TI-2026-028B | Published: June 2026 | Series: The Geography of Nowhere | Classification: PUBLIC | Investigation: TI-2026-028
The LARUS Dossier
Following the Hong Kong Thread โ From IP Marketplace to Internet Governance Capture
The Address That Connects Everything
There is a building in Hong Kong's Tsuen Wan district โ TML Tower, 11th floor, Flat A3. In the world of Internet governance and IP address allocation, this address appears with remarkable frequency:
What is the probability that a "grassroots Internet governance advocacy organization" and a "commercial IP leasing company" independently share a single apartment in a Hong Kong tower?
Zero. The Number Resource Society (NRS) is LARUS. Or more precisely: NRS is the political arm of a commercial operation that profits directly from the governance changes NRS advocates. They want AFRINIC to recognize "IP ownership" (rather than stewardship) because LARUS manages 16 million AFRINIC-allocated IPs. If IPs become "property," Cloud Innovation's contested allocation becomes permanent and unchallengeable.
This isn't a lobbying operation. It's a governance capture attempt dressed as reform advocacy.
The Timeline: From IP Allocation to Court Receiver
Cloud Innovation Ltd (Seychelles) accumulates AFRINIC allocations totaling 45.192.0.0/12 (16M+ IPs). LARUS Limited (Hong Kong) manages all technical aspects via LARUS-SERVICE-MNT. IPs are leased to downstream ASNs: Yisu Cloud (AS138152, AS142403), Antbox Networks (AS138995), UCloud (AS135377), Scloud (AS142002), and others.
AFRINIC management writes to Cloud Innovation, noting the resources are not being used in the African region as required by allocation policies. This begins a dispute over whether AFRINIC can reclaim IP space allocated to entities that don't serve Africa. (Source: The Register, July 2023)
The Number Resource Society launches at the same TML Tower address. Its platform: IP resources are "property" not "stewardship allocations." AFRINIC's policies restricting out-of-region use are characterized as overreach. NRS begins approaching AFRINIC members to sign powers of attorney. (Source: CircleID, 2024)
NRS endorses candidates for both AFRINIC and APNIC board elections. APNIC community raises alarm about "council stacking" โ coordinated voting to install board members favorable to commercial IP interests. (Source: The Register, Feb 2023)
Cloud Innovation applies to a Mauritius court to appoint a Receiver for AFRINIC itself โ attempting to place the registry under external management. The stated aim: "restoring good governance." The practical effect: a commercial entity that profits from AFRINIC allocations would influence who manages the registry that granted those allocations. (Source: NRS Statement)
ICANN (the global Internet governance body) intervenes to defend AFRINIC against Cloud Innovation's legal challenges. The Register reports this as an "unprecedented over-reach" by ICANN into a regional registry's affairs โ indicating the severity of the threat. (Source: The Register, May 2026)
Our automated enrichment pipeline extracts phone +248-4-610-795 from RDAP records of IPs attacking our honeypot. The cluster reveals 22 IPs, 15 ASNs, 8 countries โ all routing through Cloud Innovation's AFRINIC allocation. The mdrfckr botnet operates from Yisu Cloud servers managed under LARUS-SERVICE-MNT. The legal battle over IP governance is playing out on our infrastructure in real-time.
The LARUS Business Model
LARUS Limited presents itself as a legitimate IP address solutions company. Their website offers:
- IPv4 Leasing โ rent IP addresses by the month
- IPv4 Sales โ buy IP blocks outright
- IP Management โ outsource your IP administration
- WHOIS Updates โ manage registration records
They attended Capacity Europe 2025 (the major telecoms industry conference) as an exhibitor. They have a Facebook page. They have offices in Hong Kong and Shanghai. This is not a shadowy dark-web operation โ it's a conference-attending, LinkedIn-posting, marketing-spending company.
How does a legitimate IP solutions company end up managing infrastructure that hosts FatalRAT C2, Chinese gambling operations, and the mdrfckr cryptomining botnet?
Because the business model โ "painless and fast on-demand IP address solutions" โ makes no distinction between customers who want IPs for legitimate hosting and customers who want IPs for bulletproof hosting. The service is the same: take AFRINIC-allocated IP space, create WHOIS objects showing whatever abuse contact the customer wants, route through whatever ASN the customer specifies. Whether the end-use is a WordPress blog or FatalRAT command-and-control is not LARUS's concern. They manage the IP layer, not the content layer.
This is the "infrastructure provider defense" โ the same argument that ISPs use when their networks carry malware. Except LARUS isn't carrying traffic that happens to contain malware. They're specifically managing IP registration for entities that have no purpose other than hosting criminal operations.
The Downstream Empire
Our honeypot data shows Cloud Innovation's AFRINIC space being operated through at least 14 different ASNs:
| ASN | Operator | Country | IPs in Honeypot | Avg Threat |
|---|---|---|---|---|
| AS142403 | YISUCLOUDLTD-HK (Yisu Cloud) | HK | 6 | 71 |
| AS135377 | UCLOUD-HK-AP | HK | 2 | 60 |
| AS138995 | Antbox Networks | HK | 1 | 51 |
| AS142002 | Scloud Pte Ltd | SG | 1 | 81 |
| AS138152 | YISUCLOUDLTD-HK | HK | 1 | 81 |
| AS150706 | HK Zhengxing Technology | HK | 1 | 55 |
| AS151407 | Hytron Network Services | HK | 1 | 51 |
| AS8796 | FASTNET DATA INC | US | 1 | 78 |
| AS211577 | ZERSNET LLC | US | 1 | 61 |
| AS401701 | COGNETCLOUD INC | US | 1 | 51 |
| AS55967 | Baidu (Beijing) | CN | 1 | 88 |
| AS61112 | AkileCloud (AKILE LTD) | GB | 1 | 51 |
| AS135222 | MilesWeb Internet Services | IN | 1 | 51 |
| AS59187 | Cloud Innovation Ltd (direct) | SC | 1 | 78 |
Note the pattern: the same Cloud Innovation RDAP contact (+248-4-610-795) appears across ALL of these โ regardless of which ASN announces the route. This means LARUS/Cloud Innovation manages the IP registration layer while different ASN operators handle the routing layer. A division of labor: LARUS owns the addresses, downstream ASNs carry the traffic.
Who are these downstream ASN operators? Are they customers of LARUS, subsidiaries, or something else?
The lines blur. Yisu Cloud (AS138152/AS142403) appears to be a closely affiliated entity โ its traffic routes through Cloud Innovation's AFRINIC space (cymru_country=SC for ALL Yisu IPs in our database). Antbox Networks is documented by Breakglass Intelligence as hosting FatalRAT C2 on the same infrastructure. UCloud, Scloud, HK Zhengxing, Hytron โ these Hong Kong entities share the architectural signature of having their own ASN but using Cloud Innovation IP space. They may be independent customers, or they may be different front-ends for the same operation.
The LARUS Foundation
Cloud Innovation's website mentions "LARUS Foundation" โ a charitable arm that receives donations for "development of Internet in Africa." This is the stated justification for holding 16 million AFRINIC-allocated IPs: the resources nominally support African Internet development.
Does any evidence suggest LARUS Foundation actually develops Internet infrastructure in Africa?
Our data shows: every Cloud Innovation IP in our honeypot database has cymru_country=SC (Seychelles) โ meaning they're BGP-announced through Seychelles, not through any African country. Their abuse contacts claim HK, US, JP, CN, RU, BR, IN, TR โ but never any African nation. The allocation was obtained from AFRINIC (Africa), routes through Seychelles (an island nation with no terrestrial connection to continental Africa), and serves customers in Asia and the West. The "charitable" purpose appears to be a legal fiction maintaining AFRINIC compliance.
"It was Cloud Innovation who applied to the court to appoint a Receiver for AFRINIC in 2023, with the aim of restoring good governance."
โ NRS Statement on AFRINIC Challenges
The entity that uses African IP resources for non-African commercial hosting attempted to place the African registry itself under court receivership. The entity that allegedly develops African Internet asked a court to effectively take control of Africa's Internet governance body. The fox didn't just raid the henhouse โ it filed papers to become the farmer.
The Geographic Fiction in Practice
Every IP in our database connected to Cloud Innovation exhibits the same geographic impossibility:
This is not accidental misconfiguration. This is geographic obfuscation as a service. Each IP is given whatever geographic identity the downstream customer needs โ Japanese, Russian, Turkish, Brazilian, American โ while all routes ultimately trace back through Seychelles BGP space managed from Hong Kong.
Why would a hosting customer need their IPs to appear Japanese when they're really in Hong Kong?
Geolocation databases (MaxMind, IP2Location) determine which country an IP "belongs to" for purposes of: content delivery network routing, geo-restricted content access, advertising targeting, and โ critically โ abuse report routing. An IP geolocation of "Japan" means abuse reports go to Japanese CERTs, which may have no jurisdiction over a Seychelles company operating from Hong Kong. The geographic fiction doesn't just obscure the operator's location โ it actively misdirects enforcement to jurisdictions that cannot act.
What LARUS Means for Internet Governance
The LARUS/Cloud Innovation/NRS complex represents something more dangerous than bulletproof hosting. It represents a structural challenge to the Internet's governance model.
The Internet Governance Threat Model
The current Internet governance system (ICANN โ RIRs โ LIRs โ end users) is based on a fundamental assumption: that organizations obtaining IP resources will use them in the region they were allocated for, in ways that serve the Internet community. Cloud Innovation proved this assumption wrong at a scale of 16 million addresses.
Their response isn't to comply with allocation policies โ it's to change the governance rules through NRS advocacy, board election campaigns, powers of attorney collection, and court receivership applications. If IP addresses become "property" (NRS's core platform), then:
- AFRINIC cannot reclaim allocations used outside Africa
- All RIRs lose enforcement authority over allocation compliance
- IP space becomes a purely financial asset to be traded, leased, and monetized regardless of region or use
- The entire concept of "regional" Internet registries becomes meaningless
Is this just about one company's allocation, or about the future of Internet governance itself?
Both. Cloud Innovation's legal battle is the test case. If a Mauritius court rules that AFRINIC cannot revoke allocations to entities not serving Africa, then the governance model is effectively dead globally. RIPE, ARIN, APNIC, and LACNIC all have similar policies requiring regional justification. A precedent in one region rewrites the rules everywhere. ICANN's direct intervention (May 2026) signals they understand the stakes.
Our Evidence: The Operational Layer
What external research cannot see โ and what our honeypot provides โ is the operational reality of this infrastructure. Not just who owns it, but what it does:
| Metric | Cloud Innovation IPs in Honeypot |
|---|---|
| Total IPs observed | 20+ |
| Highest threat score | 100/100 |
| Average threat score | 66.3 |
| Total honeypot hits | 243+ |
| Successful SSH logins (honeypot) | Yes (mdrfckr deployment observed) |
| Malware deployed | mdrfckr SSH key (persistence for cryptomining) |
| TTPs observed | Persistence, defense evasion, reconnaissance, credential access |
| Behavioral classification | BOTNET (automated, persistent) |
| SSH client | SSH-2.0-libssh_0.11.1 |
| HASSH fingerprint | 03a80b21afa810682a776a7d42e5e6fb |
This is not theoretical abuse. This is an entity managing 16 million IP addresses, fighting in courts to reshape Internet governance, attending industry conferences โ whose infrastructure is actively deploying malware on our honeypot in real-time.
The same corporate structure that argues for "IP ownership" rights in Mauritius courts uses those IPs to deploy eight-year-old SSH parasites that steal computing resources for cryptocurrency mining.
The governance argument says: "We should own these IPs as property."
The honeypot shows: "We use these IPs to steal other people's computing resources."
The contradiction is the finding.
Conclusions
1. LARUS/NRS Represents Governance Capture, Not Governance Reform
CONFIDENCE: HIGH
The NRS shares an address with LARUS. LARUS manages Cloud Innovation's IPs. Cloud Innovation applied to put AFRINIC into receivership. NRS advocates for policy changes that would permanently protect Cloud Innovation's allocation. This is a commercial entity using a "governance reform" front to protect its revenue stream.
2. The Scale Exceeds Previous Documentation
CONFIDENCE: HIGH
45.192.0.0/12 is 16,777,216 IP addresses. All evidence indicates zero African use. All evidence indicates complete monetization as bulletproof hosting for cybercrime. This is the largest documented case of RIR allocation abuse.
3. The Legal Strategy Is Working
CONFIDENCE: HIGH
Cloud Innovation still holds the allocation (June 2026). ICANN had to intervene directly. The court proceedings in Mauritius continue. NRS continues advocacy. The infrastructure continues operating. Six years after AFRINIC noticed the problem, the IPs still route to non-African cybercrime hosting.
4. Our Pipeline Provides Operational Ground Truth
CONFIDENCE: HIGH
While governance debates happen in conference rooms and courts, our honeypot observes what the infrastructure actually does: deploy malware, brute-force SSH, mine cryptocurrency. The gap between the legal argument ("IP ownership rights") and the operational reality ("botnet infrastructure") is documented in our session transcripts.
Series Navigation
The Geography of Nowhere (TI-2026-028)
- 028A โ The Geography of Nowhere (Overview)
- 028B โ The LARUS Dossier (You are here)
- 028C โ The Marketplace Economy: IPXO and the Death of Attribution (Next)
- 028D โ The African Question: AFRINIC, Resource Capture, and Digital Colonialism
- 028E โ The Norwich Connection: WHG, HBING, and the British Gray Zone
โข TI-2026-025 โ The SSH Parasite (mdrfckr botnet operating on this infrastructure)
โข TI-2026-020D โ The Seychelles Veil (offshore hosting patterns)
โข TI-2026-021A โ The Nowhere Registry (WHOIS manipulation techniques)
Investigation TI-2026-028 | Data sources: LSN Honeypot, RDAP enrichment pipeline, The Register, CircleID, Breakglass Intelligence, NRS.help, LARUS.net, Internet Archive
All data from direct observation or publicly available sources.