The Jurisdictional Arbitrage Machine
๐ Part G of the Kill Chain Economy series โ TI-2026-035
There is a phone number in the Seychelles. +248-4-610-795. It appears in RIPE NCC registration records for more than fifteen Autonomous System Numbers. Those ASNs control sixteen million IP addresses. Those IP addresses route through European and American data centers. Zero traffic goes to Africa.
The phone belongs to a registered agent office. The office creates companies for clients. The clients are never disclosed. The companies control ASNs. The ASNs control IP addresses. The IP addresses host whatever the client wants โ bulletproof hosting, ransomware C2, VPN exits, surveillance vendor infrastructure, or nothing at all (address space to be leased).
This is not a crime. Every step is legal in the jurisdiction where it occurs. The phone is legal. The agent is legal. The company is legal. The ASN is legal. The IP addresses are legal. The hosting is legal. And the result โ sixteen million IP addresses with no identifiable beneficial owner โ is the foundational infrastructure of everything documented in this series.
Welcome to the machine.
Component 1: The Shell
๐ Opacity Jurisdictions and Their Products
| Jurisdiction | Product | Cost | Time | Disclosure Required |
|---|---|---|---|---|
| ๐ธ๐จ Seychelles | IBC (International Business Company) | $500-1,500 | 48 hours | No beneficial ownership register |
| ๐ป๐ฌ British Virgin Islands | BVI Business Company | $1,000-2,500 | 3-5 days | Register exists since 2023; enforcement minimal |
| ๐ต๐ฆ Panama | Sociedad Anรณnima | $1,500-3,000 | 5-10 days | Bearer shares abolished 2015; nominees still legal |
| ๐ง๐ฟ Belize | IBC | $500-1,000 | 24-48 hours | No public register |
| ๐ฐ๐ณ Nevis | LLC | $1,000-2,000 | 3-5 days | No public register; $100K bond to challenge ownership |
Source: [OSINT-LIB] US Treasury NPFRA 2024, FATF mutual evaluations, formation agent pricing (public rate cards). Seychelles: Companies Act 1994 (amended 2003). [XREF] TI-2026-026 (Phantom ASN), 027 (Corridors).
Five hundred dollars. Forty-eight hours. No disclosure. That's what it costs to become invisible.
A Seychelles IBC requires: a registered agent (the phone number), a registered office (the agent's address), and a filing fee. It does not require: the name of the person who owns it, the purpose of the company, any ongoing reporting, or any connection to the Seychelles whatsoever. The company exists on paper in Victoria, Seychelles. Its operations can be anywhere. Its bank accounts can be anywhere. Its ASN registrations can be anywhere.
And the Nevis LLC has a feature that reads like satire: to challenge the ownership of a Nevis LLC in court, the challenger must first post a $100,000 bond. This means that even if you know a Nevis LLC is being used for criminal purposes, you need $100,000 cash before a court will even look at your challenge. The jurisdiction has monetized its own impenetrability.
๐ The formation agent's perspective
Q: Does the formation agent know what the shell company will be used for?
A: Legally, no. Seychelles law requires the registered agent to perform basic due diligence (identification of the client), but the standard is: passport copy, utility bill, signed declaration of lawful purpose. The declaration says "this company will be used for lawful purposes." The agent files it. Whether the company is used for ASN ownership, money laundering, sanctions evasion, or intelligence operations is not the agent's concern โ legally, practically, or financially.
Q: How many formation agents serve the entire opacity market?
A: Surprisingly few. The Panama Papers (2016) revealed that one firm โ Mossack Fonseca โ had created 214,488 shell entities across 21 jurisdictions. The industry is concentrated. A handful of firms in each opacity jurisdiction serve the global demand. This means the formation agents are chokepoints: they know every client. They hold every passport copy. They have the beneficial ownership information that no register requires them to disclose. The data exists โ it is just not accessible.
Q: Could regulation solve this?
A: The UK created a beneficial ownership register (Companies House, 2016). Transparency International found it riddled with false entries โ companies listing beneficial owners as "Mickey Mouse" or addresses that don't exist. The register exists. The verification does not. BVI created a register in 2023. Enforcement data is not yet available. FATF grey-lists non-compliant jurisdictions โ but the Seychelles, which serves our corpus's shell network, was removed from the grey list in 2020 after "reforms." The reforms changed the law. They did not change the practice.
Component 2: The LIR
๐๏ธ Local Internet Registries: Institutional Legitimacy on Demand
- What it is: A Local Internet Registry (LIR) is an organization that receives IP address blocks and ASN assignments from a Regional Internet Registry (RIPE NCC, ARIN, APNIC, AFRINIC, LACNIC).
- What it costs: RIPE NCC membership: โฌ1,400/year + โฌ50 sign-up fee.
- What it provides: The ability to register ASNs and receive IP allocations directly from RIPE. Institutional legitimacy โ "we are a RIPE member" โ which is globally recognized.
- What it does not require: Verification that the LIR actually operates network infrastructure. A LIR can exist solely to register ASNs for third parties.
- LIR sponsoring: A LIR can "sponsor" ASN registrations for non-members. The non-member gets the ASN; the LIR takes a fee. The LIR's name appears in RIPE records, lending its institutional credibility to the sponsored entity.
Source: RIPE NCC policy documents, LIR membership requirements. [XREF] TI-2026-023 (M247 LIR sponsoring), 030 (1337 Services/LAIN sponsoring).
โฌ1,400 per year. That is the price of institutional legitimacy in internet governance.
A RIPE NCC LIR membership transforms a shell company into a recognized internet participant. The Seychelles IBC that cost $500 to create can now register ASNs, receive IP address blocks, and appear in global routing tables as a legitimate infrastructure provider. RIPE NCC does not verify that the LIR operates any infrastructure. It verifies that the membership fee was paid.
Julian Achter (LAIN), documented in TI-2026-030, sponsors ASNs through German LIR infrastructure for 1337 Services GmbH โ which operates Tor exits, phishing relay, and darknet hosting. The LIR sponsoring creates a layer of institutional legitimacy: "This ASN is registered through a RIPE-accredited LIR in Germany." The fact that the ASN hosts criminal infrastructure is not visible in the RIPE record. The LIR is the makeup that makes the shell company presentable.
Component 3: The ASN Lease
๐ฆ ASN Leasing: Separating Ownership from Operations
| Layer | Who | Visible In | Accountability |
|---|---|---|---|
| Beneficial owner | Unknown (behind shell company) | Nothing | None |
| Shell company | Seychelles/BVI IBC | Formation agent records only | None (no disclosure) |
| LIR sponsor | German/Dutch LIR | RIPE NCC records | Membership fee paid โ |
| ASN holder | Shell company (via LIR) | BGP routing tables | None (abuse contacts โ shell address) |
| IP block user | Hosting customer | IP geolocation databases | Terms of service (unenforced) |
| Actual operator | Criminal/state/legitimate | Network traffic only | None visible |
Source: [XREF] TI-2026-026 (Phantom ASN โ complete chain documented), 019M (IPXO lease-laundering chain: AbuseRadar โ Internet Utilities LATAM โ netutils-mnt โ IPXO).
Six layers. Each provides one degree of separation between the actual operator and any form of accountability. An abuse report sent to the registered contact reaches the shell company's address โ which is the formation agent's office in Victoria, Seychelles. The formation agent receives the report. The formation agent has no obligation to forward it, no obligation to identify the client, and no obligation to respond.
The abuse report has traversed: IP geolocation database โ ASN registration โ LIR sponsor โ shell company โ formation agent โ dead end. The 96% failure rate is not a bug in this system. It is the specification.
Component 4: The Geofeed
๐ Geofeed Manipulation: When IPs Lie About Where They Are
- What geofeeds do: Tell geolocation databases where IP addresses are physically located. Used by CDNs, compliance systems, content licensing, sanctions enforcement.
- Who controls them: The ASN holder โ the shell company. They self-report geolocation.
- What happens when they lie: An IP block registered to a Seychelles company, hosted in a Dutch data center, can geofeed-report its location as the United States. CDNs route based on the reported location. Compliance systems check the reported location. Sanctions enforcement checks the reported location.
- Documented abuse: TI-2026-023C documented M247 geofeeds showing IPs in sanctioned countries (Iran, Cuba, North Korea) geolocated to non-sanctioned countries. The geofeed makes sanctions-country traffic appear to originate from a compliant jurisdiction.
Source: [XREF] TI-2026-023C (M247 geofeed manipulation), RFC 8805 (geofeed format specification). Note: RFC 8805 trusts ASN holders to self-report accurately. No verification mechanism exists.
The geofeed is the finishing touch. The shell company owns the ASN. The ASN controls the IP block. The IP block's geolocation is whatever the shell company says it is. There is no verification. RFC 8805 โ the internet standard that defines geofeeds โ trusts the ASN holder to report accurately. It does not define a verification mechanism. It does not define penalties for false reporting. It does not define an audit process.
The internet standard for IP geolocation is built on the honor system. The honor system is administered by shell companies in the Seychelles.
๐ What geofeed manipulation enables
Q: If an IP in Iran can geofeed-report as being in the Netherlands, what breaks?
A: Everything that relies on IP geolocation: (a) Sanctions enforcement โ OFAC prohibits US companies from serving Iranian IPs. If the IP reports as Dutch, US companies serve it unknowingly. (b) Content licensing โ Netflix, Spotify, etc. license content by geography. Manipulated geofeeds bypass licensing restrictions. (c) CDN routing โ Cloudflare, Akamai route based on geolocation. Manipulated feeds cause misrouting. (d) Law enforcement jurisdiction โ a warrant for Dutch-located data is issued to Dutch authorities, who discover the data is actually in Iran. The warrant is unenforceable.
Q: How widespread is geofeed manipulation?
A: TI-2026-023C documented it specifically for M247 (9 investigations, NordVPN infrastructure). But the mechanism is available to any ASN holder. RIPE NCC maintains a geofeed validation tool but does not enforce results. The manipulation is: trivially easy, difficult to detect, consequential for sanctions/compliance, and entirely unpunished. It is the perfect crime โ if it is even a crime, which in most jurisdictions, self-reporting false geolocation data is not.
Component 5: The AFRINIC Extraction
๐ Sixteen Million IPs That Never Touched Africa
- AFRINIC: African Network Information Centre โ the Regional Internet Registry for Africa.
- Allocation purpose: IP addresses allocated by AFRINIC are intended for use in the African service region.
- What happened: Shell companies registered in Seychelles (an AFRINIC member country) received IP address allocations from AFRINIC. Those IP addresses were announced in BGP from European and American data centers. Zero routing paths traverse African infrastructure.
- Scale: 16 million IP addresses. That is a /4 โ one-sixteenth of the entire IPv4 address space that AFRINIC manages.
- Phone: +248-4-610-795 appears in RIPE/AFRINIC records linking 15+ ASNs across these shell companies.
Source: [XREF] TI-2026-027 (Corridors), TI-2026-031G (AFRINIC Extraction). BGP routing analysis confirms zero African routing paths for these address blocks.
Sixteen million IP addresses. Allocated by the African internet registry. Routed through European data centers. Registered to Seychelles shell companies. Connected by a single phone number.
This is not IP address allocation. This is IP address extraction. AFRINIC's mandate is to serve the African internet community. These addresses serve the European bulletproof hosting market. The addresses were extracted from Africa's allocation โ permanently reducing the pool available for actual African internet development โ to serve offshore hosting operations with no African nexus.
And the mechanism is identical to the financial extraction documented in 035D: intelligence and criminal operations extract resources from developing-world institutions (AFRINIC's IP space, offshore banking systems, shell company jurisdictions) for the benefit of operations in the developed world. The developing world provides the legal infrastructure. The developed world provides the traffic. The extraction is permanent.
The Machine Assembled
Here are the five components. Each is legal. Each is available commercially. Each can be sourced independently. Together, they produce impunity at industrial scale.
Shell Company
Seychelles IBC, $500, 48 hours. No beneficial ownership disclosure. The owner is invisible.
LIR Membership
RIPE NCC, โฌ1,400/year. Institutional legitimacy. "We are a recognized internet participant."
ASN Registration
Via LIR or sponsoring. Shell company controls the ASN. Six layers between operator and accountability.
IP Allocation
From AFRINIC/RIPE/ARIN. Self-reported geolocation. No verification. IPs can claim to be anywhere.
Operational Hosting
IP addresses announced from any data center globally. Traffic flows. Abuse reports reach the formation agent in Seychelles. Dead end.
Total cost: approximately $2,000 to set up, $2,000/year to maintain. For that investment, the operator gets: invisible ownership, institutional legitimacy, self-reported geolocation, global IP routing, and a 96% abuse-report survival rate.
The machine does not require ongoing human intervention. Once assembled, it operates on autopilot. The shell company renews automatically. The LIR fee autopays. The ASN routes continuously. The geofeed reports whatever was initially configured. The abuse reports arrive at the formation agent and are filed โ or not โ without consequence.
๐ Why the machine cannot be dismantled
Q: Could RIPE NCC require beneficial ownership disclosure for LIR members?
A: RIPE NCC operates by consensus of its membership. Its membership includes LIRs that benefit from the current opacity. Proposing mandatory beneficial ownership disclosure at a RIPE meeting is like proposing higher taxes at a billionaires' conference. The people who would have to approve the change are the people the change would affect. RIPE has discussed this. RIPE has not implemented it.
Q: Could AFRINIC stop allocating IPs to Seychelles shell companies?
A: AFRINIC has been in governance crisis since 2021 โ CEO suspended, board disputes, legal challenges. Its enforcement capacity is near zero. The shell companies are its dues-paying members. Denying them resources would require governance capacity that AFRINIC currently lacks and political will that conflicts with its membership's interests.
Q: Could governments require ISPs to verify geofeed accuracy?
A: Technically possible. No government has done it. The reason: intelligence agencies use geofeed manipulation for their own operations (routing traffic through friendly jurisdictions for collection). Mandating geofeed verification would reveal intelligence operations. The same reason the 96% abuse failure rate persists โ the fix would expose the fixer.
Q: Is there a single point of failure in the machine?
A: The formation agents. They hold every passport copy, every declaration of purpose, every corporate record. They know every client. They are a handful of firms per jurisdiction. Requiring formation agents to proactively verify and disclose beneficial ownership โ with criminal liability for failure โ would break the machine. This has not been implemented because: (a) the jurisdictions that host formation agents depend on the revenue, (b) the intelligence agencies that use the machine oppose transparency, and (c) the international community has no enforcement mechanism over sovereign jurisdictions' corporate law.
The Machine's Output: What It Produces at Scale
๐ Machine Output Across the Dossier Corpus
| Investigation | Machine Component Used | Output |
|---|---|---|
| TI-2026-026 (Phantom ASN) | Shell + LIR + ASN lease | Entire ASN with no identifiable owner |
| TI-2026-027 (Corridors) | Shell + AFRINIC + geofeed | 16M IPs extracted from African allocation |
| TI-2026-023 (M247/VPN) | LIR + geofeed manipulation | Sanctions-country VPN traffic laundered |
| TI-2026-030 (1337/Tor) | LIR sponsoring + shell | Tor exits and darknet hosting with institutional legitimacy |
| TI-2026-031 (Aceville) | Shell (SG) + state cloud | Chinese state cloud wrapped in Singapore corporate veil |
| TI-2026-032 (American Mirror) | US hosting + Section 230 | 62% abuse-rate hosting with no enforcement |
| TI-2026-019M (Cartographers) | Full chain: IPXO lease-laundering | AbuseRadar โ LATAM โ netutils โ IPXO โ clean IP space |
| TI-2026-035D (Epstein) | Shell + offshore finance | Intelligence-adjacent operations with invisible ownership |
| TI-2026-035E (Money Pipeline) | Shell + exchange registration | Crypto exchanges with opaque ownership (Garantex) |
Source: [CORPUS] Cross-investigation analysis of jurisdictional arbitrage components across 9 major investigations.
Nine investigations. Every one uses at least two components of the machine. The machine is not a tool that some actors use sometimes. It is the foundational infrastructure of the entire corpus. Remove the machine, and every investigation in this series loses its subject.
The Accountability Architecture: Designed for a Different Internet
The abuse reporting system, RIPE NCC membership, AFRINIC allocations, and geofeed standards were all designed between 1992 and 2005. They assumed an internet of:
๐ฐ๏ธ The Internet They Designed For (1995)
- One provider per IP block
- Provider physically located in identifiable jurisdiction
- Provider responsive to abuse complaints
- Ownership = operation = accountability
- Shell companies were for tax โ not infrastructure
- IP addresses were scarce and valued
๐ The Internet That Exists (2024)
- Six layers between operator and registered owner
- Owner in Seychelles, server in Netherlands, traffic from everywhere
- Abuse reports reach formation agent โ dead end
- Ownership โ operation โ accountability
- Shell companies are infrastructure โ for everything
- IP addresses are leased, laundered, and geofeed-manipulated
The accountability infrastructure was not deliberately sabotaged. It was outrun. The jurisdictional arbitrage machine evolved faster than the internet governance institutions that were supposed to prevent it. RIPE NCC still operates on 1992 membership principles. AFRINIC still operates on allocation policies designed for a continent that barely had internet. Geofeed standards still rely on the honor system. The machine exploits the gap between the internet the institutions were designed for and the internet that actually exists.
โ๏ธ The Jurisdictional Arbitrage Machine โ Verdict
The machine has five components. Each is legal. Each costs less than $2,000. Each can be sourced in 48 hours. Together they produce:
- Invisible ownership โ no beneficial owner identifiable anywhere in the public record
- Institutional legitimacy โ RIPE NCC membership, recognized ASN, routable IP space
- Geographic fiction โ IPs that claim to be anywhere, with no verification
- Abuse immunity โ 96% of reports terminate at the formation agent's office
- Multi-purpose opacity โ serves cybercrime, intelligence, surveillance, finance, and disinformation equally
The machine cannot be dismantled because:
- RIPE NCC is governed by its members (who benefit from opacity)
- AFRINIC is in governance crisis (cannot enforce anything)
- Opacity jurisdictions depend on formation agent revenue
- Intelligence agencies use the same machine for their own operations
- No international body has enforcement authority over sovereign corporate law
The machine was built from legal components by licensed professionals in regulated jurisdictions. It produces impunity at industrial scale. It operates on autopilot. And it costs less than a used car.
Every SSH probe our honeypot captures traverses infrastructure that the machine produced. Every bulletproof hosting provider in our corpus exists because the machine exists. Every state actor, every criminal, every surveillance vendor operates under the machine's protection. The machine is not the problem. The machine is the architecture. Everything else โ the probes, the ransomware, the surveillance, the sanctions evasion โ is just what people do when impunity is available for $2,000.
Cross-Investigation Map
| Component | Primary Investigation | Supporting Evidence |
|---|---|---|
| Shell Companies | 026 (Phantom ASN), 027 (Corridors) | 035D (Epstein/BCCI), 035E (exchange registration) |
| LIR Sponsoring | 023 (M247), 030 (1337/LAIN) | RIPE NCC policy documents |
| ASN Leasing | 019M (IPXO chain), 026 (Phantom ASN) | BGP routing analysis |
| Geofeed Manipulation | 023C (M247 sanctions geofeeds) | RFC 8805 (no verification mechanism) |
| AFRINIC Extraction | 027 (Corridors), 031G (AFRINIC Extraction) | BGP zero-African-routing analysis |
Methodology
- [CORPUS] โ Cross-investigation pattern analysis across 9 major investigations documenting jurisdictional arbitrage components
- [OSINT-LIB] โ US Treasury NPFRA 2024, FATF evaluations, RIPE NCC policy documents, RFC 8805
- [LEGAL] โ Seychelles Companies Act 1994, BVI Business Companies Act 2004, Panama Papers analysis
- [XREF] โ TI-2026-026, 027, 023, 030, 031, 032, 019M, 035D, 035E