The Registration Pipeline

10,575 registered_by relationships map who assigns IP space to whom. The chain: Regional Internet Registry (RIPE, APNIC, ARIN) → Local Internet Registry (ISP/hosting) → End User. Each step requires identity verification. Each step is an opportunity for opacity.

The Self-Referencing Registry

RIPE-NCC-HM-MNT: 508 malicious IPs. This is RIPE's own "Hostmaster Maintainer" — the marker used when IP space hasn't been delegated to a specific organization or when the delegation record is incomplete.

These IPs exist in bureaucratic limbo: allocated by RIPE to someone, but the "someone" isn't properly recorded in the delegation chain. The result: 508 malicious servers operate with the European internet registry itself listed as their administrative authority. Sending an abuse report reaches RIPE — who will respond that they're a registry, not an operator, and the actual user should be contacted directly. But the actual user isn't in the record.

Combined with RIPE-NCC-END-MNT (174 more IPs), 682 malicious IPs have RIPE itself as the only identifiable point of contact in their registration chain.

The KYC Failure Points

How does "Private Customer" get 32 IP allocations across 15 ASNs? How does IRT-ACEVILLEPTELTD-SG register 123 IPs with a Singapore $1 company? The answer is the KYC cascade failure:

1. RIR to LIR: RIPE allocates /16 blocks to Local Internet Registries. The LIR is KYC'd — it's a real company (hosting provider, ISP). This check passes.
2. LIR to Customer: The hosting provider sub-allocates to customers. This is where KYC disappears. Most hosting providers verify a credit card or cryptocurrency payment. Not identity. Not purpose.
3. Customer to RDAP: The customer can put anything in the organization field. "Private Customer." "ACEVILLE PTE LTD." "Cloud Innovation Support." As long as there's a working email and phone number, the record is technically compliant.

The KYC obligation exists at step 1 (RIR to LIR) but evaporates at step 2 (LIR to customer). This is by design — requiring hosting providers to ID-verify every customer would destroy the cloud computing industry. But it also means the registration system is one step removed from the person running the scanner.

The Volcano Engine Question

IRT-VOLCANO-ENGINE-CN: 121 malicious IP registrations. Volcano Engine is ByteDance's cloud platform (the company behind TikTok). 121 IPs registered under their incident response team are generating attacks against our infrastructure.

ByteDance operates one of the world's largest cloud platforms. Their KYC for Chinese customers follows PRC regulations — real-name registration with government ID. For international customers: credit card verification only. The 121 malicious IPs likely represent international accounts created with stolen payment methods, operating in a jurisdiction where enforcement requires navigating Chinese bureaucracy.

This isn't a accusation of ByteDance complicity. It's an observation about scale: when you host millions of VMs, hundreds will be malicious. The question isn't whether some are bad — it's whether the response time to abuse reports is measured in hours, days, or months.