The Registration Layer

RDAP (Registration Data Access Protocol) is the system that maps IP addresses to organizations. Every IP allocation must have a registrant. Every registrant must provide contact details. The theory: abuse reports reach responsible parties. The reality: 11,411 shared RDAP organization links reveal an accountability vacuum.

The Shell Companies

ACEVILLE PTE LTD — Singapore → Tencent → Everywhere

122 IPs registered to IRT-ACEVILLEPTELTD-SG. All route through Tencent (AS132203). Deployed across 9 countries despite Singapore registration. Average threat: 58.6. Individual IP threats: 84 to 100.

The structure: a Singapore PTE LTD (private limited company, minimum $1 SGD share capital, no public disclosure requirements) purchases IP allocations from Tencent Cloud, then deploys scanning/attack infrastructure across Tencent's global regions. Singapore's corporate opacity provides the legal shield. Tencent's global infrastructure provides the network reach.

Cloud Innovation — Seychelles → 17 ASNs → Opacity

A Seychelles-registered entity whose abuse phone (+248-4-610-795) spans 17 autonomous systems. Operating through Yisu Cloud HK (AS142403), Scloud Pte (AS142002), NEEVAI (AS59187), CNSERVERS (AS40065), and UCloud (AS135377).

This is the same entity documented in TI-2026-057F: registration fraud using jurisdiction mismatches. Cloud Innovation claims Seychelles incorporation while operating exclusively through Chinese/Hong Kong cloud providers. The Seychelles registration provides:

• No beneficial ownership disclosure requirement
• No mutual legal assistance treaties with major enforcement jurisdictions
• 4-hour timezone offset from victims (harassment-proof abuse contact)
• Bearer share provisions (anonymous ownership until 2020 reform)

"Private Customer" — Maximum Opacity

32 IPs across 15 ASNs and 9 countries. Average threat: 65.3 — the highest of any organization with 5+ IPs.

WHG Hosting Services (AS14670) hosts multiple "Private Customer" IPs all at threat score 95-100. This is a hosting provider that either can't or won't identify its own customers in registration data. The RDAP record exists. The name on it is meaningless.

"IP Manager" — The Reseller Layer

85 IPs across 10 ASNs. Average threat: 64.2. An entity whose business IS managing IP space — buying allocations from RIRs and reselling to customers who need addresses without questions.

The reseller layer is where accountability disappears. The RIR sold to "IP Manager." IP Manager sold to... whom? The RDAP record stops at the reseller. The actual user — the person running the scanner, the botnet, the C2 server — is one hop beyond the registry's visibility.

The Registry Markers

RIPE-NCC-HM-MNT: 226 malicious IPs, 79 ASNs, 38 countries. This isn't an organization — it's a maintenance object indicating "managed by RIPE NCC itself." When an IP block's RDAP record points to RIPE's own maintainer, it means the allocation hasn't been properly transferred to an end-user entity. These IPs exist in a registration limbo: allocated but not attributed.

RIPE-NCC-END-MNT: 67 IPs, 23 ASNs, 11 countries. Another registry marker — "end-user maintainer" without actual organizational attribution. Combined with RIPE NCC's general record (96 IPs, 19 ASNs, 16 countries), over 389 malicious IPs hide behind RIPE registry markers — accountability nominally assigned to the European internet registry itself.

APNIC (Asia Pacific): 35 IPs, 16 ASNs, 11 countries. The same pattern in Asia. Regional registries become inadvertent shields when downstream allocations aren't properly documented.

The Legitimate vs. Complicit Spectrum

The spectrum from "passively abused" to "actively complicit" isn't binary. Microsoft doesn't facilitate attacks — but their provisioning speed enables account churn. FranTech doesn't ignore abuse — but their response time is measured in weeks. ACEVILLE doesn't pretend to be legitimate — their entire business model is access without accountability.