Who Is Lu Heng Really?

I. The Question No One Asks

This is the question that every internet governance forum carefully avoids. It's the question that AFRINIC's own board couldn't answer before the institution was placed under receivership. It's the question that six years of Mauritius litigation has successfully prevented anyone from answering definitively.

But let's ask it anyway. Let's ask it the way intelligence analysts ask it — not "is this person doing something wrong?" but rather: "What is the simplest explanation that accounts for all observed behavior?"

The observed behavior:

• One man controls entities holding between 6.2 and 16 million IPv4 addresses allocated by AFRINIC
• None of these addresses are used in Africa
• The addresses are routed through 14+ autonomous systems across 8+ countries
• Every address shows cymru_country=SC (Seychelles registration) regardless of actual location
• Our honeypot data shows a threat score of 100 for the highest-activity Cloud Innovation IPs
• The controlling entity has offices in Hong Kong, Shanghai, AND Wuhan
• The same person founded a "charitable foundation" to promote his internet governance vision
• When challenged legally, the response was not to comply but to seek the dissolution of the entire institution

Now — what's the simplest explanation?

II. The Official Narrative

Lu Heng presents himself on his personal website (heng.lu) as an "Internet Governance Leader, Entrepreneur & Visionary." The biography describes a successful businessman who identified the IPv4 scarcity problem early, built a legitimate brokerage business (LARUS), and is now fighting a corrupt AFRINIC bureaucracy that unfairly revoked his address allocations.

The narrative is clean:

Every single one of these claims is factually accurate. And that's what makes the official narrative so effective — it's constructed entirely from verified facts while omitting every uncomfortable connection.

It's the architecture of omission that intelligence analysts look for.

III. The Counter-Narrative

Now let's read the same facts through a different lens. Not conspiracy theory — conspiracy analysis. The difference is that we follow evidence rather than imagination.

Two narratives. Same facts. Radically different implications.

But here's where it gets interesting: there are facts that only fit one narrative.

IV. The Wuhan Connection

According to industry publication Reboot Magazine, LARUS maintains offices in three locations:

Why Wuhan?

Wuhan is not a typical location for an IP brokerage. It's not Singapore. It's not London. It's not even Beijing or Shenzhen. Wuhan is significant for entirely different reasons:

• Wuhan National Cybersecurity Center — China's premier cybersecurity talent base, operational since 2019
• Wuhan University of Technology — One of China's designated "first-class cybersecurity schools"
• Central China Technology Hub — Home to major PLA-linked technology companies
• Optical Valley (光谷) — China's fiber optics and networking hardware cluster

For a company whose official business is "IP address management and leasing," maintaining a presence in China's cybersecurity capital requires an explanation that the official narrative doesn't provide.

V. The Volt Typhoon Parallel

In February 2024, CISA, NSA, and FBI issued Advisory AA24-038A — one of the most significant cybersecurity warnings in US history:

"People's Republic of China (PRC) state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States." — CISA Advisory AA24-038A, February 2024

The advisory describes Volt Typhoon's methodology: "The group also relies on valid accounts and leverage strong operational security, which combined, allows for long-term undiscovered persistence."

Now consider what Lu Heng controls:

We are NOT claiming Lu Heng is Volt Typhoon. That would be irresponsible speculation.

What we ARE saying: the capability that Cloud Innovation's address holdings represent is exactly the capability that Volt Typhoon would need. Sixteen million legitimate-looking IP addresses, pre-positioned globally, with no traceable connection to Chinese state infrastructure.

Our honeypot data confirms these IPs are actively used in attacks:

VI. Belt & Road: The Digital Layer

China's Belt and Road Initiative (BRI) has a digital component that is well-documented but poorly understood in terms of IP address strategy:

• Digital Silk Road — Submarine cables, data centers, 5G networks across Africa and Asia
• Huawei's submarine cables — Connecting Africa to global internet backbone
• Smart Cities programs — Chinese-built surveillance infrastructure in 18+ African cities
• IP address requirements — All digital infrastructure needs IP addresses to function

Here's what most analysis misses: you can build all the cables and data centers you want, but without IP addresses, they're useless. IP addresses are the digital equivalent of land rights. Control the addresses, control what gets routed where.

AFRINIC's service region covers ALL of Africa. Cloud Innovation holds addresses from that pool. The Digital Silk Road runs through Africa. The addresses were allocated 2013-2016 — the exact period BRI was being formalized.

The timing is either extraordinary coincidence or careful planning. Intelligence analysis has a principle: once is chance, twice is coincidence, three times is enemy action.

VII. Follow the Money

The most conspicuous unexplained fact in this entire saga: who is funding the litigation?

Since 2019, Cloud Innovation has maintained continuous legal proceedings in Mauritius against AFRINIC. This involves:

• International law firm engagement (Mauritius + UK + Hong Kong jurisdictions)
• Multiple injunction applications (won repeatedly)
• Appeals through Mauritius Supreme Court
• Potential Constitutional Court proceedings
• Parallel lobbying at ICANN, RIPE, and other RIRs

Conservative estimate for 6+ years of multi-jurisdictional litigation: $5-15 million USD.

LARUS's legitimate IP brokerage business, while profitable, operates in a market where typical profit margins are $1-5 per IP per year. Even with 10 million addresses leased, the annual revenue from IP leasing would be in the range of $10-50 million.

The value that cannot survive scrutiny is the value of unattributable routing. Once AFRINIC (or a successor) demands "prove these addresses serve African networks," the game ends. The only move is to ensure no one ever has the authority to ask.

VIII. Governance Capture as Strategy

Lu Heng's approach to AFRINIC follows a pattern that political scientists call "governance capture" — the process of neutralizing regulatory institutions not by evading them, but by destroying their ability to function:

If AFRINIC is dissolved, who inherits governance of African IP addresses? The most likely answer: nobody. Addresses become property, not community resources. And property can be bought, sold, and held by anyone — including entities with offices in Wuhan.

This is not a bug. It's the feature. The destruction of internet governance institutions is the strategic objective.

Internet Governance Project (November 2025) wrote critically: "ICANN fosters some Not-So-Smart Ideas for AFRINIC" — noting that ICANN's intervention proposals would essentially allow AFRINIC to be rebuilt under different governance. But whose governance?

IX. What If — The Hard Questions

X. Reading Between the Lines

What The Corporate Structure Tells Us

Let's map what we actually know about Lu Heng's corporate network:

Lu Heng (Person)
├── Cloud Innovation Limited (Seychelles) — holds AFRINIC allocations
├── LARUS Limited (Hong Kong) — IP brokerage
├── NRS Technology (Hong Kong, same flat as LARUS) — shell/vehicle
├── LARUS Foundation — "charitable" governance advocacy
└── Offices: Hong Kong + Shanghai + Wuhan

Cloud Innovation Sub-lessees (from our data):
├── Yisu Cloud Ltd (CN/HK) — ASN 138152, 142403
├── Scloud Pte Ltd (SG) — ASN 142002
├── UCloud (HK) — ASN 135377
├── Antbox Networks (HK) — ASN 138995
├── Hytron Network Services (HK) — ASN 151407
├── Hong Kong Zhengxing Technology (HK) — ASN 150706
├── Fastnet Data Inc (US) — ASN 8796
├── ZersNet LLC (US) — ASN 211577
├── MilesWeb (IN) — ASN 135222
└── AkileCloud (GB) — ASN 61112

Notice the pattern: every sub-lessee except MilesWeb, AkileCloud, and Fastnet is a Chinese-owned or Hong Kong-registered company. The addresses were allocated for Africa, registered in Seychelles, but the actual customer base is overwhelmingly Chinese-controlled entities.

This is not an IP brokerage serving global demand. This is Chinese infrastructure wearing African clothes.

What The Litigation Strategy Tells Us

Normal business disputes follow predictable patterns: negotiate, compromise, settle. Lu Heng's litigation against AFRINIC follows a different pattern entirely:

1. Never negotiate (no settlement attempts documented)
2. Escalate continuously (injunction → appeal → constitutional challenge)
3. Attack the institution itself (call for dissolution)
4. Fund indefinitely (no apparent budget constraint)

This pattern matches one documented type of actor: state-backed entities for whom the institution's existence is the problem, not a specific policy decision.

What The Threat Data Tells Us

Our honeypot captures direct evidence of how these addresses are actually used:

When a single IP address can simultaneously "be" in Russia, Japan, and Seychelles depending on which database you query, attribution is dead. And that's not a bug of this system — it's what the system was built to produce.

XI. The Answer That Isn't One

So: who is Lu Heng really?

The honest answer: we don't know with certainty, and that's the point.

The architecture of his corporate network is specifically designed to make this question unanswerable through normal investigation. Seychelles incorporation means no beneficial ownership disclosure. Hong Kong provides the business legitimacy layer. Mainland Chinese offices (Shanghai, Wuhan) provide the operational capability but aren't on any official company registration.

What we CAN say with high confidence:

The question "who is Lu Heng?" may be the wrong question. The right question is: "What becomes possible when one entity controls 16 million unattributable IP addresses and simultaneously destroys the only institution that could demand accountability?"

The answer to that question doesn't require knowing who Lu Heng is. It only requires looking at what his infrastructure enables.

And what it enables is exactly what Western intelligence agencies are warning about — pre-positioned capability for disruption of critical infrastructure, with no attribution possible because the addresses themselves have been divorced from geographic reality.

The Geography of Nowhere isn't just a title. It's an operational objective.