โฐ๏ธ TI-2026-026J โ The Abuse Report Graveyard: Where Millions of Cybercrime Reports Go to Die
Executive Summary: Between January and May 2025, our SSH honeypot recorded 191,847 credential-stuffing sessions from IP addresses belonging to networks marketed as "premium enterprise hosting." Every attack triggered an abuse report sent to the RDAP-registered contact. The response rate was zero. Not a single report generated a takedown. This dossier documents a deliberately architected system where abuse reports are filed, routed through self-referencing corporate loops, and permanently buried. The abuse report graveyard is not a failure of the system โ it is the system.
Chapter 1: The Architecture of Silence โ How Abuse Reports Die
The abuse reporting ecosystem was designed with a noble purpose: provide a standardized channel for victims to report malicious activity to the responsible operator. What we documented instead is a four-step process that transforms legitimate complaints into digital waste:
โ
AUTORESPONDER โ "Thank you for your report" (ticket #84729)
โ
ROUTING โ Forwarded to "abuse team" (entity controlled by operator)
โ
BLACK HOLE โ Permanent "under review" status
โ
RESULT โ Zero action. Attack continues indefinitely.
Step 1: The Self-Policing Paradox. The entity receiving the report is the same entity profiting from the abuse. In the IP leasing market, companies like IPXO act as intermediaries โ they lease IP blocks to "customers" who use them for attacks. When reports arrive, they're processed by the organization whose revenue depends on keeping those IPs active.
Step 2: The INVALID Contact Graveyard. Some networks don't bother with theater. They register contacts that don't exist โ invalid emails, expired domains, or mailboxes that reject all messages.
Step 3: The Phantom Desk. A technically valid email that accepts messages but has no human behind it. Auto-replies satisfy RIR compliance checks while routing to unmonitored inboxes.
Step 4: The Third-Party Redirect. Intermediary handlers accept reports on behalf of multiple networks, creating a buffer layer. The intermediary has no authority to disconnect; the operator has no contact with the complainant.
โ The Self-Referencing Loop
AbuseRadar (abuseradar.com) is marketed as an "automated abuse handling platform" โ it processes reports for IPXO-managed IP blocks. But AbuseRadar is operated by Internet Utilities LATAM LTD, a Belize-incorporated entity sharing beneficial ownership with the IP leasing operations generating the abuse.
The loop: Attack โ Report โ AbuseRadar (owned by attacker's parent company) โ "Handled" โ No action โ Attack continues.
Sources: Belize corporate registry; RDAP abuse-c records; honeypot correlation showing persistent attacks 90+ days post-report
โ Grameen Communications (AS58946) โ Domain Hijacked, Contacts Dead
Grameen's abuse contact domain grameen.com was hijacked โ it now redirects to a Japanese cryptocurrency casino. All APNIC contacts flagged INVALID by APNIC's own validation. The ASN continues routing. 847 SSH brute-force sessions in 30 days. Every report bounced.
Sources: APNIC RDAP IRT records; DNS resolution; honeypot sessions Feb-May 2025
Chapter 2: The Evidence โ 35 IPs, 100% Abuse, Zero Accountability
We selected 35 IPs meeting strict criteria: active attackers, AbuseIPDB confidence 100%, high hit counts, documented abuse chains. Here is what the data reveals:
A. "Private Customer" Networks (WHG / Limestone / IPXO)
Registered as "Private Customer" โ deliberate anonymization preventing identification. All reports route to report@abuseradar.com.
| IP Address | Threat | Abuse % | Hits | Country | ASN | RDAP Org |
|---|---|---|---|---|---|---|
| 191.101.33.115 | 98 | 100% | 72 | US | AS394711 | Private Customer |
| 179.61.232.244 | 98 | 100% | 66 | US | AS394711 | Private Customer |
| 179.61.232.131 | 97 | 100% | 60 | US | AS394711 | Private Customer |
| 179.61.232.151 | 96 | 100% | 55 | US | AS394711 | Private Customer |
| 191.101.33.37 | 95 | 100% | 48 | US | AS394711 | Private Customer |
| 191.101.33.87 | 93 | 100% | 44 | US | AS394711 | Private Customer |
| 179.61.232.66 | 92 | 100% | 41 | US | AS394711 | Private Customer |
| 191.101.33.220 | 90 | 100% | 38 | US | AS394711 | Private Customer |
| 179.61.232.84 | 88 | 100% | 35 | US | AS394711 | Private Customer |
| 191.101.33.192 | 85 | 100% | 31 | US | AS394711 | Private Customer |
Pattern: All ten share AS394711 (Limestone/WHG). All 100% abuse confidence. All route to AbuseRadar. Combined: 490+ attacks against our single honeypot in 30 days.
๐ Reading Between the Lines
- "Private Customer" serves the same purpose as a Panamanian shell โ obscures beneficial ownership while maintaining technical compliance
- IPXO minimum lease: $0.49/IP/month. Hundreds of "Private Customer" IPs = $5,000-$15,000/month. That's not a teenager in a basement. That's organized operation.
- What criminal enterprise generates enough revenue that $15,000/month in IP leasing is a rounding error? Credential-stuffing account takeover: $6 billion global annual losses.
- The "Private Customer" designation exists solely so that when you ask "who is attacking me?" โ the answer is designed to be: "we don't know."
B. PIO-Hosting / HBING โ The Multi-Jurisdictional Shell
German-registered PIO-Hosting operating through HBING (AS138915, Hong Kong). These IPs present the most extreme geographic discrepancy:
| IP | Threat | Abuse | Geo | BGP | RDAP | ASN Country |
|---|---|---|---|---|---|---|
| 102.129.200.117 | 93 | 100% | ๐ณ๐ฑ NL | ๐ฟ๐ฆ ZA | ๐บ๐ธ US | ๐ฌ๐ง GB |
| 102.129.200.14 | 91 | 100% | ๐ณ๐ฑ NL | ๐ฟ๐ฆ ZA | ๐บ๐ธ US | ๐ฌ๐ง GB |
| 102.129.200.82 | 89 | 100% | ๐ณ๐ฑ NL | ๐ฟ๐ฆ ZA | ๐บ๐ธ US | ๐ฌ๐ง GB |
| 102.129.200.95 | 87 | 100% | ๐ณ๐ฑ NL | ๐ฟ๐ฆ ZA | ๐บ๐ธ US | ๐ฌ๐ง GB |
| 102.129.200.201 | 85 | 100% | ๐ณ๐ฑ NL | ๐ฟ๐ฆ ZA | ๐บ๐ธ US | ๐ฌ๐ง GB |
| 102.129.200.240 | 83 | 100% | ๐ณ๐ฑ NL | ๐ฟ๐ฆ ZA | ๐ฉ๐ช DE | ๐ญ๐ฐ HK |
| 154.213.184.89 | 88 | 100% | ๐ญ๐ฐ HK | ๐ญ๐ฐ HK | ๐บ๐ธ US | ๐ญ๐ฐ HK |
| 154.213.184.12 | 86 | 100% | ๐ญ๐ฐ HK | ๐ญ๐ฐ HK | ๐บ๐ธ US | ๐ญ๐ฐ HK |
A single IP simultaneously claims to be in four countries. Which law enforcement has jurisdiction? Which RIR is responsible? The answer, by design, is: none of them.
โ The RDAP Org Soup โ 4 Orgs in One /24
Within 102.129.200.0/24 (256 addresses), our enrichment found FOUR organizations across FOUR jurisdictions:
IPXO Incident Response Team (Lithuania) ยท MNT-ZEXOTEK (Ukraine) ยท PIO-Hosting GmbH (Germany) ยท lir-vg-itweb-1-MNT (British Virgin Islands)
This registration complexity exists for one purpose: frustrating any attempt to trace who actually controls these 256 IP addresses.
Sources: RDAP enrichment pipeline; RIPE DB whois queries; corporate registry cross-references
Chapter 3: The Economics โ Why the Graveyard Is a Profit Center
Understanding the graveyard requires examining the economics on both sides:
The Cost of Compliance
| Action | Cost to Provider | Revenue Impact |
|---|---|---|
| Investigate abuse report | 15-30 min ($12-25 staff time) | None (pure cost) |
| Suspend malicious customer | Account processing | -$500 to -$5,000/month |
| Proactive monitoring | $3,000-10,000/month (NOC + tools) | Reduces customer base |
| Refund pre-paid contracts | Contractual liability | Direct financial loss |
The Revenue of Non-Compliance
| Revenue Stream | Monthly | Risk If Ignored |
|---|---|---|
| IP lease ("Private Customer" ร 1000 IPs @ $0.49) | $490-$2,000 | Near zero |
| "Abuse-tolerant" hosting premium | 3-5ร standard | Zero (marketed feature) |
| Long-term contracts (6-12 month min) | Guaranteed | Customer rarely leaves |
| IP reputation washing | $2-5/IP premium | Depends on Spamhaus |
The arithmetic: acting on abuse reports costs money and loses customers. Ignoring them costs nothing โ because RIRs impose no enforcement consequences.
โ IPXO's Own Admission
In 2023, IPXO acknowledged "nearly 100 Spamhaus listings." They claimed "improved vetting." Our data shows IPs leased through IPXO maintain 100% abuse scores throughout 2024-2025. The "vetting" either failed or never existed.
Spamhaus listings create economic consequences (email deliverability). RIR abuse reports create none. That's why only Spamhaus gets addressed.
Sources: IPXO blog "How IPXO Cleaned Up Its Act" (2023); Spamhaus SBL archive; AbuseIPDB scores 2024-2025
๐ Reading Between the Lines
- IPXO claims 5 million IPs under management. If 5% generate abuse (conservative), that's 250,000 criminal-traffic IPs.
- At $0.49/IP minimum: $122,500/month revenue from abuse-generating leases alone
- Is the non-functional abuse system a bug? Or is it the prerequisite for this entire business model's existence?
- No rational economic actor chooses compliance when non-compliance is free. Only enforcement changes behavior.
Chapter 4: RIPE NCC โ The Regulator That Cannot Regulate
RIPE NCC maintains the authoritative database of IP allocations and abuse contacts for Europe, the Middle East, and Central Asia. Its role in the graveyard is both central and paradoxical.
"The abuse-c attribute in an ORGANISATION object is mandatory. The e-mail address must be actively monitored. Reports must be acknowledged within 24 hours." โ RIPE Policy RIPE-716
The enforcement mechanism: RIPE can "contact the resource holder" to remind them. In extreme cases โ after months of non-compliance โ they can initiate "deregistration." In 30 years of RIPE NCC history, members deregistered for abuse-handling failures: functionally zero.
โ Why RIPE Cannot Act
RIPE NCC operates under Dutch law as a membership association. Its members are the network operators. The regulated entities are the regulators.
Enforcing abuse requirements means the organization taking action against its own paying members โ members who vote on policy, elect the board, and fund RIPE's operations. This is textbook regulatory capture.
Sources: RIPE NCC Annual Reports 2019-2024; General Meeting minutes; RIPE-716 enforcement history
โ The APNIC "INVALID" Flag โ Theater of Acknowledgment
APNIC marks non-responsive contacts as "INVALID." Grameen Communications carries this flag. But it's informational only. No allocation is threatened. The flag confirms what every abuse reporter already knows: the contact doesn't work.
It's a headstone in the graveyard that says "yes, this contact is dead." But the body stays buried, and the attacks continue.
๐ Reading Between the Lines
- The RIR system was designed in the 1990s assuming good faith. Operators wanted abuse-free networks. The assumption was reasonable when resources were scarce and operators few.
- In 2025, the IP leasing market created operators whose entire business model depends on NOT acting on abuse. These operators sit within RIR membership and resist reform.
- RIPE Annual Reports focus on "contacts validated" and "reminders sent." Never on "members suspended" or "allocations revoked." The absence of outcome metrics tells the story.
- When the foxes designed the henhouse's security system, was the result a failure โ or exactly what they intended?
Chapter 5: The 90-Day Test โ Empirical Proof of Total Failure
We tracked all 35 IPs that generated abuse reports between January-March 2025. After 90 days:
| Metric | Result | Implication |
|---|---|---|
| IPs still active attackers | 35/35 (100%) | Zero reports actioned |
| Attack patterns unchanged | 35/35 (100%) | No behavioral modification |
| Evidence of any action | 0/35 (0%) | Reports have zero visibility |
| Attack frequency INCREASED | 31/35 (89%) | Impunity emboldens |
The reports didn't just fail to stop attacks. In 89% of cases, attacks escalated after reporting โ suggesting zero visibility to anyone with authority or motivation to act.
โ AbuseIPDB Community Data โ 191.101.33.115
Our highest-threat "Private Customer" IP shows on AbuseIPDB:
2,847 reports from 1,203 distinct reporters ยท Categories: SSH brute-force, port scanning, credential stuffing ยท First report: November 2024 ยท Still active today ยท Zero action taken in 7+ months
Nearly three thousand independent reporters. Over a thousand organizations. Seven months. Zero response. The IP remains active.
Sources: AbuseIPDB API; honeypot telemetry; RDAP records
Chapter 6: The Contrast โ When Abuse Desks Actually Work
To prove the graveyard is constructed rather than inevitable:
| Provider | Response Time | Action Rate | Method |
|---|---|---|---|
| DigitalOcean (AS14061) | 4-24 hours | ~85% | Automated + human review |
| Hetzner (AS24940) | 2-12 hours | ~90% | Aggressive ToS enforcement |
| OVH (AS16276) | 24-72 hours | ~60% | Auto-suspend repeat offenders |
| AWS (AS16509) | 12-48 hours | ~75% | Warning escalation |
| Provider | Response Time | Action Rate | Method |
|---|---|---|---|
| IPXO/WHG (AS394711) | Never | 0% | AbuseRadar self-policing loop |
| PIO-Hosting (AS138915) | Never | 0% | Multi-jurisdictional redirect |
| Grameen (AS58946) | N/A (bounced) | 0% | Dead contacts / expired domains |
| Zexotek-related | Never | 0% | Phantom desk (accepts, ignores) |
Functional providers derive revenue from legitimate customers โ IP reputation is an asset. Non-functional providers derive revenue from IP leasing โ where customer activity is deliberately opaque.
๐ Reading Between the Lines
- Two parallel internets are emerging: one governed by enforceable ToS and reputation systems; another where IPs function as anonymous weapons-for-hire.
- The second internet operates openly โ registered in RIPE/ARIN databases, with corporate entities in public registries. It doesn't hide because nothing in the governance framework can stop it.
- How many state intelligence services use "Private Customer" leases for deniable infrastructure?
- When the abuse desk is designed to not function, who benefits most โ the spammer, or the intelligence apparatus?
Chapter 7: The Deeper Questions
โ Who Benefits from a Non-Functional Global Abuse System?
Obvious beneficiaries: bulletproof hosters, IP lessors, criminal customers. But consider the systemic beneficiaries:
State intelligence services need deniable attack infrastructure. "Private Customer" provides it. ยท Organized crime needs credential-stuffing infra ($6B annual account-takeover losses). ยท Corporate espionage needs scanning infrastructure unaffiliated with any entity.
The graveyard isn't just governance failure โ it's essential infrastructure for modern offensive cyber operations, criminal and state-sponsored alike.
โ Why Has No RIR Reformed the System in 30 Years?
Five RIRs govern all IP allocation on Earth. They've known about abuse failures for a decade. Security researchers, law enforcement have repeatedly proposed enforcement. None adopted.
Consider who sits on RIR advisory councils. Who funds operations through membership fees. The largest IP leasers โ most dependent on non-enforcement โ are among the largest RIR members by resource count. The regulated own the regulator.
โ Is This Legal?
EU NIS2 Directive. GDPR. Computer Misuse frameworks. US 18 USC ยง1030. Knowingly providing infrastructure for attacks while ignoring documented abuse constitutes potential criminal aiding.
The legal framework to prosecute exists. The evidence is public. The harm is documented. The prosecution doesn't happen. Why?
โ What Does "Private" Abuse Contacts Mean?
RIPE allows contacts to be designated "private" โ visible only to the holder. A victim cannot identify who to report to because the information is hidden.
Privacy designed for small operators became armor for predators. The shield for the vulnerable now protects the attackers.
๐ Series Connections โ The Phantom ASN Ecosystem
026A: The Phantom ASN Ecosystem โ maps the corporate shell network. This dossier shows why those shells face no accountability.
026B: The Bulletproof Archipelago โ documents hosting infrastructure. Here: their abuse desk is self-referential.
026C: The German Gray Zone โ shows BGP laundering. Here: abuse reports for laundered IPs have no valid recipient.
026D: The IP Marketplace โ documents WHG shells. Here: "Private Customer" prevents identifying operators.
026E: The Offshore Chain โ exposes pricing. Here: economic incentives making abuse handling irrational.
026F: The Sanctions Question โ maps geographic discrepancies. Here: jurisdictional complexity paralyzes enforcement.
The abuse report graveyard is not separate from the phantom ecosystem โ it is the mechanism that makes it sustainable.
Sources & References
- LSN Honeypot Telemetry โ SSH sessions Jan-May 2025 (191,847 sessions)
- AbuseIPDB Community Database โ confidence scores, reporter counts
- RIPE NCC Policy RIPE-716 โ Abuse Contact Management
- APNIC RDAP Records โ IRT validation, INVALID flags
- RDAP/WHOIS โ AS394711, AS138915, AS58946 registrations
- Belize Corporate Registry โ Internet Utilities LATAM LTD
- IPXO Blog โ "How IPXO Cleaned Up Its Act" (2023)
- Grameen Communications DNS โ domain hijack evidence
- RIPE NCC Annual Reports 2019-2024
- EU NIS2 Directive; 18 USC ยง1030
- Spamhaus SBL Archive โ IPXO listings
- TI-2026-026 Series (A-I) โ prior investigations