🧭 The Discovery

The path was forensic and linear. The honeypot first saw ISAEV-space abuse: one IP in the /24 was a one-shot reconnaissance node, another was a relentless credential validator, and the whole block carried the now-familiar disagreement between registry country, routing origin, and geolocation. The paperwork said Kazakhstan. Team Cymru pointed to Russia. Abuse geolocation and physical hosting kept landing in Poland. That discrepancy was the parent clue.

1. Honeypot flags 87.251.64.176 and adjacent ISAEV-space activity
2. Geo-discrepancy emerges: registry KZ, routing RU, abuse/hosting PL
3. RIPE routing history for 87.251.64.0/24 reveals five ASN generations with the same block surviving the deaths
4. The maintainer ru-avm-1-mnt persists across the Panchenko era and the ISAEV era
5. Passive DNS on 87.251.64.146 lands on Torzon, Abacus, DrugHub, and Kerberos bridges
6. Parallel enrichment of Omegatech exposes a Seychelles shell, Spamhaus DROP status, Virtualine branding, and Pfcloud transit
7. The Seychelles corporate pattern cross-connects back to the consecutive-shell logic already documented in TI-2026-022A

This is the whole path in one sentence: honeypot scanner → country contradiction → RIPE route history → persistent Russian maintainer → darknet bridge IP → offshore corporate wrapper → DROP-listed transit hub.

Sources: threat_intel DB; TI-2026-019M synthesis; TI-2026-024 report sections 1–5; RIPE whois for 87.251.64.0/24; Spamhaus DROP.

🧼 ISAEV Igor — The IP Laundering Chain

The core ISAEV finding is not merely that the ASN is abusive. It is that the address block is older than the current legal mask and has outlived multiple burnt ASN wrappers. That is the opposite of hijacking. Hijacking steals space suddenly. This block was walked through successive dead shells over years while the same operational seam stayed visible in the RIPE objects.

The INETNUM was created on 19 Sep 2021 — the Panchenko phase — and the mnt-by stack still includes ru-avm-1-mnt. That is the continuity. The name on the door changes. The address block does not. The maintainer does not. The abuse logic does not.

This is IP laundering: preserve the usable asset, retire the burnt ASN wrapper, re-emerge under a new natural person, and keep the registry paperwork just respectable enough to delay automated distrust. The chain is not accidental because the persistence is not accidental.

Sources: RIPEstat routing-history for 87.251.64.0/24; RIPE whois for 87.251.64.0/24; TI-2026-024 finding “IP Space Laundering: 5 Dead ASNs in 5 Years”.

🧷 The Panchenko Connection

AS48080 is the pivot that changes this from generic abuse to lineage. The chain does not jump from anonymous dead wrappers straight into ISAEV. It passes through Dmitriy Panchenko, a named Russian-linked operator already sitting in the middle generation of the same /24. That matters because Panchenko is not an incidental one-off occupant. He is the bridge between the older shells and the present one.

The same maintainer seam — ru-avm-1-mnt — persists across Panchenko and ISAEV. The current ASN also lists a fallback/peer relationship with AS212835 / Shesternin Vladimir Anatolievich, another Kazakhstan-registered individual whose sponsorship and maintenance still touch the same Russian administrative world. One Kazakh-named front could be coincidence. A repeated KZ individual + RU maintainer / sponsor pattern is not.

The provenance implication is blunt: ISAEV did not acquire a clean block. He inherited a worked criminal corridor. The current /24 sits downstream of a Panchenko generation that is already part of the laundering timeline. Whether ISAEV is the operator, the brokered nominee, or the latest liability sink, the ancestry of the address space is already contaminated and operationally meaningful.

Sources: RIPEstat AS overview for AS48080 and AS212835; cluster-isaev institutional-anchor notes; TI-2026-024 actors/connections.

🌑 Darknet Market Bridges

Passive DNS tied 87.251.64.146 to clearnet domains branded for Torzon Market, Abacus Market, DrugHub Market, and Kerberos Market. Those are not random keywords. They are the brand names of post-2023 darknet markets that filled the vacuum left by successive law-enforcement operations. The most conservative reading is still severe: ISAEV space hosted live market bridges or mirrors.

Then the honeypot adds a second layer. The same IP, 87.251.64.146, logged into the honeypot once with admin:admin and ran a reconnaissance chain that enumerated kernel, hostname, architecture, listening ports, writable paths, package managers, and potential tunneling tools. This was not a random spray node. It was a machine that probed post-auth operating conditions while its passive-DNS footprint pointed at darknet-market access infrastructure.

Whether the clearnet names were official bridges, mirror hosts, or criminally adjacent clones, the effect is the same: our honeypot was touched by the same /24 that exposed live access points into the darknet-market economy.

Sources: TI-2026-024 evidence “Darknet Market Domains on 87.251.64.146”; threat_intel honeypot_sessions and honeypot_commands; TI-2026-019M synthesis.

🏝️ OMEGATECH LTD — The Seychelles Shell

Omegatech is the offshore version of the same strategy. The RIPE and Spamhaus layer says AS202412 / OMEGATECH-AS. The jurisdictional layer says Seychelles. The abuse mailbox says abuse@omegatech.sc. The domain layer says Dynadot privacy shield. The operational layer says Virtualine, not Omegatech. The transit layer says Pfcloud. The result is a structure where every layer answers a different question and none of them answers all of them.

The infrastructure is materially larger than ISAEV: 20 announced /24s, including 158.94.208.0/22, 178.16.52.0/22, and 91.92.240.0/22. Within it, multiple organizational masks appear: Omegatech LTD itself, WEBNETWORK-MNT (Ukrainian pitline ecosystem), and Virtualine Technologies as the RDAP-facing label on at least one German IP.

This is not a single company. It is a shell stack: Seychelles for opacity, GB branding for legitimacy, Chinese registrar gravity in the domain layer, and German transit to keep packets moving.

Sources: RIPE whois AS202412; Spamhaus ASN-DROP for AS202412; WHOIS for omegatech.sc and virtualine.org; TI-2026-024 findings/evidence.

🇨🇳 The China Connection

The cleanest documented Chinese anchor is not a shareholder filing. It is the domain chain. virtualine.org — the identity Spamhaus assigns to both AS202412 and AS214940 — is registered through CNOBIN INFORMATION TECHNOLOGY LIMITED. The same domain resolves behind Cloudflare, emits a dead hosting-panel page — "Sorry, Please confirm that this domain name has been bound to your website" — and still sits at the center of the brand layer used to identify two DROP-listed ASNs.

That gives two possibilities, both bad. Either CNOBIN is merely the registrar and the Chinese layer is clerical rather than operational; or CNOBIN is closer to the beneficial-ownership chain than the shells want to admit. The second is unproven. The first is still revealing, because even the registrar path keeps returning us to a Chinese commercial infrastructure layer while the legal wrapper presents as Seychelles and the operational identity presents as British.

The right inference is not “Chinese state operation.” There is no evidence for that. The right inference is narrower and harder: a bulletproof host serving European abuse and darknet-adjacent infrastructure felt the need for a Seychelles shell, a UK-facing identity, and a Chinese registrar layer at the same time. That is not simplification. That is deliberate compartmentalization.

Sources: WHOIS for virtualine.org; Spamhaus ASN-DROP entries for AS202412 and AS214940; TI-2026-024 report section 2.3.

🚇 Pfcloud UG — The Transit Hub

If ISAEV shows what laundering looks like at the /24 scale, Pfcloud UG shows what enabling looks like at the ecosystem scale. AS51396 is not just another upstream. It is a convergence point for multiple Spamhaus DROP-listed ASNs: Omegatech, KPROHOST, VPSDEDICATED, TECHTIES, STEALTHVM, SWISSNET, STORMINDUSTRIES and more. Its own upstream, AS49581 / Tube-Hosting, is also DROP-listed. The stack is recursive.

Pfcloud is where respectable routing stops pretending not to notice. This is the single point where much of the worst traffic in this slice of European bulletproof hosting converges before it fans back out into shells, mirrors, malware subnets, and scanner estates.

Sources: RIPEstat ASN neighbours for AS51396; Spamhaus ASN-DROP; TI-2026-024 evidence “Pfcloud UG — Bulletproof Transit Hub”.

📊 The IP Census

These are the key infrastructure IPs carried into the investigation record across both operations. Every row combines public attribution with direct honeypot telemetry.

The pattern is stark: almost all successful access is disposable-default validation, not artisanal intrusion. These hosts are optimized for scale — proving which doors open, not lingering behind them. The exceptions matter precisely because they are rare: 87.251.64.146 did not just validate. It looked around. That makes it more operationally interesting than its volume suggests.

Sources: threat_intel tables ips, honeypot_sessions, honeypot_credentials, honeypot_commands; TI-2026-024 infrastructure.json.

📛 Spamhaus Analysis

Omegatech (AS202412) is directly on Spamhaus ASN-DROP. So are Pfcloud (AS51396), KPROHOST (AS214940), Tube-Hosting (AS49581), and WEBNETWORK's wider pitline ecosystem. The DROP tag means the global filtering community has already crossed the threshold from “this is suspicious” to “this should not be routed or peered.”

ISAEV is the more interesting edge-case. Public DROP pulls confirm AS202412, AS51396, and AS214940, but not AS200730. Yet the individual IPs in the ISAEV /24 are already abuse-burnt, show 100/100 AbuseIPDB scoring on the main nodes, and were described in the investigation chain as Spamhaus-relevant at the SBL/IP level. That means the laundering logic may be working exactly as intended: rotate the shell faster than the broadest ASN-level distrust can fully congeal, while the IPs themselves are already toxic.

How do these networks continue operating? Because global distrust is uneven. Spamhaus can tell the world not to peer a network. It cannot revoke the RIPE object. It cannot dissolve the Seychelles shell. It cannot force a transit provider to stop pretending. Filtering communities can describe the fire. They cannot compel the landlord to turn off the gas.

Sources: Spamhaus asndrop.json; threat_intel enrichment for ISAEV/Omegatech IPs; TI-2026-024 report section 1.5 and evidence set.

🏝️ The Seychelles Pattern

Seychelles keeps surfacing not because it is exotic, but because it is useful. In TI-2026-022A, two corporate members of a UK LLP — LUPINE LOGISTICS LTD and LS TRADING PARTNERS INC — appeared at the same Sound & Vision House, Francis Rachel Street, Victoria, Mahe address with consecutive IBC numbers 215807 and 215808. That was a shell fabrication signature: same-day formation, same agent, same opacity function.

Omegatech reproduces the grammar even where the exact registered-agent address differs in public traces. The operation presents as a Seychelles company, hides its domain ownership behind privacy, projects a GB-facing Virtualine identity to Spamhaus, and lets the useful technical layers happen elsewhere. Previous research checkpoints tied Omegatech to another Seychelles virtual-office pattern — House of Francis, Room 303, Île du Port, Mahé — reinforcing the broader point: these are not substantive island businesses. They are secrecy sockets.

The pattern is stable even when the street address changes: use Seychelles to absorb ownership questions, use Europe to absorb routing traffic, use some other layer to absorb the real beneficial-owner question. TI-2026-022 showed consecutive shells feeding a UK wrapper for Iranian routing. TI-2026-024 shows a Seychelles shell feeding a UK-facing bulletproof brand for darknet infrastructure.

Sources: TI-2026-022A article and evidence; session checkpoint on TI-2026-010; TI-2026-024 report section 4; WHOIS/Spamhaus layers for Omegatech/Virtualine.

❓ Conspiratorial Questions

👁️ Read Between the Lines

🧪 Methodology

🔗 Sources & Evidence Chain

Editorial note: the public lead asserting a clean UK Companies House wrapper for “Virtualine Technologies Limited” did not resolve cleanly in this pass; the cited company number 14735849 currently resolves to CLICKSO LIMITED, not a visible Virtualine entity. That disagreement is itself a finding: the UK-facing wrapper is unstable, stale, renamed, or deliberately muddy.