🏛️ The Registry That Looked Away

TI-2026-026I — RIPE NCC, IP Governance, and the Architecture of Inaction

Series: The Phantom ASN (Part 9 of 9)

RIPE NCC — the organization responsible for all IP address allocation in Europe, the Middle East, and Central Asia — has a former IP lease company executive on its Programme Committee, allows anonymous "Private Customer" records that hide bulletproof hosts, and published articles by the same executive's CEO while their company enabled the infrastructure attacking our honeypot.

This is not conspiracy. It's documented governance failure. Every entity in this series — PIO-Hosting, HBING LIMITED, IPXO, SkyLink Data Center — exists because a registry allocated them resources without effective accountability. The registry is RIPE NCC.

97M+IPs Under RIPE

22,000+RIPE Members

1IPXO Exec on Committee

0ASNs Revoked for Abuse

GOVERNANCE REGULATORY CAPTURE RIPE NCC CONFLICT OF INTEREST IP GOVERNANCE ACCOUNTABILITY GAP

Chapter 1: What RIPE NCC Is (And What It Isn't)

RIPE NCC (Réseaux IP Européens Network Coordination Centre) is one of five Regional Internet Registries (RIRs) that allocate IP addresses globally. It covers Europe, the Middle East, and parts of Central Asia — over 75 countries.

RIPE NCC's official position on abuse is clear: "We are a registry, not a regulator." They allocate numbers. They don't police how those numbers are used.

This creates a structural gap. When you register a car, the DMV doesn't police your driving — but there is a police force that does. In IP address governance, there is no equivalent police force. RIPE allocates the resource. Nobody effectively monitors its use. The gap is where bulletproof hosting lives.

❓ Is "we're just a registry" a legitimate position?

RIPE's membership agreement includes clauses about accurate registration data. When a member provides false data (e.g., HBING claiming to operate in the UK while running infrastructure in the Netherlands through a Turkish director's company), RIPE could enforce data accuracy requirements. They choose not to. "Just a registry" is a choice, not an inevitability.

Chapter 2: The Private Customer Mechanism

RIPE allows IP holders to register resources under "Private Customer" labels, redacting the actual organization operating the IPs from public WHOIS data. The stated purpose: privacy protection for small operators.

The practical effect: bulletproof hosts can operate behind opaque registrations where abuse reporters cannot identify who to contact. When we queried RIPE for information about certain IP blocks in this investigation, the registrant was listed as a generic private customer reference — lir-vg-itweb-1 — revealing only that the block was registered through an LIR in the British Virgin Islands.

The mechanism was designed for privacy. It is used for opacity.

❓ Who benefits from Private Customer records?

Legitimate use: a small business hosting their own email server doesn't want their CEO's name in WHOIS. Illegitimate use: IPXO leasing IP blocks to bulletproof hosts while shielding those hosts from identification. The mechanism doesn't distinguish between the two — which is the point. Without knowing who the customer is, nobody can evaluate whether the usage is legitimate.

Chapter 3: Paulius Judickas and the Programme Committee

In June 2026, Paulius Judickas was elected to the RIPE Programme Committee. His background:

2020: Email on record as paulius.j@heficed.com (Heficed = IPXO's predecessor)
2021-present: Key executive at IPXO UAB
June 2026: Elected to RIPE Programme Committee

The RIPE Programme Committee decides which proposals are discussed at RIPE meetings, shapes policy agendas, and influences the direction of internet governance in the RIPE region.

IPXO depends on RIPE for:

IP address transfers (their core business is IP leasing)
ASN management (their clients need autonomous systems)
The "Private Customer" mechanism that shields their clients from accountability
Inter-RIR transfer policies that allow them to move addresses between regions

Having an IPXO executive shape the agenda of the body that governs these mechanisms is a conflict of interest. Not illegal. Not technically a violation. But a clear indicator of regulatory capture — where the regulated entity participates in governing itself.

❓ Is this unusual in internet governance?

It's common — and that's the problem. Internet governance bodies are structured as "multi-stakeholder" organizations where industry participants govern themselves. This works when participants have aligned incentives (everyone benefits from a functioning internet). It fails when some participants profit from the system's weaknesses. IPXO profits from IP leasing with minimal accountability. Having their executive shape RIPE policy is like having an arms dealer on a weapons regulation committee.

Chapter 4: Vincentas Grinius and RIPE Labs

Vincentas Grinius — CEO and co-founder of IPXO — publishes articles on RIPE Labs, RIPE's official knowledge-sharing platform. His article on "Top 3 Types of IP Address Abuse That Threaten IPv4 Resource Holders" discusses IP reputation damage from abuse — framed as a risk to IP owners rather than as harm to attack victims.

The framing is revealing. In Grinius's framework:

The problem is that IP addresses get blacklisted (damaging their lease value)
The solution is better monitoring tools (which IPXO sells)
The victim is the IP address owner/lessor

Absent from this framework: the networks being attacked. The servers being compromised. The organizations whose data is stolen. The actual victims of the abuse that IPXO's leased IPs facilitate.

RIPE Labs publishes this perspective as educational content. The CEO of a company whose leased IPs appear in bulletproof hosting operations is positioned as a thought leader on abuse prevention.

❓ What does publishing on RIPE Labs actually mean?

RIPE Labs is not peer-reviewed. It's a platform for community contribution. But it carries RIPE's institutional credibility. Being a "RIPE Labs author" positions you as a trusted voice in internet governance. It's branding as expertise — and it works. Grinius's publications are cited in policy discussions about IP address management.

Chapter 5: The ASNs That Should Have Been Revoked

Two ASNs documented in this series were allocated through RIPE's system:

AS198584 (PIO-Hosting GmbH) — allocated May 2023. Announces IP space registered in Hong Kong and Germany. Serves as transit for bulletproof hosting. Director (Dirk Bellgart) previously operated convicted bulletproof host SkyLink/AS206264. No RIPE action taken.
AS208949 (HBING LIMITED) — allocated April 2023. UK-registered company with Turkish director. Announces African (AFRINIC) space leased through IPXO. Hosts malware C2 and scanning infrastructure. No RIPE action taken.

In RIPE's entire history, ASN revocation for abuse has been effectively unheard of. The mechanism exists in policy but is never used. Deregistration happens only when members fail to pay fees or when companies formally dissolve.

❓ Could RIPE revoke these ASNs?

RIPE's membership agreement requires accurate registration data. HBING claims to operate from the UK but has no UK data center. PIO-Hosting announces space from jurisdictions (HK, VG) unrelated to its German registration. These could be characterized as inaccurate registration — grounds for review. But RIPE has never characterized bulletproof hosting as a registration data problem, despite the obvious fiction of companies "operating" in countries where they have no infrastructure.

Chapter 6: What Reform Would Look Like

Several proposals have been made in RIPE working groups over the years:

Mandatory abuse contact validation: Abuse contacts should respond within 72 hours or face escalation. Currently, abuse contacts can be dead mailboxes with no consequence.
Geographic accuracy requirements: If an ASN announces IP space, the announcing entity should have verifiable infrastructure in the stated country. "Operating" from a jurisdiction where you have no servers should trigger review.
Transfer transparency: IP transfers and leases should record the actual end-user operating the IPs, not just the intermediary (IPXO). The "Private Customer" mechanism should not apply to IP blocks with documented abuse.
Conflict of interest declarations: Committee members with commercial interests in RIPE policy outcomes should declare them. An IP leasing company executive shaping IP governance policy should be on the record.

None of these proposals have been adopted. The multi-stakeholder model means the entities that benefit from the current system vote on whether to change it.

📖 Read Between the Lines

RIPE allocates resources to any company with a registration fee. No vetting. No ongoing accountability. No revocation for abuse. This is by design, not by accident.
When IPXO places its executive on the committee that shapes allocation policy, it ensures the system that benefits IPXO won't change.
The "Private Customer" mechanism — presented as privacy protection — is the single most effective tool for shielding bulletproof hosts from identification.
RIPE's budget comes from member fees. Members who lease large IP blocks (like IPXO) pay more fees. The registry has a financial incentive not to revoke resources from its largest members.
The absence of ASN revocations isn't proof of clean networks. It's proof of an enforcement gap so wide that documented criminal infrastructure operates openly under registered ASNs.

Chapter 7: The Institutional Stack of Inaction

Our entire investigation — nine dossiers, 628 attack machines, five named individuals, three shell company jurisdictions — operates within a system where no single institution claims authority to stop it:

Institution	Claim	Reality
RIPE NCC	"We're a registry"	Registry that never revokes
Companies House (UK)	"We register companies"	Registers shells with BVI addresses
E-SIRKET (TR)	"We verify identities"	Verifies directors who never visit
123LIR	"We provide LIR services"	Enables instant ASN acquisition
IPXO	"We lease IPs"	Leases to known-abuse hosts
Law enforcement	"Insufficient evidence"	Evidence across 5+ jurisdictions = impossible
Hosting providers	"We terminated the account"	Account reopens under new name

Each institution has a narrow mandate and stays within it. The abuse lives in the gaps between mandates. Nobody is responsible for the gaps.

❓ Is this deliberate or just bureaucratic inertia?

Both. The initial architecture (RIRs as neutral registries) was designed for a cooperative internet where all participants acted in good faith. The exploitation of this architecture (by bulletproof hosts, IP speculators, and shell companies) is deliberate. The failure to reform is both bureaucratic inertia AND active resistance by parties who profit from the status quo. When the regulated entity sits on the governance committee, reform is structurally impossible from within.

Chapter 8: The Verdict

We began this investigation with a geographic discrepancy: an IP address that claimed to be in five countries simultaneously. We end with a systemic diagnosis:

The internet's numbering system is governed by organizations that have neither the mandate, the incentive, nor the will to prevent its exploitation. The result is a permanent infrastructure layer — funded, staffed, and professionally operated — that exists solely to attack everything else.

628 machines will be replaced tomorrow. The ASNs will persist. The companies will be re-registered. The people will continue operating. And RIPE NCC will continue to "just register" the resources that make it all possible.

This is not a bug. It's the architecture working exactly as designed — for everyone except the victims.

🔬 Methodology: Institutional analysis based on RIPE NCC public policies, membership agreements, and published working group records. IPXO committee appointment sourced from official IPXO blog and RIPE meeting archives. Vincentas Grinius publications from RIPE Labs. ASN allocation dates from RIPE database. Abuse report response analysis from our operational experience reporting to the entities named in this series. Reform proposals referenced from RIPE Anti-Abuse Working Group mailing list archives.

📎 Series Navigation — The Phantom ASN

026A: The Phantom ASN (Overview)
026B: The Bulletproof Archipelago
026C: The German Gray Zone
026D: The IP Marketplace
026E: The Offshore Chain
026F: The Sanctions Question
026G: The People Behind the Curtain
026H: The 628 Machines
→ 026I: The Registry That Looked Away (You Are Here)