๐๏ธ TI-2026-026E โ The Offshore Chain: Panama Papers, BVI Shells, and the Nominee Director Industry
Executive Summary: The IP addresses that attacked our honeypot are registered to a person named in the Panama Papers. Rea Ketty Yolande Barreau โ ICIJ node 12169229, Seychelles national, operating from "House of Francis, Room 303" โ appears as the registrant for three HBING prefixes. She is part of a nominee director industry that provides plausible deniability to whoever actually controls the infrastructure. This installment traces the offshore chain from Dubai through the British Virgin Islands to the Seychelles, revealing the legal architecture that makes bulletproof hosting truly bulletproof.
Chapter 1: A Name in the RIPE Database Leads to the Panama Papers
Three IP prefixes announced by AS208949 (HBING LIMITED) are registered to a person named "Rea Ketty":
| Prefix | Size | Registrant | Status |
|---|---|---|---|
| 45.88.0.0/24 | 256 IPs | Rea Ketty | Active |
| 45.142.2.0/24 | 256 IPs | Rea Ketty | Active |
| 45.148.145.0/24 | 256 IPs | Rea Ketty | Active |
Searching the ICIJ Offshore Leaks Database for this name yields a direct hit:
REA KETTY YOLANDE BARREAU โ Node ID 12169229 โ listed as an officer in the Panama Papers leak (Mossack Fonseca data, 2016).
Her registered address: House of Francis, Room 303, รle Du Port, Mahรฉ, Seychelles.
This is not someone who happened to have the same name. The combination of Seychelles nationality, BVI company involvement, and offshore IP registrations โ all connecting to the same infrastructure โ identifies a professional nominee director.
โ What is a "nominee director" and why would bulletproof hosting use one?
A nominee director is a person who lends their name to a company directorship without having actual operational control. The real owner (the "beneficial owner") remains hidden. In the BVI and Seychelles, nominee services are legal and common. They exist for one purpose: anonymity. For bulletproof hosting, this means law enforcement cannot easily determine who actually controls the infrastructure. If a German prosecutor issues a European Investigation Order seeking the owner of 45.148.145.0/24, they'll find Rea Ketty Barreau โ in the Seychelles โ who has no actual knowledge of what runs on those IPs.
Chapter 2: House of Francis, Room 303 โ The Address That Holds Hundreds of Companies
"House of Francis" at รle Du Port, Mahรฉ, Seychelles is a registered agent address โ a building that exists primarily to provide a legal address to offshore companies. Room 303 is occupied not by Rea Ketty Barreau personally, but by a corporate service provider that manages nominee directorships.
The Seychelles was chosen deliberately:
- No public beneficial ownership register (unlike the UK/EU)
- No automatic information exchange with EU law enforcement
- Minimal corporate filing requirements โ no public accounts
- International Business Companies (IBC) Act โ optimized for offshore structures
- No Mutual Legal Assistance Treaty (MLAT) with most EU countries for civil matters
If German authorities want to trace who controls the IPs registered to Rea Ketty, they must:
- Identify her as the registrant (done)
- Determine she's in Seychelles (done)
- Issue an international letter rogatory to Seychelles courts
- Wait 6-18 months for processing
- Receive a response saying she's a nominee
- Start over, seeking the beneficial owner โ who may be in a third jurisdiction
By step 6, the IPs have been moved to new registrants. The structure is designed for this delay.
๐ Read Between the Lines
- "House of Francis, Room 303" likely holds registrations for hundreds of shell companies. Rea Ketty is a professional nominee โ she's on the Panama Papers because she was named on Mossack Fonseca documents. MF was one of many providers. She likely serves as nominee for other corporate service providers too.
- The Seychelles is the only jurisdiction that refuses to join the ICIJ's beneficial ownership transparency initiative. This is not an oversight โ it's the jurisdiction's competitive advantage.
- IP address registrations in RIPE/ARIN don't require the same level of identity verification as banking. You can register a /24 with a name, email, and phone number. No passport scan. No utility bill. The offshore industry was designed for bank accounts โ applying it to IP registrations is almost too easy.
Chapter 3: lir-vg-itweb-1-MNT โ The British Virgin Islands LIR
The RIPE maintainer lir-vg-itweb-1-MNT controls several HBING prefixes. The naming convention tells us everything:
| Component | Meaning |
|---|---|
lir | Local Internet Registry (RIPE member) |
vg | British Virgin Islands (ISO 3166-1) |
itweb | Company name fragment |
1-MNT | First maintainer object |
A BVI company (hence "vg") is a RIPE LIR โ a Local Internet Registry paying RIPE NCC membership fees and managing IP addresses. But the BVI has no internet infrastructure, no data centers, no IX facilities. Why would a BVI company need to be an internet registry?
The abuse contact for this maintainer: abuse.webltd@gmail.com โ a free Gmail address. Not a corporate domain. Not even a country-specific domain. A gmail.com address managing internet resources for a BVI entity routing through a UK ASN with infrastructure in Germany.
This is the middle layer in the chain:
Rea Ketty (Seychelles) โ lir-vg-itweb-1 (BVI) โ AS208949 (UK) โ Infrastructure (Germany)
โ Can RIPE NCC verify that a BVI company is legitimate?
In theory, yes. In practice, barely. RIPE requires LIR members to provide a company registration number and demonstrate "intent to provide internet services." A BVI company certificate costs ~$1,500 and requires no public disclosure of owners. RIPE's due diligence process cannot pierce the BVI veil. They can verify the company exists โ not who owns it. The Gmail abuse contact should be a red flag, but RIPE's policy doesn't mandate corporate email for abuse contacts. The system trusts the information provided.
Chapter 4: Olga INAG โ Three Days as HBING's Director
HBING LIMITED (UK company #13836998) was incorporated on 10 January 2022. The founding director: Olga INAG, Russian national, born October 1991.
Three days later โ 13 January 2022 โ she resigned.
Her replacement: Cihan KAPLAN, Turkish national, who remains the sole director today.
A three-day directorship is the signature of a nominee incorporation service:
- Service provider uses their own nominee (Olga INAG) to file incorporation
- Once the company exists (takes 1-3 days for UK Companies House)
- Nominee resigns and the actual controller is installed
- The company has a "clean" incorporation history with no link to the final owner at the moment of creation
The formation agent is likely E-SIRKET LTD โ a Turkish company formation service. The Russian nominee (INAG) is provided by the agent; the Turkish director (KAPLAN) is the client's representative.
But who is KAPLAN's client? The UK's PSC (Persons with Significant Control) register should reveal this โ but HBING's PSC filing is notably... absent.
โ What does a missing PSC filing mean legally?
Since 2016, UK law requires all companies to declare Persons of Significant Control (anyone owning >25% of shares or controlling the company). Failure to file is a criminal offense under the Small Business, Enterprise and Employment Act 2015, Section 790F. Each director faces an unlimited fine and/or up to 2 years imprisonment. If HBING's PSC is missing, Companies House should have flagged it. The fact that a company operating bulletproof hosting since 2022 still hasn't filed a PSC โ with no enforcement action โ demonstrates the gap between UK corporate transparency law and its actual enforcement.
Chapter 5: Host Sailor โ The Dubai Sponsor
Host Sailor Ltd (ORG-HSL15-RIPE) is the RIPE-accredited LIR that sponsors AS208949 for HBING LIMITED. Registered address: 1605 Churchill Executive Tower, Burj Khalifa Area, Business Bay, Dubai, UAE.
In RIPE's system, an LIR "sponsors" an ASN by vouching for the requesting organization. Host Sailor agreed that HBING LIMITED was a legitimate organization deserving of an Autonomous System Number.
Host Sailor is a known entity in the bulletproof hosting ecosystem:
- Sponsors multiple ASNs for opaque network operators
- Minimal due diligence (accepts companies with 3-day-old directors)
- Based in Dubai โ outside EU and US regulatory reach
- Registration number: IBC/2021/123456 (Dubai International Financial Centre)
The enabler chain is now complete:
Host Sailor (Dubai) โ sponsors AS208949
โ HBING LIMITED (UK, Cihan Kaplan)
โ lir-vg-itweb-1-MNT (BVI shell)
โ "Rea Ketty" registrant (Seychelles, Panama Papers)
โ Actual infrastructure (Frankfurt, Germany)
Five jurisdictions. Zero public beneficial owners. The chain runs: UAE โ UK โ BVI โ Seychelles โ Germany. No single law enforcement agency has jurisdiction over the entire chain.
๐ Read Between the Lines
- Dubai's entire value proposition for companies like Host Sailor is regulatory arbitrage. UAE has no MLAT with most EU countries for cybercrime. Extradition requires bilateral agreements that mostly don't exist.
- The "Churchill Executive Tower" address is a business center, not a data center. Host Sailor doesn't operate infrastructure in Dubai โ it operates paperwork in Dubai. The address exists solely to place the company outside EU/UK regulatory reach.
- RIPE's sponsorship model assumes good faith. Host Sailor's business model is providing that sponsorship to entities that can't get it from more reputable LIRs. They are the "notary" in this system โ the entity that certifies legitimacy without verifying it.
Chapter 6: The Four-Jurisdiction Laundering Pattern
Our investigation identified a systematic pattern across HBING's infrastructure:
| Layer | Jurisdiction | Purpose | Visibility |
|---|---|---|---|
| ASN Registration | United Kingdom ๐ฌ๐ง | Appear legitimate (UK = trust) | Public (Companies House) |
| LIR/Maintainer | British Virgin Islands ๐ป๐ฌ | Control IP resources anonymously | Opaque (no BVI public register) |
| IP Registrant | Seychelles ๐ธ๐จ | Obscure beneficial ownership | None (nominee system) |
| Physical Infrastructure | Germany ๐ฉ๐ช | Low-latency European connectivity | Technical only (BGP/traceroute) |
Each layer is chosen for what it hides:
- UK: provides the appearance of a regulated company (but enforcement is weak for small companies)
- BVI: hides the ultimate owner of the IP resources (no public register, no information exchange)
- Seychelles: breaks the chain completely (nominee directors, no beneficial ownership disclosure)
- Germany: provides the actual connectivity (but authorities only see a "UK company's" traffic)
A law enforcement investigation must cross all four jurisdictions simultaneously โ requiring cooperation between UK (NCA), BVI (Financial Investigation Agency), Seychelles (Financial Intelligence Unit), and Germany (BKA). In practice, this never happens for hosting abuse cases. It barely happens for major financial crimes.
โ Has this specific multi-jurisdictional pattern been used in major financial crime?
It's the standard model. The Panama Papers revealed 214,000+ offshore entities using exactly this pattern โ legitimate-jurisdiction company (UK, Netherlands) โ BVI/Cayman holding โ nominee directors in a third jurisdiction. The only novelty here is applying it to internet infrastructure rather than bank accounts. The offshore industry built these structures for financial secrecy. Bulletproof hosting discovered they work equally well for operational secrecy.
Chapter 7: Following the Money โ Who Actually Benefits?
The entities we can see (HBING, lir-vg-itweb-1, Rea Ketty) are all shells โ they don't generate revenue themselves. Someone behind them profits from:
- Hosting fees: Bulletproof hosting charges 5-10x normal rates. A /24 generating $5,000-10,000/month is typical.
- IP leasing: IPXO pays for prefix routing. At market rates, 3,072 IPs generate $3,000-6,000/month in lease revenue.
- Abuse-tolerance premium: Customers pay extra specifically for the guarantee that complaints won't result in service termination.
Conservative estimate for the visible infrastructure: $15,000-30,000/month flowing to whoever controls HBING. After costs (hosting, LIR fees, ASN fees, nominee directors), profit margins exceed 60%.
The money flows in via cryptocurrency or through layered corporate transfers (Host Sailor Dubai โ [unknown] โ HBING UK โ [operating costs]). The nominee director structure ensures no bank account is linked to a traceable individual.
Rea Ketty Barreau likely receives $500-2,000/year for her nominee services. Olga INAG was probably paid $200-500 for her three-day directorship. The actual operators capture everything else.
Chapter 8: The Nominee Director Industry โ A Feature, Not a Bug
Rea Ketty Barreau is not a criminal mastermind. She's a professional nominee โ one of thousands worldwide who provide a legal service: lending their name to company directorships so beneficial owners can remain anonymous.
The industry operates openly in the Seychelles, BVI, Panama, Belize, and similar jurisdictions. Corporate service providers sell packages:
| Service | Price | What You Get |
|---|---|---|
| BVI company incorporation | $1,500-3,000 | Company certificate, registered agent |
| Nominee director (Seychelles) | $500-2,000/year | Named person, signs documents |
| Nominee shareholder | $300-1,000/year | Holds shares in trust |
| Registered office | $200-500/year | Legal address (House of Francis etc.) |
Total cost for a fully anonymous corporate structure: ~$5,000/year. That's the price of bulletproof legal protection for a hosting operation generating $15,000-30,000/month.
The genius of the system: every individual piece is legal. Nominee directorships are legal. BVI companies are legal. Seychelles IBCs are legal. Internet hosting is legal. IP leasing is legal. Only the combination โ applied specifically to evade law enforcement for malicious hosting โ crosses the line. But proving criminal intent requires piercing every layer of the chain simultaneously.
๐ Read Between the Lines
- The Panama Papers (2016) exposed this industry. The Pandora Papers (2021) showed nothing had changed. In 2025, the same addresses, the same nominees, the same jurisdictions are still operating. Eight years of "reform" produced zero structural change.
- FATF (Financial Action Task Force) gray-lists countries for inadequate anti-money-laundering measures. The Seychelles was gray-listed in 2020, removed in 2023 after "reforms." Those reforms didn't prevent Rea Ketty from continuing to serve as nominee for internet infrastructure in 2025.
- The UK's own Economic Crime Act 2022 was supposed to address nominee directors and opaque beneficial ownership. HBING was incorporated in January 2022 โ months before the Act passed. The PSC requirement already existed but remains unenforced for thousands of companies.
Chapter 9: The Architecture of Unaccountability
Our honeypot captured SSH brute-force attempts. Those attempts came from IP addresses. Those addresses are registered to a person in the Panama Papers. That person is a professional nominee in the Seychelles. The addresses are controlled by a BVI entity. The ASN is registered to a UK company with a missing PSC filing. The company was incorporated by a Russian nominee for a Turkish director. The infrastructure physically sits in Germany. The ASN is sponsored by a Dubai company.
Eight facts. Five jurisdictions. Zero accountability.
This is not a failure of any single system. It's the interaction of systems โ corporate registration, internet governance, law enforcement cooperation โ each designed in isolation, that creates the gap. The offshore industry found this gap decades ago for financial crime. Bulletproof hosting found it for cybercrime. The structure is identical because the problem being solved is identical: how do you operate profitably while ensuring no single authority can shut you down?
The answer, as Rea Ketty Barreau's continued appearance in IP registrations demonstrates, is: you don't need to hide. You just need to be in enough places at once that no one can catch all of you simultaneously.
๐ Series Navigation
โ 026A: The Phantom ASN (Overview) ยท โ 026B: The Bulletproof Archipelago (HBING) ยท โ 026C: The German Gray Zone (PIO-Hosting) ยท โ 026D: The IP Marketplace (IPXO) ยท 026E: The Offshore Chain (Panama Papers) ยท 026F: The Sanctions Question โ