits close enough to a globally recognized privacy brand to harvest ambient legitimacy without ever having to state the lie outright. This is not identity theft in the strict legal sense. It is brand parasitism.
The trick works because internet infrastructure operates inside half-attentive ecosystems. Analysts skim. Abuse desks pattern-match. Customers glance at a name and move on. A string like protonserv benefits from that cognitive shortcut. It whispers privacy, VPN culture, European respectability, and technical competence โ all before anyone asks what the maintainer actually controls or who sits behind it in Novosibirsk.
There is a second layer to the name. In an era of VPN crackdowns, โprivacy infrastructureโ has market value even for actors who are not privacy providers at all. If a Russian operator needs offshore access while domestic control tightens, a name that smells like privacy technology performs a useful softening function. It makes the infrastructure look like part of the solution rather than part of the problem.
- The maintainer string uses the โprotonservโ naming pattern.
- No documentary basis links it to Proton AG.
- The brand resemblance nonetheless imports a privacy-adjacent aura.
- The aura sits on infrastructure tied to abusive telemetry and cross-border opacity.
Chapter 6: The Kazakhstan Trick
Once you see the pattern, Kazakhstan stops looking incidental. ISAEV Igor appears through AS200730. SOLDATOV Alexey Valerevich appears through AS209702. Bashinskii Vadim Ruslanovich appears through AS216473. Another echo appears in AS210352 through Partner LLC. Each presents some version of the same geometry: Kazakhstan registration, Russian routing gravity, Western-facing geolocation or RDAP surfaces.
This is not because Kazakhstan is exotic. It is because it is useful. It lives inside the RIPE service region while remaining politically and administratively distinct from Russia. It provides jurisdictional distance without leaving the familiar registry neighborhood. It can host natural persons or front companies that are administratively plausible but operationally detached from where the route gravity points.
| Actor / ASN | Registration face | Observed route / geography pattern |
|---|---|---|
| ISAEV ยท AS200730 | Kazakhstan individual registration | PL geo / RU BGP / PL RDAP across 8 DB IPs |
| SOLDATOV ยท AS209702 | Kazakhstan registration | NL or BG geo / RU BGP / NL RDAP |
| Bashinskii ยท AS216473 | Kazakhstan wrapper | Maintainer adjacency inside same ecosystem |
| Partner LLC ยท AS210352 | Separate legal surface | Same maintainer pattern reappears |
The point of the Kazakhstan trick is not to hide from deep investigation. Deep investigation can still follow the thread. The point is to survive shallow investigation โ the kind that powers most compliance, most automated trust decisions, and most first-response abuse handling. Kazakhstan is far enough from Russia to dilute suspicion, near enough to the Russian technical ecosystem to remain convenient, and ordinary enough not to invite automatic escalation.
Chapter 7: The 4,136-Hit Machine
If Chapter 6 described the shell, Chapter 7 describes the machine inside it. 87.251.64.176, tied to the ISAEV ecosystem, delivered 4,136 honeypot hits and the highest activity count in this cluster. Numbers alone do not prove sophistication. What matters is the behavioral profile: repeated authentication pressure, relentless presence, and enough persistence to mark the address as infrastructure rather than opportunism.
The cross-layer identity of the machine fits the corridor pattern perfectly. Across the database, ISAEV-linked IPs tend to present as Poland by geolocation, Russia by BGP country, and Poland by RDAP. That means the box can appear locally European while inheriting Russian route gravity underneath. For anyone looking only at map labels, it reads like generic Eastern-European noise. For anyone reading the full chain, it looks like a deliberately buffered attack node.
Host Profile โ 87.251.64.176
ASN: AS200730
Observed pattern: PL geo / RU BGP / PL RDAP
Activity: 4,136 honeypot hits
Threat score: 99
Significance: Highest activity IP in the ISAEV set; operational center of gravity for the Kazakhstan shell pattern.
What does such a machine do socially? It normalizes itself. High-volume abusive infrastructure survives by becoming one more familiar nuisance among many. That is what makes its registration pattern so important. The operator is not trying to look invisible. The operator is trying to look boringly deniable. Poland on the surface. Russia underneath. Kazakhstan on paper. One exhausted abuse desk after another in the middle.
Chapter 8: The Novosibirsk-Warsaw Pipeline
Put the pieces together and a geographic corridor starts to emerge: administrative control in Novosibirsk, registration distance through Kazakhstan or Ukraine, and Western-facing physical presentation through Poland, the Netherlands, or neighboring European surfaces. This is not a literal fiber route. It is an ownership and narrative route โ a pipeline for transforming Russian operator gravity into something that can circulate internationally with less immediate scrutiny.
Poland matters here because it is practical. It is close enough to the Russian operational orbit to be commercially reachable, European enough to calm outsiders, and common enough in abuse data to avoid standing out. That same role can be played by Dutch registry surfaces or Lithuanian and Romanian cluster nodes when needed. The corridor does not require one perfect destination. It requires a set of plausible European faces downstream from Russian control.
| Origin | Buffer Layer | European face | Operational benefit |
|---|---|---|---|
| Novosibirsk | Kazakhstan / Ukraine | Poland | Russian control with EU-looking presence |
| Novosibirsk | Ukrainian wrapper | Netherlands | Higher trust registry surface |
| Russian maintainer chain | RIPE-valid objects | Lithuania / Romania nodes | Distributed operator cluster |
The phrase โWarsaw pipelineโ is forensic shorthand, not an accusation against a city. The point is that corridors function through intermediate places that are credible enough to absorb the first shock of scrutiny. What enters the system as Russian control exits the system as something more negotiable: Polish-looking, Dutch-looking, European enough, and administratively denser than any single investigator wants to untangle in real time.
Chapter 9: The Sovereign Internet Paradox
To understand why Russian operators would want these offshore-looking corridors, one must step outside the abuse database and back into state policy. Since the 2019 Sovereign Internet law, Russia has expanded the installation of TSPU filtering equipment and deepened Roskomnadzorโs practical influence over traffic handling. By 2026, the national architecture of control is not speculative. It is documented by researchers at DGAP, the Carnegie Endowment, and reporting such as Zona Media. The domestic internet is increasingly governable from above.
That creates a paradox. The Russian state wants routing leverage, content filtering capacity, and tighter control over domestic connectivity. Russian operators, meanwhile, still need access to unrestricted markets, foreign payment surfaces, internationally acceptable infrastructure stories, and routes that are not visibly trapped inside the domestic compliance cage. So the stateโs push for control does not extinguish evasion markets. It creates demand for them.
This is why privacy-smelling brands, foreign maintainer chains, and Kazakh or Ukrainian wrappers become more than criminal improvisation. They become tools in a broader adaptation market. An operator who wants offshore maneuverability without openly severing from Russian gravity has to buy ambiguity somewhere. The corridor sells exactly that ambiguity.
Chapter 10: The Formation-Agent Pattern
By now the dossier has named three administrative archetypes: protonserv-mnt, ru-avm-1-mnt, and the GCS LLP environment with GCS-MNT and ru-quasar-1-mnt. They do not share one universal legal wrapper. What they share is more important: operational DNA. Every one of them converts a politically awkward origin into a more portable surface through some combination of nominee entities, obscure maintainers, route-side indirection, and country disagreement.
The GCS LLP case proves the scale this can reach. A UK LLP at Haverfordwest fronts 25 IPs in our database across 12+ countries, while all of them still show cymru_country=RU. The estate announces 237 prefixes, roughly 64,000 IPs, with 96% RPKI ROA coverage. That is not chaos. That is disciplined infrastructure. It is the grown-up version of the same trick: one face for trust, another for operation, a third for paperwork, and a fourth for routing reality.
| Pattern element | protonserv-mnt | ru-avm-1-mnt | GCS / ru-quasar-1-mnt |
|---|---|---|---|
| Cross-border wrapper | Ukraine | Kazakhstan | UK LLP + Seychelles + Russian PSC |
| Russian route gravity | Yes | Yes | Yes |
| Western-facing geo/RDAP surface | Yes | Yes | Yes |
| Abuse telemetry | High | Very high | Distributed, multi-country |
| Visible beneficial ownership | Weak | Weak | Layered and diluted |
Formation agents and administrative intermediaries are not always sinister. But in this family of cases they function as stability providers for deniability. The shell survives because someone specializes in keeping it legible enough for the registry and vague enough for everyone else. That is the common service across the corridor ecosystem: not bandwidth, but plausible paperwork.
Chapter 11: The Invisible Ownership
After the 2022 invasion of Ukraine, some expected internet registries to make political choices about Russian resources. RIPE NCC did not revoke Russian resources. The stated reason was technical neutrality. That principle sounds civilized until one asks what it means in a world where technical objects are themselves instruments of cross-border political evasion. Neutrality toward the object can become indulgence toward the structure behind it.
This dossier is not arguing that RIPE should collapse into sanctions enforcement by whim. It is arguing something narrower: the current object model cannot see beneficial control clearly enough to defend its own neutrality claims. When a Russian operator can maintain foreign-facing infrastructure through Kazakhstan individuals, Ukrainian fronts, UK LLP wrappers, or Seychelles members, โwe only manage technical resourcesโ stops sounding neutral and starts sounding administratively blind.
The Crimea precedent makes this harder to dismiss. Since 2014, Russia has shown willingness to re-route and politically absorb connectivity where strategic interests demand it. The lesson is not that every abusive corridor is state-run. The lesson is that internet governance no longer has the luxury of pretending that routing identity and political control live in separate worlds. They do not.
- Registry objects verify operational authority, not beneficial control.
- Cross-border wrappers exploit that distinction.
- High-abuse infrastructure can present through politically safer jurisdictions.
- Neutrality toward the object preserves opacity for the operator.
- Enforcement and journalism inherit the same blind spot.
Chapter 12: The Signal
What does all this teach? Not that one Russian operator is especially clever. Not that one registry is uniquely compromised. The deeper lesson is that internet governance still treats control as if it were local, singular, and transparently declared. It is not. Control can be administrative without being legal, legal without being beneficial, beneficial without being visible, and visible only through repeated discrepancies that no one institution is tasked to combine.
The corridor series started with the map. This installment supplies the hand. A Russian operator in Novosibirsk. Kazakhstan individual registrations. Ukrainian front entities. Western-facing geo and RDAP surfaces. A screamingly active attack node in ISAEV space. A much larger UK/Seychelles/Russian GCS pattern showing the same DNA at scale. The pattern is no longer subtle. The only subtle part is how long institutions can keep pretending they are looking at isolated cases.
In the end, โThe Russian Handโ is not a slogan. It is a method. Put control in the maintainer. Put liability in the wrapper. Put legitimacy in the geography. Put abuse at the edge. Then wait for every downstream system to select the version of the truth it finds most convenient. That is how foreign infrastructure becomes controllable without ever looking formally conquered.