The Paper Trail
How registration fraud across five registries enables jurisdictional arbitrage โ the same operator seen from six countries simultaneously
Overview
One operator. Eight registration identities. Twelve jurisdictions. Zero enforceable abuse contacts.
This article maps how the SSH attack enterprise exploits the fragmented internet registration system to make legal action structurally impossible. By distributing infrastructure across five Regional Internet Registries (RIPE, ARIN, APNIC, LACNIC, AFRINIC), incorporating shell companies in privacy jurisdictions (Panama, Seychelles, Belize, Hong Kong), and operating servers in countries unrelated to their registration โ they create a legal maze where no single authority has complete jurisdiction.
The proof is in the HASSH fingerprints. Despite being registered to different entities in different countries, these IPs share identical SSH client implementations โ the same binary, compiled from the same source, deployed by the same hand.
The Jurisdiction Mismatch Pattern
Of 5,347 unique attacker IPs in our honeypot database, we identified 25 high-confidence jurisdiction mismatches โ IPs where the operational country (determined by routing) differs from the registration country (RDAP records). These aren't CDNs or anycast networks. These are single-homed attack nodes deliberately registered in one country while physically operating in another.
| IP | Operates In | Registered In | Registrant | Hits | Score |
|---|---|---|---|---|---|
| 179.43.139.58 | ๐จ๐ญ Switzerland | ๐ต๐ฆ Panama | PRIVATE LAYER INC | 12,885 | 78 |
| 94.154.35.215 | ๐ณ๐ฑ Netherlands | ๐บ๐ฆ Ukraine | WEBNETWORK-MNT (Dyachenko) | 810 | โ |
| 80.66.66.10 | ๐ง๐ฌ Bulgaria | ๐ณ๐ฑ Netherlands | soldatov-av-mnt | 198 | โ |
| 2.57.122.168 | ๐ท๐ด Romania | ๐ณ๐ฑ Netherlands | TECHOFF-MNT | 95 | โ |
| 195.178.110.217 | ๐ณ๐ฑ Netherlands | ๐ฆ๐ฉ Andorra | TECHOFF SRV LIMITED | 89 | โ |
| 92.118.39.71 | ๐ท๐ด Romania | ๐ณ๐ฑ Netherlands | DMZHOST | 88 | โ |
| 172.110.221.82 | ๐ช๐ธ Spain | ๐ญ๐ฐ Hong Kong | haoxiangyun (ๅฅฝๆณไบ) | 72 | โ |
| 172.110.219.251 | ๐ช๐ธ Spain | ๐ญ๐ฐ Hong Kong | YSZ TRADING CO., LIMITED | 72 | โ |
| 77.90.185.17 | ๐ฑ๐น Lithuania | ๐ฌ๐ง United Kingdom | Limited Network LTD | 52 | โ |
| 200.26.188.219 | ๐ท๐ด Romania | ๐ง๐ฟ Belize | Internet Utilities LATAM LTD. | 54 | โ |
| 103.176.90.41 | ๐ณ๐ฑ Netherlands | ๐ญ๐ฐ Hong Kong | bo jing (่ไบฌ) | 54 | โ |
| 103.143.238.100 | ๐บ๐ธ United States | ๐ญ๐ฐ Hong Kong | HONG KONG LING JIAN ZHUO TECHNOLOGY | 50 | โ |
Pattern: Registration in privacy/offshore jurisdiction โ Operation in different country โ Legal complaints go to registrant country โ No enforcement because registrant is a shell.
The TECHOFF Cluster: One Gmail, Five Countries
A single abuse email โ dmzhostabuse@gmail.com โ connects three registered entities across five operational countries:
Entity 1: TECHOFF-MNT
- IPs controlled: 10
- Operates in: ๐ฌ๐ง GB, ๐ณ๐ฑ NL, ๐ท๐ด RO
- ASN: AS47890 (UNMANAGED-DEDICATED-SERVERS)
- Company: UNMANAGED LTD โ UK Companies House #12461131
- Incorporated: Feb 2020 โ SIC 63110 (Data processing)
- Spamhaus: ASN-DROP โ ๏ธ
- Risk score: 86.5
Entity 2: TECHOFF SRV LIMITED
- IPs controlled: 3
- Operates in: ๐ฆ๐ฉ AD, ๐ณ๐ฑ NL
- ASN: AS48090 (DMZHOST)
- Company: UK Companies House #16090235
- Incorporated: Nov 2024 (7 months old!)
- Address: 35 Firs Avenue, London N11 3NE
- Spamhaus: ASN-DROP โ ๏ธ
- Risk score: 90.52
Entity 3: DMZHOST
- IPs controlled: 1
- Operates in: ๐ท๐ด Romania
- Same email: dmzhostabuse@gmail.com
- Address: 35 Firs Avenue, London N11 3NE (same!)
The proof: HASSH fingerprint 2ec37a7cc8daf20b10e1ad6221061ca5 appears from IPs registered to all three entities โ 195.178.110.217 (TECHOFF SRV), 2.57.122.168 (TECHOFF-MNT), and 92.118.39.71 (DMZHOST). Same binary. Same operator. Three "different" companies.
Private Layer: The Panama-Switzerland Pipeline
PRIVATE LAYER INC โ AS51852
- Registration: ๐ต๐ฆ Panama โ "Marbella, Edif. Ocean Business Plaza, Panama City"
- Operations: ๐จ๐ญ Switzerland
- RIPE allocation: 2010-11-15 (15-year veteran)
- Admin contact: Kevin Ponce
- IPs attacking us: 10
- Total hits: 13,907 (highest single-registrant volume)
- Email: support@privatelayer.com
- Classified as: Bulletproof โ
Why Panama? Panama has no bilateral legal assistance treaty with most European countries for cybercrime. Abuse complaints go to a Panamanian-registered entity that operates Swiss servers โ Swiss authorities can't act on the registration, Panamanian authorities can't act on the servers. By design.
The fingerprint link: HASSH a7a87fbe86774c2e40cc4a7ea2ab1b3c shared between 179.43.139.58 (Private Layer, Panama/Switzerland) and 94.154.35.215 (Omegatech/Dyachenko, Ukraine/Netherlands). Same tool operator, different shell companies, different continents.
The Seychelles-Ukraine-Turkey Triangle: Omegatech
OMEGATECH LTD โ AS202412
- Registered country: ๐ธ๐จ Seychelles
- Operates in: ๐บ๐ฆ Ukraine, ๐น๐ท Turkey, ๐บ๐ธ United States, ๐ณ๐ฑ Netherlands
- Spamhaus: ASN-DROP โ ๏ธ
- Risk score: 78.4
- IPs: 7 (130.12.180.51, 178.16.52.166, 178.16.54.226, 91.92.240.199, 91.92.243.116, 91.92.243.49, 94.154.35.215)
- Registrant email: abusep@kharkiv.com
- RIPE maintainer: WEBNETWORK-MNT
- Key person: Dyachenko V.I. โ registered address in Kharkiv war zone
The jurisdiction stack:
- Company registered in Seychelles (no cybercrime enforcement cooperation)
- Abuse contact in Kharkiv, Ukraine (active war zone โ enforcement impossible)
- IP space announced as Turkey via BGP (mismatched geolocation)
- Physical servers in Netherlands and United States
- ARIN allocation from October 2025 for US space (network: LANEDONET)
Five countries. Each authority would need to coordinate with four others to take action. None will.
The Hong Kong Shell Factory
Three distinct Hong Kong entities, all operating European servers, all attacking our honeypot:
| Entity | ASN | Allocated | Operates In | Risk |
|---|---|---|---|---|
| haoxiangyun (ๅฅฝๆณไบ) โ HONGKONG HAO XIANG YONG TECHNOLOGY CO LIMITED | AS141718 | 2021-02-05 | ๐ช๐ธ Spain | 92.2 |
| YSZ TRADING CO., LIMITED | AS211484 | 2025-03-19 | ๐ช๐ธ Spain | 93.0 |
| bo jing (่ไบฌ) | โ | โ | ๐ณ๐ฑ Netherlands | โ |
Pattern: Hong Kong limited companies are the cheapest bulletproof registration vehicle. Incorporation costs ~$200 USD, requires no local physical presence, company records are not publicly searchable (unlike UK Companies House), and Hong Kong has no proactive cybercrime enforcement for non-local victims.
The HASSH proof: Fingerprint 14b2ddda386a4d1006108ccd231b42fc shared between 172.110.221.82 (haoxiangyun, HKโSpain) and 200.26.188.219 (Internet Utilities LATAM, BelizeโRomania). Hong Kong shell and Belizean shell โ same SSH binary.
NexonHost: Belize Paper, Romanian Metal
AS62390 โ NEXONHOST (NexonHost Srl, RO)
- Allocated: 2021-11-02
- Registered admin: Ovidiu Costan Florin
- RDAP maintainer: TENNET-MNT
- IPs in honeypot: 13
- Risk score: 93.8 (highest in our dataset)
- Bulletproof: โ confirmed
NexonHost registers IP space through Internet Utilities LATAM LTD. โ a Belize-registered entity (address: "Corner Eyre and Hutson Streets, Ground Floor, Blake Building") that holds LACNIC allocations. The IPs route through Romania. Abuse reports go to report@abuseradar.com โ a black hole.
NexonHost operates 13 IPs against our honeypot at a combined risk score of 93.8. It is the highest-risk bulletproof provider in our dataset by this metric.
The Credential Synchronization Proof
If these were truly independent operators behind independent registrations, their credential dictionaries would differ. They don't.
Identical credential lists deployed from 4+ IPs registered to "different" entities:
| Credential | IPs Using It | Registrant Countries |
|---|---|---|
admin:admin | 4 IPs | ๐ต๐ฆ Panama, ๐ณ๐ฑ Netherlands, ๐ฐ๐ฟ Kazakhstan, ๐บ๐ฆ Ukraine |
root:admin | 4 IPs | ๐ฆ๐ฉ Andorra, ๐ณ๐ฑ Netherlands, ๐ฌ๐ง United Kingdom, ๐ท๐ด Romania |
admin:123456 | 3 IPs | ๐ต๐ฆ Panama, ๐ณ๐ฑ Netherlands, ๐บ๐ฆ Ukraine |
root:123456 | 3 IPs | ๐ฆ๐ฉ Andorra, ๐ณ๐ฑ Netherlands, ๐ท๐ด Romania |
root:1q2w3e4r | 3 IPs | ๐ฆ๐ฉ Andorra, ๐ณ๐ฑ Netherlands, ๐ท๐ด Romania |
The same wordlist, distributed from the same C2, running through "independent" companies in Panama, Andorra, Netherlands, UK, Ukraine, Kazakhstan, and Romania. Seven jurisdictions. One operation.
The Five-Registry Distribution
The enterprise distributes IP registrations across all five Regional Internet Registries:
| Registry | Attack IPs | Operating Countries | Purpose |
|---|---|---|---|
| APNIC | 2,244 | 30 countries | Volume โ compromised IoT, residential proxies |
| RIPE NCC | 1,375 | 60 countries | Infrastructure โ bulletproof hosts, shell companies |
| ARIN | 1,244 | 6 countries | Premium โ "clean" US/CA space for high-value targets |
| LACNIC | 299 | 16 countries | Overflow โ Belize/Panama registration vehicles |
| AFRINIC | 184 | 26 countries | Emerging โ cheap space, minimal oversight |
No single registry has a complete view. RIPE sees the shell companies. ARIN sees the Panamanian registrants. APNIC sees the compromised IoT. Each registry's abuse team handles only their slice. The coordination required to map the full picture exceeds what any one registry is designed to do.
The Registration Evasion Architecture
The pattern is not coincidental. It is engineered:
- Incorporate in privacy jurisdiction โ Seychelles, Panama, Belize, Hong Kong ($200-$500, no verification)
- Register IP space through RIPE โ UK company provides "local presence" for RIPE membership
- Announce prefixes from different country โ BGP routing has no registration verification
- Use Gmail for abuse contact โ no company email, no domain trace
- Operate for 6-12 months โ get ASN-DROP listed by Spamhaus
- Incorporate new entity โ UNMANAGED LTD (2020) โ TECHOFF SRV LIMITED (2024): same address, new name
- Transfer IP space to new entity โ registration history resets
The result: law enforcement in Switzerland cannot compel a Panamanian company. Panamanian authorities cannot inspect Swiss servers. RIPE cannot revoke allocations based on third-party abuse reports alone. And the operator continues from behind the next shell.
Timeline: The Registration Refresh Cycle
| Date | Event | Entity |
|---|---|---|
| 2010-11-15 | AS51852 allocated | Private Layer INC (Panama) โ still active 15 years later |
| 2019-09-05 | AS48090 allocated | DMZHOST / TECHOFF SRV LIMITED |
| 2020-02-xx | UK company 12461131 | UNMANAGED LTD incorporated |
| 2020-07-27 | AS47890 allocated | UNMANAGED-DEDICATED-SERVERS |
| 2021-02-05 | AS141718 allocated | haoxiangyun (Hong Kong) |
| 2021-11-02 | AS62390 allocated | NexonHost (Romania/Belize) |
| 2024-11-xx | UK company 16090235 | TECHOFF SRV LIMITED incorporated |
| 2024-11-29 | AS213790 allocated | Limited Network LTD (GBโLithuania) |
| 2025-03-19 | AS211484 allocated | YSZ TRADING CO. (HKโSpain) |
| 2025-04-25 | AS209702 allocated | SOLDATOV ALEXEY VALEREVICH (Kazakhstan) |
| 2026-01-12 | AS202412 re-listed | Omegatech (Seychelles) โ Spamhaus ASN-DROP |
Pattern: New entity every 12-18 months. When one ASN gets listed by Spamhaus, the next is already allocated. The pipeline never stops because the shell company factory never stops.
Confidence Assessment
HIGH โ Direct evidence from RDAP records, Companies House filings, HASSH fingerprint sharing, credential synchronization, and Spamhaus classifications.
The registration fraud is not an auxiliary technique. It is the primary evasion mechanism. Without it, the enterprise would need to operate from a single ASN in a single country โ making enforcement trivial. The paper trail is not a trail at all. It is a maze, constructed specifically so that no one following it can reach the end.
Sources: RIPE NCC RDAP, UK Companies House, Spamhaus ASN-DROP, PeeringDB, honeypot HASSH correlation, credential overlap analysis across 5,347 unique attacker IPs.