031G — The AFRINIC Extraction

How a Seychelles Shell Company Captured 16 Million African IP Addresses — and Weaponized the Courts to Keep Them

The Allocation: 45.192.0.0/12

To understand the scale: Seychelles has approximately 100,000 residents. Cloud Innovation holds 167 IPs per Seychelles citizen. Multiple African nations — nations within AFRINIC's actual service region — have fewer total allocated addresses than this single Seychelles shell company obtained from their regional registry.

AFRINIC's purpose is to manage IP resources for the African continent. Its need-based allocation policy requires demonstrable African network presence. How a Seychelles entity with zero African routing obtained a /12 is itself a governance failure — but what happened next was unprecedented.

The Network: How 16M IPs Become Attack Infrastructure

In our threat intelligence database, we track 43 IPs with rdap_org = "Cloud Innovation Support". These 43 IPs are delegated to 23 different downstream operators:

The Litigation: Weaponizing Courts Against Internet Governance

In 2020, AFRINIC detected that Cloud Innovation's allocated resources were not being used in accordance with African regional policy. The sequence that followed:

The Strategy: How Institutional Capture Works

Cloud Innovation's approach is not merely litigation. It is a multi-vector institutional capture strategy:

1. Litigation Overwhelm

25+ lawsuits in Mauritius (AFRINIC's host country) create prohibitive legal costs. AFRINIC — a non-profit managing African Internet resources — must fund defense across dozens of proceedings simultaneously. The legal fees alone threaten organizational viability.

2. Jurisdictional Arbitrage

Cloud Innovation is Seychelles-registered. AFRINIC is Mauritius-based. The IP resources route through Hong Kong (LARUS). No single jurisdiction has authority over all parties. Each court sees only a fragment of the full structure.

3. Governance Capture

The powers-of-attorney campaign sought to accumulate enough member votes to control AFRINIC's board — effectively capturing the regulatory body that governs African IP resources. If successful, Cloud Innovation would have controlled both the resources and the body authorized to reclaim them.

4. Receiver Application

Filing for a court-appointed receiver over AFRINIC would place the entire African Internet registry under judicial control — initiated by the entity whose resources were terminated for policy violation. The plaintiff becomes the administrator of the organization that sanctioned them.

The Person: Lu Heng

Documented sources (EverybodyWiki, BTW Media) connect Lu Heng to Cloud Innovation Limited. Cloud Innovation's own website describes partnership with LARUS Limited, established 2013. Lu Heng appears in context of AFRINIC elections and governance controversies.

Confidence: MEDIUM. Direct beneficial ownership documentation has not been independently verified. However, the operational chain (Lu Heng → Cloud Innovation → LARUS → downstream operators) is consistently documented across multiple sources.

The Downstream Impact: Our Honeypot Evidence

Of the 43 Cloud Innovation IPs in our database:

The top attacker — 154.209.4.195 — has threat score 100, abuse score 100, 64 honeypot hits. Its RDAP says "Cloud Innovation Support." Its BGP routing says "YISU CLOUD LTD, HK." Its geolocation says "Hong Kong." Its AFRINIC allocation says "African regional resource."

This is the extraction made material: African Internet resources, allocated for African development, routed through Hong Kong, monetized by Chinese operators, generating attack traffic against global targets, with zero benefit to Africa.

The Systemic Question

AFRINIC's five Regional Internet Registries (RIRs) manage the global allocation of IP addresses as a public trust. The principle: resources are allocated based on demonstrated need within the region, and may be reclaimed if policy compliance fails.

Cloud Innovation tested whether this principle survives contact with determined, well-funded litigation in a small-island jurisdiction. The answer — requiring 5 years, 25+ court cases, and ICANN intervention — is: barely.

The deeper question: if one entity can capture 16 million African IP addresses through legal maneuvering, what prevents the same strategy at other RIRs? APNIC, RIPE, ARIN, and LACNIC each face the same vulnerability — their governance mechanisms were designed for good-faith participants.