The Geography of Nowhere

Prologue: A Phone Rings in the Seychelles

On a Tuesday in May 2026, our automated RDAP enrichment pipeline extracted a phone number from a routine abuse contact record: +248-4-610-795. The IP it belonged to — 154.209.4.195 — had been hammering our SSH honeypot with brute-force attempts, deploying the mdrfckr SSH key, and probing for CPU cores to hijack for cryptocurrency mining.

Routine. Unremarkable. Except the pipeline flagged something: that same phone number appeared on twenty-two other IPs. Across fifteen different ASNs. In eight different countries.

What kind of entity has a single phone number that spans fifteen autonomous systems across eight nations?

Not a hosting provider. Not a legitimate business with international operations. The answer is simpler, and far darker: a geographic fiction factory. An entity whose entire business model is making IP addresses appear to be in places where nothing exists — no servers, no offices, no humans answering that phone.

This investigation documents what we found when we pulled that thread.

Part I: The Empire That Isn't There

The Discovery

Our enrichment pipeline extracts RDAP (Registration Data Access Protocol) records for every IP that touches our honeypot. Among the hundreds of fields, we cluster by shared phone numbers — a technique that identifies infrastructure operated by the same entity regardless of how many shell companies are layered between.

The cluster for +248-4-610-795 revealed:

If a network claims to be in the US, routes through Seychelles, and is registered in Hong Kong — where is it actually?

The answer, as we discovered, is: nowhere that has legal accountability. That's the point. That's the entire product.

The Scale

When we searched external sources for the entity behind this phone number, we found Breakglass Intelligence's investigation which documented what our automated pipeline had independently surfaced:

Cloud Innovation Ltd (Seychelles) holds AFRINIC allocation 45.192.0.0/12.

That's sixteen million, seven hundred seventy-seven thousand, two hundred and sixteen IP addresses.

Obtained from AFRINIC — Africa's Regional Internet Registry, whose mandate is to develop Internet infrastructure for Africa. Not one of these 16 million IPs routes traffic to Africa. The entire allocation is monetized through LARUS Limited (Hong Kong) as commercial hosting for cybercrime operations.

The Corporate Structure

Why Seychelles? Why not Panama, or the BVI, or any other offshore jurisdiction?

Seychelles has no data retention laws, no mandatory WHOIS disclosure, no mutual legal assistance treaties with major cyber-enforcement jurisdictions, and — critically — AFRINIC (based in Mauritius) has limited enforcement capacity over Seychelles-registered entities. The Seychelles IBC (International Business Company) Act 2016 requires almost no public disclosure of beneficial ownership. It's not just opacity — it's structural unaccountability.

Part II: The South African Straw People

Every regional Internet registry requires that IP resources be managed by identifiable humans. AFRINIC is no exception. Someone must appear in the WHOIS records as a responsible contact.

For Cloud Innovation's 16 million IPs, those contacts are all in South Africa:

Why do Dori Anne Heath and Keith Thomas share the same phone number?

Because these contacts may not be independent individuals managing separate network resources. They appear to be a straw contact cluster — people (real or fictitious) whose identities exist in WHOIS records to satisfy AFRINIC's "African presence" requirements while the actual operations run from Hong Kong through Seychelles shells.

What is De Boom Resort in Vredenburg?

Vredenburg is a small town (population ~40,000) on the West Coast of the Western Cape, South Africa. It's a fishing and agricultural center. It is not — by any reasonable measure — the operational base for sixteen million IP addresses generating attack traffic across eight countries. The "resort" address suggests either a vacation property used for postal purposes, or a mailbox service.

Do these people know what their names are attached to?

Unknown. Possibilities range from: (a) complicit participants paid to lend their identity, (b) friends/family of someone connected to the operation who agreed without full understanding, (c) entirely fabricated identities using real South African addresses and phone numbers. The shared phone number between Heath and Thomas suggests coordination — whether voluntary or not.

The beauty of a straw contact is that they provide plausible deniability in both directions: the actual operator can claim they delegated management to these contacts, and the contacts can claim they didn't understand what they were managing. Meanwhile, 16 million IPs spray malware across the Internet with no one accountable.

Part III: What the Honeypot Saw

Theory is useful. Evidence is better. Here's what Cloud Innovation's infrastructure actually did to our systems:

The mdrfckr Deployment (154.209.4.195)

Classification: BOTNET | Threat Score: 100/100 | ASN: 142403 (Yisu Cloud) | RDAP: Cloud Innovation Support

This is the mdrfckr botnet — an eight-year-old SSH parasite documented extensively in our TI-2026-025 series. It deploys a hardcoded RSA key (always the same, since 2018), changes the root password to a random string, then fingerprints the system for cryptocurrency mining suitability.

Why is an eight-year-old botnet running on infrastructure controlled by a company managing 16 million IPs?

Two possibilities: (1) Cloud Innovation's infrastructure is so bulletproof that even unsophisticated botnet operators can rent servers and operate with impunity for years, or (2) there is operational overlap between the entity managing the infrastructure and the entity deploying the malware. The shared RDAP contact (+248-4-610-795) across both the attacked IP's registration AND the IPs documented by Breakglass as hosting FatalRAT/gambling suggests option (2) is at minimum plausible.

The Behavioral Fingerprint

SSH client: SSH-2.0-libssh_0.11.1 | HASSH: 03a80b21afa810682a776a7d42e5e6fb

This HASSH fingerprint — the cryptographic signature of the SSH client's algorithm preferences — links this IP to other Yisu Cloud / Cloud Innovation IPs exhibiting identical behavior. It's not just the same company. It's the same tool, same configuration, same operator.

The WHG/HBING Pattern (Different Empire, Same Strategy)

While Cloud Innovation represents the AFRINIC axis, two British companies demonstrate the same geographic obfuscation through RIPE:

SSH fingerprint shared between WHG and HBING: 14b2ddda386a4d1006108ccd231b42fc (SSH-2.0-libssh2_1.11.0)

Why do WHG (Norwich, UK) and HBING (UK, est. 2023) share the same SSH client fingerprint across their attack traffic?

Because the same scanning tool — likely the same operator — is running on infrastructure from both providers. The HASSH match means identical client software configuration. Combined with both routing through South African address space and both using "Private Customer" as sub-registrant, this suggests a shared customer using both providers as interchangeable infrastructure, or a shared backend operator managing both providers' attack nodes.

Part IV: The IP Marketplace Problem

Between the operator (Cloud Innovation/LARUS in the East, WHG/HBING in the West) and the end-user attacking our honeypot, there's a critical intermediary: IPXO.

What IPXO Is

IPXO (formerly Heficed) is a Lithuanian company (UAB IPXO) that operates the world's largest IP address marketplace. Think of it as "Airbnb for IP addresses" — organizations with unused IP allocations can lease them to others for revenue.

Legitimate use case: a company allocated a /16 in 2003 only uses half; they lease the rest through IPXO rather than returning it to the RIR.

Actual use case (documented):

Is IPXO itself malicious?

No — and that's what makes it dangerous. IPXO is a legitimate registered company in Lithuania, operating legally within current IPv4 market regulations. They respond to abuse reports (eventually). They have terms of service. But their business model — specifically the separation of IP ownership from IP usage — structurally prevents traditional attribution. When you send an abuse report about a leased IP, you reach IPXO's incident response team, not the actual operator. The operator is a customer of a customer of the ASN holder.

How many layers are between the attacker and accountability?

Traditional WHOIS-based attribution assumes: registry → holder → user → attacker. The marketplace model breaks this into: registry → holder → marketplace → lessor → lessee → sub-lessee → attacker. Each layer is in a different jurisdiction. Each requires a separate legal process to pierce.

Part V: The PIO-Hosting Gateway

PIO-Hosting GmbH (AS198584) represents the European node in this geography of nowhere. A German company — regulated under EU law, theoretically subject to NetzDG and GDPR — yet hosting some of the most aggressive attack infrastructure in our database:

Why are Hong Kong entities (Guosheng IDC, ZEXOTEK SOLUTION) sub-leasing from a German hosting provider?

Because German hosting provides a European IP reputation (high trust scores in geolocation databases), while Hong Kong entities provide operational opacity (limited Western legal reach). The combination is deliberate: the IP address looks European (RIPE allocation, DE ASN), but is operated by a Hong Kong shell company that has no EU legal presence and cannot be served with EU court orders.

What is ZEXOTEK SOLUTION?

Based on our data: a Hong Kong-registered entity that appears on multiple IPs across PIO-Hosting with threat scores of 82-90. The name follows the pattern of "random word + solution/technology/service" seen in hundreds of Hong Kong shell companies created specifically to hold IP sub-allocations. Whether it has any physical presence, employees, or operations beyond holding RIPE database objects is unknown — and likely the answer is no.

Part VI: The Kosovo Edge Case

One operator in our data exploits a jurisdictional edge case so specific it deserves individual attention:

Why Kosovo?

Kosovo declared independence in 2008 but is not recognized by 5 EU members, Russia, China, or the UN Security Council. It has no RIPE membership of its own — it operates under "XK" as a temporary designation. It has no established cybercrime enforcement bilateral agreements with most countries. An entity claiming Kosovo presence exists in a regulatory gray zone: nominally European (geographically), but without the enforcement infrastructure that EU membership provides. It's a jurisdictional lacuna — a place that is simultaneously inside and outside the European legal framework.

Is MAXTV-SOHO a real entity?

The name suggests a small ISP or IPTV provider. In the Balkans, "SOHO" (Small Office/Home Office) ISPs are common — small operations serving a neighborhood or building. Whether MAXTV-SOHO is a legitimate small ISP whose contact information has been appropriated, or a purpose-built shell claiming Kosovo presence, our current data cannot determine. But the three-jurisdiction structure (UK ASN → BVI management → Kosovo contact → ZA routing) is not something that arises from legitimate operations.

Part VII: The Unified Model

What we've documented is not five separate stories. It's one architecture:

The Business Logic

This is not disorganized crime. It's an industrial service:

1. Acquire IP resources from registries with weak enforcement (AFRINIC) or through marketplaces (IPXO)
2. Route through maximum jurisdictions to ensure no single legal process can reach the operator
3. Sell bulletproof hosting to operators who need geographic fiction: their IPs look like they're in the US/Japan/Germany but are actually controlled from Hong Kong through Seychelles shells
4. Ignore all abuse reports because the registered abuse contact (the Seychelles phone) has no legal obligation to act, and the actual operator (Hong Kong) has no direct legal exposure in the victim's jurisdiction

Is this legal?

Individually, each step is either legal or in a gray zone. Registering a company in Seychelles: legal. Obtaining IP addresses from AFRINIC: legal (if you meet allocation criteria). Leasing IPs through a marketplace: legal. Routing traffic through multiple countries: legal. The combination — specifically designed to prevent any jurisdiction from having complete enforcement authority — is where the line between "aggressive privacy" and "facilitating cybercrime" becomes a matter for courts that can never be assembled, because no single court has jurisdiction over all the pieces.

Part VIII: What Our Pipeline Found That Humans Didn't

The critical finding of this investigation is not the existence of bulletproof hosting — that's well-documented. It's that our automated enrichment pipeline independently detected the same patterns that required months of manual investigation by specialized researchers.

Pipeline Detection vs. Manual Research

Our pipeline adds behavioral context that external research cannot: we don't just know who owns the infrastructure — we know what it does, in real-time, at the session transcript level.

Part IX: The Questions That Remain

Who is Lu Heng?

Documented as connected to Cloud Innovation and involved in AFRINIC governance. The individual — or entity — behind the corporate structure. We have the name; we don't have the complete picture of their role, their other holdings, or their relationship to the South African straw contacts.

Are the South African contacts real people or fabricated identities?

The phone numbers are real South African mobile numbers. The addresses are real South African locations. Whether the named individuals exist and are aware of their role in managing 16 million IPs is an open question that physical investigation (beyond our digital scope) would be needed to resolve.

Is there a connection between Cloud Innovation / LARUS and the WHG / HBING cluster?

Both route through South African address space. Both use "trust obfuscation" as a service model. But we have no direct evidence of shared ownership or operational coordination. They may be independent actors exploiting the same structural weakness in Internet governance — or they may share customers, infrastructure, or beneficial ownership that isn't visible in WHOIS records.

What would it take to stop this?

AFRINIC could revoke Cloud Innovation's allocation (they've tried — legal challenges in Mauritius courts blocked it). RIPE could enforce stricter sub-allocation disclosure (they won't — industry lobbying against it). Marketplace regulation could require identity verification for IP lessees (no regulatory framework exists). Or: behavioral detection systems like ours could make the geographic fiction irrelevant by identifying operators through what they do rather than where they claim to be.

Conclusions

Technical Indicators

Key Phone Numbers

Key SSH Fingerprints

Critical IP Ranges

mdrfckr SSH Key (Full)

Series Navigation

This is Part A of The Geography of Nowhere series (TI-2026-028). Upcoming:

• 028B — The LARUS Dossier: Following the Hong Kong Thread
• 028C — The Marketplace Economy: IPXO, IP Leasing, and the Death of Attribution
• 028D — The African Question: AFRINIC, Resource Capture, and Digital Colonialism
• 028E — The Norwich Connection: WHG, HBING, and the British Hosting Gray Zone