๐ญ The People Behind the Curtain
TI-2026-026G โ Five Names, Three Countries, Zero Accountability
Series: The Phantom ASN (Part 7 of 9)
Behind every bulletproof network are real people making real decisions. This dossier profiles the human actors who operate, enable, and profit from the infrastructure documented in TI-2026-026A through 026F. They are not anonymous hackers in basements. They are registered company directors, RIPE NCC contacts, and professional service providers operating in plain sight.
Five key individuals span Turkey, Russia, Germany, the Netherlands, and Lithuania. Their roles range from 3-day nominee directors to RIPE committee members. None has ever been charged with a crime. All are documentable through public corporate registries.
Chapter 1: The Cast
A bulletproof hosting network doesn't build itself. Behind the ASN numbers, the shell companies, and the BGP announcements are individuals who signed forms, verified identities, and made decisions. These are the people:
| Name | Nationality | Role | Company | Source |
|---|---|---|---|---|
| Cihan KAPLAN | Turkish ๐น๐ท | Sole Director | HBING LIMITED (UK) | Companies House |
| Olga INAG | Russian ๐ท๐บ | Nominee Director (3 days) | HBING LIMITED (UK) | Companies House |
| Marcel EDLER | German ๐ฉ๐ช | Admin Contact / Director | XSServer GmbH + PIO-Hosting GmbH | RIPE NCC |
| Dirk BELLGART | German/Dutch ๐ณ๐ฑ | Admin Contact | SkyLink Data Center BV | PeeringDB |
| Vincentas GRINIUS | Lithuanian ๐ฑ๐น | Co-Founder / Customer | IPXO UAB + Internet Utilities | IPXO Blog |
All identities verified through government corporate registries (UK Companies House, German Handelsregister, Dutch KvK) and RIPE NCC WHOIS records.
Chapter 2: Cihan Kaplan โ The Man Who Wasn't There
Born June 1990. Turkish national. Resident in Turkey. Since January 13, 2022, Cihan Kaplan has been the sole director of HBING LIMITED โ a UK company that operates AS208949, announces IP prefixes from 7 countries, and hosts infrastructure scored 95.26/100 for threat by our automated systems.
The facts that don't add up:
- Address: 82a James Carter Road, Mildenhall, Suffolk IP28 7DE โ a known virtual office address. Kaplan has never been to Suffolk.
- Infrastructure location: DB-IP.com places the actual hardware in Frankfurt am Main (Bergen-Enkheim), Germany. Not UK. Not Turkey.
- Identity verification: E-SIRKET LTD, a Turkish ACSP (Authorised Corporate Service Provider), verified his identity on 11 March 2026 โ four years after he became director.
- No digital footprint: No LinkedIn. No professional profile. No industry conference attendance. No published papers or blog posts.
- No PSC filing: UK Companies House shows no Person of Significant Control declaration โ meaning the actual owner of HBING is undeclared.
โ Who actually controls HBING?
Kaplan is the registered director, but there is no PSC (Person of Significant Control) filing. Under UK law, every company must declare who owns 25%+ of shares. The absence means either: (a) deliberate non-compliance, (b) shares held through nominees or corporate chains, or (c) the true controller is in a jurisdiction that makes discovery difficult. Given the BVI shell company (lir-vg-itweb-1-MNT) managing the IP prefixes, option (b) is most likely.
โ What if Kaplan is a nominee himself?
The pattern fits. A Turkish national who never visits the UK, has no technical background visible anywhere online, runs a company whose infrastructure is in Germany, and whose identity was only formally verified four years into his directorship. The E-SIRKET verification in March 2026 coincides with Companies House tightening ACSP requirements โ suggesting this was a compliance checkbox, not a genuine identity confirmation for operational purposes.
Sources: UK Companies House #13836998 | RIPE ORG-HA1037-RIPE
Chapter 3: Olga Inag โ The Three-Day Director
Born October 1991. Russian national. On January 10, 2022, Olga Inag was appointed as the founding director of HBING LIMITED. On January 13, 2022 โ exactly three days later โ she resigned. Cihan Kaplan was appointed the same day.
This is a textbook nominee director pattern:
- A person (often in a different jurisdiction) incorporates the company
- They immediately transfer control to the actual operator
- The founding director's involvement creates a jurisdictional step that complicates investigation
Olga Inag's role lasted 72 hours. Her correspondence address was the same virtual office in Mildenhall. There is no evidence she ever set foot in the United Kingdom.
โ Why use a Russian national to found a UK company that will be controlled by a Turkish national?
The three-jurisdiction hop (Russia โ UK โ Turkey) serves a specific purpose: it makes the chain of beneficial ownership harder to trace. A Russian investigator hits a UK wall. A UK investigator finds a Turkish controller. A Turkish investigator finds no local operations. No single national authority has the full picture.
โ How many other companies has Olga Inag founded?
This remains an open question. Companies House allows searching by director name, but common names produce noise. The pattern of a Russian national founding UK companies and immediately resigning is, however, a well-documented indicator of corporate formation mills operating between Moscow and London. These mills sell "clean" UK companies with pre-established banking relationships.
Sources: HBING Filing History
Chapter 4: Marcel Edler & Rene Spellerberg โ The Operators
While Kaplan and Inag are legal fronts, Marcel Edler (ME7748-RIPE) and Rene Spellerberg (RS24146-RIPE) are the people who actually run the infrastructure. Their RIPE NCC handles appear as admin and tech contacts across three legally separate entities:
| Entity | Registration | ASN | Location |
|---|---|---|---|
| XSServer GmbH | HRB 21403, Aachen | AS207959 | Em Koddes 1, รbach-Palenberg |
| PIO-Hosting GmbH | HRB 20998, Mรถnchengladbach | AS198584 | Sรผchtelner Str. 65, Mรถnchengladbach |
| SkyLink Data Center BV | KvK (Netherlands) | AS44592 | Eygelshoven, Netherlands |
The phone number +49 2451 9949570 appears in RIPE records for all three. The area code 02451 corresponds to รbach-Palenberg โ a small town on the German-Dutch border. Not Mรถnchengladbach (where PIO is registered). This proves the registered address is cosmetic; the actual operations center is in the border region.
These three entities form a vertically integrated stack:
- SkyLink = upstream transit (AS44592, 1-5 Tbps, 16 IXPs, 2500 prefixes)
- XSServer = the RIPE LIR (actual holder of IP allocations)
- PIO-Hosting = the customer-facing brand that onboards bulletproof clients
โ Why three companies for one operation?
Legal liability isolation. If PIO-Hosting is prosecuted for enabling abuse, XSServer (the LIR) and SkyLink (the transit provider) can claim they are separate entities. The RIPE NCC resource holder (XSServer) is one step removed from the hosting customers. The transit provider (SkyLink) is two steps removed. Shutting down PIO-Hosting doesn't revoke the IP allocations (held by XSServer) or disconnect the network (controlled by SkyLink).
โ What do we know about Edler and Spellerberg personally?
Unlike Kaplan and Inag, they have real operational presence โ they attend IXP meetings (SkyLink connects to 16 IXPs), manage PeeringDB profiles, and respond to (some) abuse reports. They are technical operators who made a business decision: gray-transit pays more than clean hosting. The infrastructure they built is professionally engineered โ multi-redundant, well-peered, and specifically designed to be resilient against takedown. This is not incompetence. It is architecture.
Sources: RIPE ORG-XG40-RIPE | PeeringDB AS44592 | RIPE ORG-PG281-RIPE
Chapter 5: Dirk Bellgart โ The Phantom Upstream
Dirk Bellgart (DB24958-RIPE) is the admin contact for SkyLink Data Center BV. His phone number โ the same +49 2451 9949570 โ conclusively links him to the XSServer/PIO operation. But his role is distinct: he manages the transit layer.
SkyLink's PeeringDB profile reveals the scale:
- Traffic: 1-5 Tbps (terabits per second)
- IXPs: Connected to 16 Internet Exchange Points across Europe
- Prefixes: Announces 2,500 IPv4 prefixes
- Location: Eygelshoven, Netherlands โ literally across the border from รbach-Palenberg
The German-Dutch border choice is not random. It provides jurisdictional ambiguity: German authorities investigate a Dutch company, Dutch authorities see German phone numbers and personnel. Neither takes the lead.
โ Is Bellgart a separate actor or the same team?
The shared phone number settles this definitively. Bellgart is part of the Edler/Spellerberg operation, running the upstream layer from a Dutch legal entity. The multi-entity structure (German LIR + German hosting + Dutch transit) is a deliberate firewall design. If you're designing a takedown-resistant network, this is exactly how you'd do it.
Sources: PeeringDB SkyLink | RIPE DB24958-RIPE
Chapter 6: Vincentas Grinius โ The Respectable Customer
Vincentas Grinius is the most interesting actor because he is the most legitimate. Co-founder of IPXO (formerly HEFICED/Digital Energy Technologies), a Lithuanian IP marketplace claiming $55 million in revenue and ISO 27001 certification. He attends ARIN meetings. He publishes on RIPE Labs. His company has a RIPE Programme Committee member (Paulius Judickas, elected June 2026).
And his company's IP blocks route through both bulletproof ASNs documented in this series.
The evidence:
- netutils-mnt (Internet Utilities, Grinius's entity) is the RIPE maintainer for prefixes on both AS198584 and AS208949
- Internet Utilities NA LLC (Wilmington, Delaware) lists Grinius as admin contact for ARIN blocks 66.92.164.0/24 and 72.9.233.0/24 routing via PIO AS198584
- RIPE blocks 143.14.65.0/24, 147.79.0.0/24, 93.95.115.0/24 also via PIO
- AFRINIC blocks (102.129.200.0/24, the HBING/HEFICED block) route via AS208949
โ Does Grinius know his IPs route through bulletproof infrastructure?
He must. IPXO's business model is IP leasing โ they know exactly where their prefixes are announced because BGP routing is observable. They run their own ASNs. They have RIPE Programme Committee access. The netutils-mnt maintainer objects are their own creation. The routing through PIO and HBING is not accidental discovery; it is the configured transit path they selected.
โ What if IPXO deliberately uses bulletproof transit to guarantee uptime for leased IPs?
This is the most charitable reading: bulletproof networks don't go down. If you're leasing IPs and guaranteeing availability, routing through an abuse-tolerant transit provider ensures your SLA. The less charitable reading: bulletproof transit means your customers' activity won't trigger a null-route. Either way, it means IPXO's $55 million revenue stream depends partly on infrastructure that enables the 628-IP scanning campaign documented in this investigation.
๐ Read Between the Lines
- A company with a RIPE committee member routes through a network with zero PeeringDB presence and Spamhaus-listed prefixes
- The same person who publishes on RIPE Labs about "responsible IP stewardship" maintains route objects on a bulletproof ASN
- ISO 27001 certification โ which requires demonstrating supply chain security โ apparently doesn't cover transit provider due diligence
- Paulius Judickas (paulius.j@heficed.com โ IPXO โ RIPE Programme Committee) votes on policies that affect how abuse complaints about IPXO's transit partners are handled
Sources: IPXO Blog | RIPE Committee Announcement | ARIN RDAP (Internet Utilities NA LLC) | RIPE WHOIS (netutils-mnt)
Chapter 7: The Support Cast โ E-SIRKET and 123LIR
Behind the five principals, service providers make the structure possible:
E-SIRKET LTD โ A Turkish Authorised Corporate Service Provider (ACSP) supervised by UK HMRC. They verified Cihan Kaplan's identity for Companies House. ACSPs are the gatekeepers of UK company formation. Their role: confirm "yes, this person is real." Not: "yes, this person should run a network hosting botnet infrastructure."
123LIR / ANT BM Limited โ A UK-based ASN registration service. Their maintainer (mnt-uk-123lir-1) appears on AS208949's RIPE records, indicating they provided the initial ASN setup. 123LIR sells "RIPE ASN registration" as a commodity service โ ยฃ499 plus annual fee. No due diligence on what the ASN will carry.
Host Sailor Ltd (Dubai) โ The RIPE NCC sponsoring LIR for AS208949 (ORG-HSL15-RIPE). Registered at 1605 Churchill Executive Tower, Burj Khalifa Area, Dubai. Phone number: +16465189099 โ a US number despite UAE registration. Without Host Sailor's sponsorship, HBING cannot hold RIPE resources.
โ Are these enablers culpable?
Legally, probably not. E-SIRKET verified an identity โ that's their job. 123LIR registered an ASN โ that's their service. Host Sailor sponsors RIPE membership โ that's their business. But collectively, they form the supply chain that allows a Turkish national with no visible technical background to operate a bulletproof ASN from a UK virtual address with infrastructure in Germany. The system works exactly as designed: each link does its narrow job, no one looks at the whole chain.
Chapter 8: What 628 Machines Do While Nobody Watches
These five people's decisions โ to register, to direct, to operate, to route, to enable โ result in a concrete harm. The libssh2_1.11.0 campaign tied to this infrastructure:
| Metric | Value |
|---|---|
| Total scanning IPs | 628 across 48 countries |
| Total sessions against our honeypot | 16,253 attempts |
| Credential used | root: (empty password) โ 24,239 attempts across 670 IPs |
| Success rate | 0% (honeypot rejects all) |
| Top hosting ASNs | OVH (45), SingleHop (39), Psychz (34), ColoCrossing (33), MULTACOM (26) |
| PIO-Hosting IPs in campaign | 15 (directly on AS198584) |
| Campaign duration | 2026-05-02 to 2026-05-21 (19 days) |
The campaign uses identical SSH client libraries (libssh2 1.11.0) with the same HASSH fingerprint (14b2ddda386a4d10...) across all 628 IPs. This proves centralized control โ one operator distributing the same tool across infrastructure in 48 countries. PIO-Hosting provides 15 of these nodes directly. HBING provides additional nodes through its IPXO/AFRINIC prefixes.
โ Do the five named individuals know their infrastructure scans the entire internet?
Edler and Spellerberg certainly do โ they receive (and ignore) the abuse reports. Kaplan may not understand the technical details. Grinius routes IPs through this network; whether specific lease customers use them for scanning is arguably one step removed. But none of them needs to know the specifics. The business model is: provide infrastructure, ask no questions, respond to no complaints. That's what "bulletproof" means.
Chapter 9: The Accountability Gap
Five people. Three countries. Seven company directorships. 628 attack machines. Zero criminal charges.
Why?
- Jurisdictional fragmentation: The UK registers the company. Turkey houses the director. Germany hosts the hardware. The Netherlands provides transit. Lithuania provides IP blocks. No single jurisdiction owns the entire problem.
- The "mere conduit" defense: Under EU Directive 2000/31/EC (e-Commerce Directive), hosting providers are not liable for content they don't know about. The defense requires: no actual knowledge + no expeditious action obligation triggered. Bulletproof hosting sidesteps this by simply not reading abuse reports.
- Corporate veils: Even if PIO-Hosting is shut down, XSServer retains the RIPE allocations. Even if XSServer loses its LIR status, SkyLink's 2,500 prefixes remain active. The structure has redundancy built specifically against legal intervention.
- Enforcement capacity: German cybercrime units are underfunded. BKA focuses on ransomware. A hosting provider enabling scanning campaigns is low priority. There are approximately 4,800 cybercrime prosecutors in the EU for an estimated 500,000+ cybercrime incidents per year.
๐ Read Between the Lines
- The system doesn't fail to catch these people โ it's not designed to catch them
- Every one of these individuals is findable in 10 minutes through public registries
- The corporate formation industry (E-SIRKET, 123LIR, Host Sailor) profits from not asking questions
- RIPE NCC has the data to see PIO/XSServer/SkyLink as one entity. They don't look.
- Paulius Judickas (IPXO/Heficed โ RIPE Committee) helps set the policies under which his company's transit partners are evaluated
Sources: EU Directive 2000/31/EC | Europol IOCTA 2025 (enforcement capacity figures) | Our honeypot data (16,253 sessions)
๐ Series Navigation โ The Phantom ASN
026A: The Phantom ASN (Overview)026B: The Bulletproof Archipelago
026C: The German Gray Zone
026D: The IP Marketplace
026E: The Offshore Chain
026F: The Sanctions Question
โ 026G: The People Behind the Curtain (You Are Here)
026H: The 628 Machines
026I: The Registry That Looked Away