📄 TI-2026-024G · Offshore Bulletproof · Part 7 of 8

🪦 The Dead ASN Graveyard: 5 Revoked Networks, Same IP Space

There are prefixes that get hijacked, prefixes that get abandoned, and prefixes that become something stranger: recyclable criminal real estate. The address block at the center of this article — 87.251.64.0/24 — belongs to the third category. It has not merely been abused once and forgotten. It has persisted through years of routing changes, shell turnover, and dead autonomous systems, while the operational smell around it never really went away. The question is not whether one current holder is bad. The question is how the same chunk of address space keeps returning to hostile use under fresh administrative wrappers as if the internet forgets everything the moment an old ASN dies.

The answer begins with a protocol limitation and ends with an institutional one. BGP has no memory. It knows what prefix is announced now, by which origin ASN, and through which path. It does not know that the same /24 was burned two years ago under a different shell. Meanwhile the Regional Internet Registry that allocates the resources is not a law-enforcement body. It processes memberships, fees, transfers, closures, and formal policy rules. If one entity is barred for fraud, that bar applies to that entity. A new legal person can re-enter the system. Between those two facts — protocol amnesia and administrative entity-fragmentation — a dirty prefix can be reborn over and over under a new name.

The Bunea TELECOM / Panchenko / ISAEV chain is a precise illustration of that mechanism. The user’s verified research data and the internal dossier store point to a repeating pattern: Romanian shell entities with eye-catching network names, dead ASNs on Spamhaus ASN-DROP, a Russian operator controlling the prefix in an intermediate phase, and a current Kazakh-registered holder inheriting address space already burdened with abusive ancestry. Public routing history confirms that the prefix moved through a sequence of origin ASNs between 2021 and 2026. The administrative shell changes. The address space persists.

This is why the article is about a graveyard rather than a single offender. Dead ASNs do not stay dead in any meaningful reputational sense. They become fertilizer for the next shell. What looks like churn is actually continuity.

1. One prefix, years of criminal continuity

Most network defenders are taught to think in snapshots: current ASN, current WHOIS object, current feed status, current resolving hosts. That perspective is useful for blocking traffic today. It is insufficient for understanding how bad infrastructure survives over time. The 87.251.64.0/24 case matters because its history is the evidence. Public routing history retrieved from RIPEstat shows the block moving through successive origin ASNs beginning well before the current ISAEV-AS period. Relevant criminal-era stages include AS43624, AS44015, AS48080, a later wrapper in the AS197414 range, a brief transient appearance under AS216473, and the current AS200730. Whether one counts five dead shells before the current holder or five named owners within the wider laundering narrative, the same conclusion holds: the prefix outlives the paperwork.

This is why the title uses the phrase “same IP space.” The significance does not depend on whether every single ASN in the sequence belongs to the same human being or the same company. In fact, the opposite is true. The power of the mechanism comes from discontinuity on paper. If the prefix stayed under one permanent criminal brand, reputation systems and law enforcement would have a stable target. Instead, the address block passes from wrapper to wrapper, each of which can claim to be a new operator, a new customer, a new situation, a new misunderstanding. What survives is the routable real estate itself.

The case becomes even more striking when paired with the Bunea TELECOM triad. AS35478, AS42397, and AS62380 all sit on Spamhaus ASN-DROP and all trace back to the same Romanian SRL. Even where the precise routing epoch of a given block differs, the operational logic is identical: legal shell, globally routable number resource, abuse accumulation, death or deregistration, and replacement by a new wrapper. The prefix history and the Bunea triple-ASN pattern are not separate stories. They are two views of the same industrial method.

That method breaks the intuition many people still have about sanctions-by-reputation. They imagine that once a network is burned, the market excludes it. In reality the exclusion falls on the current visible wrapper. The underlying address space can be reintroduced under another identity almost immediately. That is why the problem is not just one bad ASN. It is the carousel.

The exact chronology matters less than the pattern. No normal, transparent business wants its /24 to read like a cemetery plot register. This one does.

2. The carousel mechanism: dead ASN, returned space, fresh shell

The laundering primitive at work here is simple enough to describe in one sentence: an ASN dies, the visible identity disappears, the number resources or routing control migrate, and the same operational utility returns wearing a new badge. The reason the primitive works is that each institution involved sees only part of the cycle. RIPE sees membership status, resource records, and policy compliance. BGP routers see current announcements. Abuse feeds see current attribution. Hosting customers see present capacity. None of those systems automatically preserve the memory of what the block meant three shells ago.

Once the block or its operational control is back in circulation, the new holder benefits from a kind of reputational cold start. The worst feeds may still remember specific addresses for a while, but many reputation systems are biased toward present attribution: current ASN, current RDAP, current registrant, current geolocation, current open ports. That is sensible for fast-moving defense. It is disastrous for historically dirty space. A sufficiently motivated operator can wait out parts of the decay curve, change the paperwork, and re-announce the same real estate as if history were just a cache expiry problem.

That is what makes the term carousel more accurate than “churn.” Churn suggests noise. A carousel suggests design. The participants do not need perfect continuity of ownership across every stage. They need continuity of function. One shell burns, another takes its place. One ASN is revoked or abandoned, another originates the same or adjacent space. One operator exits paper visibility, another enters. The customer base experiences not a shutdown, but a lateral move.

The user’s verified research data captures the institutional reason this works: RIPE NCC closure for non-payment can take up to 120 days, and the celebrated five-year bar applies to fraud findings against the same organization, not to newly formed entities. That means a fresh legal person can apply immediately. The system is good at recognizing yesterday’s company. It is weaker at recognizing yesterday’s pattern under today’s paperwork.

BGP remembers adjacency. It does not remember guilt.

That gap between protocol present-tense and investigative historical memory is the technical heart of the dead-ASN graveyard.

3. Bunea TELECOM SRL: three ASNs, all on Spamhaus DROP

If the prefix carousel explains how dirty space survives over time, Bunea TELECOM SRL shows how cheaply new wrappers can be mass-produced. The company’s three autonomous systems — AS35478, AS42397, and AS62380 — are all on Spamhaus ASN-DROP. Their names are almost too explicit: DATACENTER, HIGH-VOLUME-NETWORK, and HIGH-PEER-NETWORK. On one reading those labels are marketing fluff. On another, they are a form of accidental candor. They describe the operational ambition more honestly than a polished compliance statement ever would.

The important fact is not merely that all three ASNs are bad. It is that one Romanian SRL generated three separate DROP-listed autonomous systems. Spamhaus ASN-DROP is the nuclear option of network reputation. It is not a list for minor negligence. To have one ASN land there is serious. To have three under the same corporate identity is diagnostic. The simplest explanation is that the company’s business value lay not in ordinary connectivity but in repeatedly offering infrastructure attractive to high-abuse customers.

That interpretation is strengthened by naming pattern and operational structure. “DATACENTER,” “HIGH-VOLUME,” and “HIGH-PEER” read less like organically developed network brands and more like interchangeable shells in a production catalog. They tell you what the customer is buying: capacity, throughput, route presence. They do not tell you anything about substantive business history, distinctive service quality, or a clean customer base. The names are functional because the entities are functional.

For this article’s central thesis, Bunea matters even beyond its own ASNs. The triple-ASN pattern demonstrates that an abusive operator does not need to cling desperately to one number resource. It can simply make or acquire another wrapper. When three such wrappers from the same Romanian company all end up in the harshest reputation tier, the problem is no longer a rogue customer. It is a manufacturing method.

One bad ASN can be blamed on misfortune. Three under one shell cannot.

4. Romanian SRL formation: the disposable LIR shell

The Bunea story would be less concerning if the barrier to creating a new wrapper were high. It is not. The user’s verified research data states that a Romanian SRL can be formed online for about €200 with minimal verification. On its own that is not a scandal. Cheap incorporation is normal in modern commercial policy. But pair that low-friction company formation with the RIPE fee structure — €1,000 sign-up and €1,800 yearly — and the economics of abusive infrastructure become obvious. For well under the cost of serious enterprise hardware, an operator can purchase a legal mask and the administrative gateway to globally routable identity.

This is the disposable LIR shell. It does not need to embody a substantive company in the ordinary sense. It needs to exist long enough to hold records, sign forms, pay fees, and interact with the RIR. If it burns, the operator is not ruined. The shell is sacrificial. That is why the phrase “institutional enabler” belongs not only to RIPE’s policy gaps but also to the corporate regimes that make the legal wrapper cheap to obtain. Neither system is malicious in design. Together they create a path of least resistance for operators who view companies as consumables.

The cost arithmetic deserves explicit statement because it strips away mystique. Suppose one forms a Romanian SRL for roughly €200. Add RIPE’s €1,000 sign-up and €1,800 annual fee. In round terms, year-one entry into the LIR world begins around €3,000 before ancillary costs. For a legitimate ISP that is routine overhead. For a criminal or abuse-tolerant infrastructure broker it is a small insurance premium against the future death of any given shell. If one profitable customer run can earn more than the wrapper cost, the entity becomes disposable by design.

This is why defenders should stop speaking as if shell-company use in infrastructure is an exotic trick. It is often just a spreadsheet decision. Low-friction incorporation plus routable identity equals a cheap, repeatable mask.

The Romanian SRL is therefore not incidental scenery in this case. It is one of the manufacturing tools.

5. Dmitriy Panchenko: the named operator phase

The 87.251.64.0/24 history becomes more valuable once it passes through a named individual. Anonymous shells are frustrating because they prove pattern without always proving lineage. Dmitriy Panchenko changes that. The user’s data places him as the previous operator of the /24 via AS48080 from September 2021 to August 2022. The internal routing dataset shows AS48080 holding the block well beyond that window, into 2023, but the narrower verified interval is enough for the argument. What matters is that the prefix is not floating through pure noise. At one point it sits under a human-linked operational identity.

That named phase matters because it turns the story from generic bad hygiene into lineage. A prefix under Panchenko is not merely a number on a graph. It is a relationship point. When the same /24 later appears under a different shell, defenders are tempted to treat the new appearance as a separate case. But the historical link tells us the opposite. The address space already belonged to a hostile operating context. The next holder inherits not just addresses, but a tainted operational ancestry that ordinary systems fail to preserve.

Panchenko’s place in the chain also demonstrates why “ownership” language must be used carefully. The issue is not necessarily who possessed every legal right to the address block at every instant. The issue is who operated the network identity through which the block was announced. In abuse analysis, operational control is often more revealing than formal title. AS48080 is the pivot because it shows a real person inside the carousel, not just a series of dead numbers.

Once that pivot exists, later transitions are harder to read as innocent resets. A burned prefix that moves from anonymous wrapper to named operator to new wrapper is not cleansing itself. It is traveling.

Panchenko is therefore not merely a predecessor. He is the stage that reveals the mechanism.

6. ISAEV Igor and AS200730: the latest legal mask

The current visible stage of the chain is ISAEV Igor / AS200730, registered in Kazakhstan and tied in the user’s infrastructure set to IPs including 87.251.64.176, 87.251.64.144, and 87.251.64.145. In a shallow present-tense analysis, that would be the whole case: current ASN, current country code, current abusive IPs. But present-tense analysis is precisely what this article argues against. The key fact is not merely that AS200730 is bad today. It is that AS200730 is the newest wrapper on space with a long abusive memory.

This distinction matters because it changes how one interprets legitimacy. A clean new ASN announcing a clean new block might deserve the benefit of doubt. A new ASN announcing a block with this history does not. The problem is not that Kazakhstan appears in the metadata. The problem is that the current holder benefits from the internet’s habit of treating current attribution as if it erased prior pattern. It does not. The line from earlier dead wrappers through Panchenko to ISAEV shows renewal, not remediation.

That is why the phrase “IP laundering” is appropriate. Laundering does not mean the material becomes morally clean. It means the identifying marks are stripped or changed so the next observer sees a fresh surface. AS200730 performs that function for 87.251.64.0/24. The block is not a new asset in any meaningful forensic sense. It is an old asset wearing a new legal story.

That is the danger of the current holder phase. The attacker does not need the prefix to be genuinely rehabilitated. It only needs analysts, providers, and automated systems to treat it as if it were.

7. RIPE NCC’s institutional failure: closure delays and entity-specific penalties

The institutional enabler in this case is not malicious intent inside RIPE NCC. It is the gap between administrative policy and adversarial behavior. RIPE is a regional internet registry serving roughly 21,500 LIRs with about €38 million in annual income. Its job is allocation, recordkeeping, and policy administration at scale. That model works tolerably for good-faith members. It struggles when a hostile operator treats legal entities as disposable tokens. The reason is embedded in the verified rules relevant here: closure for non-payment can take up to 120 days, and the five-year bar applies only to the same organization in fraud cases. A new legal entity can apply immediately.

In practice this means RIPE can terminate yesterday’s wrapper without meaningfully excluding tomorrow’s. The registry has memory of organization records, but its policy structure does not automatically collapse related shells into one operational identity. That is understandable from a governance perspective. It is also exactly what an adversary needs. If the sanction follows only the old company name, the operator simply changes the company name.

This is not a theoretical weakness. The Bunea triad and the recycled 87.251.64.0/24 lineage illustrate how well it maps to real abuse. The registry can close the account. The internet still needs a way to decide whether the next account is materially the same actor in new clothing. Today, that judgment is weakly encoded if at all. There is no robust concept of pattern-level recidivism across shells built into the membership process.

That gap matters because the cost of entry is low enough to make repetition rational. If a business model can survive one or two deaths per year by minting new shells, then slow closures and entity-specific penalties do not deter. They become a line item.

Seen this way, the problem is not one bad decision by RIPE. It is a structural mismatch between administrative neutrality and adversarial serial shell use.

8. The BGP memory problem

Even if RIPE had stronger shell-detection, the protocol itself would still remain a problem. BGP has no concept of tainted address space. It validates path visibility, policy, and adjacency relationships. It does not preserve narrative history. The router asks: who originates this prefix now? It does not ask: what did this prefix do three wrappers ago? This is why reallocated or recycled blocks can be re-announced immediately. The protocol is functioning exactly as designed, but the design assumes that the control plane is not itself a laundering interface.

That assumption no longer holds. In a world of cheap shells, routable identity can be regenerated faster than reputational memory can spread. The result is an asymmetry: attackers reuse the same block with minimal friction, while defenders must reconstruct the historical chain by querying archives, routing history, and registry data manually. Attackers operate in the present tense; defenders must do history homework under time pressure.

One consequence is that prefix-level history is routinely undervalued. Many organizations still anchor blocking or triage decisions to current ASN and current domain intelligence. Those indicators matter, but they flatten the lineage. A block like 87.251.64.0/24 should carry a reputation shadow that survives changes of origin ASN. Today that shadow exists mainly in the minds of careful investigators, not in the fabric of the protocol.

The router sees a route. The investigator sees a reincarnation.

Until those two views are better connected, dead-ASN recycling will remain an effective laundering tool.

9. Why reputation databases keep resetting

Once the protocol forgets, the feeds often follow. Many reputation products are optimized for actionability, not historical memory. They answer questions like: which ASN owns this IP now, which abuse complaints mention it recently, which current domains resolve here, what does the present RDAP say? That design is defensible for high-volume automated blocking. It is weak against recycled infrastructure. If reputation is tied too tightly to the current wrapper, then every new ASN offers a partial reset.

The 87.251.64.0/24 chain shows the consequences. A defender looking only at current data on AS200730 may see a Kazakh-registered network and a cluster of abusive IPs. A defender who looks historically sees a prefix that has already passed through multiple dead wrappers, including a named Panchenko phase and earlier anonymous shells. These are not the same analytical object. The second view supports broader blocking, stronger skepticism, and more durable attribution. The first view risks treating the present holder as a new isolated incident.

This is also why “dead ASN” is not a sufficiently comforting phrase. Dead to whom? Dead in which database? Dead in the billing system? Dead in the company registry? The IP space is still alive. The attacker’s use case is still alive. The customer demand is still alive. Only the last label has died.

What defenders call “fresh infrastructure” is often just old infrastructure with fresh paperwork.

10. The Omegatech connection: when the DROP predates the debut

The wider significance of the graveyard mechanism appears when one compares it with other cases in this series. The user’s verified research data notes that AS202412 (Omegatech) shows the same pattern: Spamhaus DROP entries predate the ASN’s first BGP announcement in January 2026. That is an extraordinary fact because it means the dirty reputation shadow was attached not merely to a current operator’s conduct, but to address space or related infrastructure history older than the current network identity. In other words: the shell was born into contamination.

This is the conceptual bridge between the Pfcloud transit case and the dead-ASN graveyard case. Pfcloud shows how a transit sponsor keeps burned networks online. The 87.251.64.0/24 chain shows how burned space itself survives shell death. Omegatech connects the two by demonstrating that reputation can arrive before the new ASN’s visible life begins. When that happens, the fiction of a clean slate becomes impossible to sustain.

It also shows why institutional responses aimed only at current bad actors are insufficient. One must track lineage: prefixes, route objects, contacts, customer patterns, upstream dependencies, and corporate shell families. Without lineage, every new ASN looks like a new problem. With lineage, the same handful of problems begin to reveal themselves in rotation.

That rotational quality is the real connective tissue across this series. Some operators specialize in shells. Some specialize in transit. Some specialize in leasing. Some specialize in disappearing before the invoice cycle catches up. The reason the same names keep resurfacing in different combinations is that these are not isolated incidents. They are interlocking maintenance routines for a hostile infrastructure market. A recycled prefix is useful to the same customer class that values a lenient upstream. A disposable SRL is useful to the same operator who wants to reset a RIPE-facing identity without rebuilding every downstream dependency. Once you understand that, the distinction between “old block” and “new ASN” starts to look like a legal fiction convenient to everyone except defenders.

The Omegatech example is especially valuable because it strips away the last innocent explanation. If a fresh ASN enters BGP already carrying prefixes with DROP baggage older than its own routing life, then the operator cannot plausibly claim that reputation attached only after some unforeseen customer incident. The contamination predates the debut. That means the historical baggage was either ignored, exploited, or deliberately selected as part of the deployment model. None of those interpretations is consistent with a good-faith clean-start story.

For investigators, that should change the default question. Instead of asking only “what is this ASN doing now?” one should also ask “what kind of address history did this ASN choose to inherit?” That second question exposes intent. Clean operators avoid baggage where they can. Shell-heavy operators frequently treat baggage as tolerable because the address block’s prior damage is somebody else’s paperwork problem until a new round of abuse makes it theirs.

None of this requires inventing a new internet. It requires refusing the comforting habit of taking current paperwork at face value. The data already exists in routing archives, RIR history, and reputation feeds. What is often missing is the willingness to merge those records into a persistence model. The attacker has one. The defender usually does not. That is why dead ASNs keep handing their grave goods to the next wrapper.

The dead ASN graveyard is therefore not a niche curiosity. It is one of the core maintenance routines of bulletproof infrastructure. Abuse survives not because the internet cannot see it, but because the systems that see it are not designed to preserve that memory across shells. A prefix dies on paper, returns under a new wrapper, and the machine resumes.

And that is the real scandal. The dead networks are not gone. They are standing back up under different numbers, carrying the same old space, while much of the internet treats each resurrection as a new event instead of what it is: a continuation.