๐ข TI-2026-058K: The Shell Companies
Series: The Operators | Letter K: Corporate Forensics of the Bulletproof Hosting Pipeline
How a multi-national SSH attack enterprise hides behind UK dormant companies, Kazakh village addresses, and Ukrainian phone numbers โ while announcing their networks as Dutch, Polish, and Turkish.
The Corporate Veil
Every criminal enterprise needs infrastructure. Infrastructure needs IP addresses. IP addresses need registration. Registration needs a company. And companies โ in the United Kingdom โ can be created for ยฃ12 in under 24 hours, with no verification of the registrant's identity.
This is the story of how the SSH attack enterprise documented throughout Series 058 incorporates itself. Not in the dark web. Not in anonymous cryptocurrency. In the most transparent corporate registry in the world: Companies House, UK.
The Companies
๐ฌ๐ง TECHOFF SRV LIMITED
| Field | Value | Red Flag |
|---|---|---|
| Company Number | 16090235 | |
| Address | 35 Firs Avenue, London, England, N11 3NE | Residential address in North London suburb |
| Incorporated | 20 November 2024 | 7 months old, already operating dual-ASN infrastructure |
| SIC Code | 96090 โ "Other service activities not elsewhere classified" | Most generic possible classification |
| Status | Active | |
| RIPE Maintainer | TECHOFF-MNT | Controls all DMZhost.co IP space |
| ASN | AS47890 + AS48090 (dual!) | Dual-ASN = sophisticated redundancy for 7-month company |
| Brand | DMZhost.co | "DMZ" = Demilitarized Zone โ the name tells you what it is |
| Abuse Contact | dmzhostabuse@gmail.com | Gmail for a hosting company's abuse desk |
| Romanian Link | "prova.dmzhost.co" subdomain | "Prova" = Romanian/Italian for "test/proof" |
๐ฌ๐ง W1N LTD
| Field | Value | Red Flag |
|---|---|---|
| Company Number | 14123971 | |
| Address | Dept 302, 43 Owston Road, Carcroft, Doncaster, DN6 8DA | Mail forwarding address in South Yorkshire village |
| Incorporated | 23 May 2022 | |
| SIC Code | 99999 โ Dormant Company | Declared dormant but operating live hosting infrastructure |
| Status | Active | |
| RIPE Maintainer | lir-uk-win-1-MNT | |
| Phone (RIPE) | +380502309318 | UKRAINIAN mobile number on UK company |
| Abuse Contact | abuse@w1n.nl | Netherlands domain for UK company |
| Network Description | "Dedicated-Servers" | A "dormant" company hosting dedicated servers |
๐ฌ๐ง UNMANAGED LTD
| Field | Value | Red Flag |
|---|---|---|
| Company Number | 12461131 | |
| Address | Business First Northampton, Brindley Close, Rushden, NN10 6EN | Virtual office / business center |
| Incorporated | 13 February 2020 | |
| SIC Codes | 62020, 62030, 63110, 63120 | IT consultancy + data processing + hosting (at least honest) |
| Status | Active | |
| RIPE Maintainer | ro-btel2-1-mnt | ROMANIAN maintainer on UK company |
| Hosted Asset | 2.57.122.238 (The Crypto Hunter โ see 058I) | Hosts isolated blockchain predator |
| Brand | "Unmanaged" โ the name says it all | No management = no accountability |
The Kazakhstan Connection
Behind the UK shell companies lies a deeper layer. Two hosting operations in Kazakhstan, both controlled by the same Russian-speaking entity:
๐ฐ๐ฟ SOLDATOV Alexey Valerevich
| Field | Value | Significance |
|---|---|---|
| RIPE Org | ORG-SAV2-RIPE | |
| Address | Gabita Musrepova district, Novoselovka village, Jambula street 21 | A VILLAGE in North Kazakhstan |
| MNT-BY | soldatov-av-mnt + ru-avm-1-mnt | Shared Russian maintainer |
| Network | 80.66.66.0/24 | Announces as Netherlands |
| Abuse | alex@hostup.kz / abuse@hostup.kz | |
| Brand | hostup.kz | Zero SSL certificates (no legitimacy effort) |
| Honeypot Relations | 46 total (10 shared RDAP, 5 shared HASSH, 31 OTX) | Confirmed malicious |
๐ฐ๐ฟ ISAEV (Individual Entrepreneur)
| Field | Value | Significance |
|---|---|---|
| RIPE Handle | II1979-RIPE | "1979" may indicate birth year |
| Address | Almaty region, Zhibek Zholy street 100 | |
| MNT-BY | ISAEV-MNT + ru-avm-1-mnt | SAME Russian maintainer as SOLDATOV |
| Network | 87.251.64.0/24 | Announces as Poland |
| Abuse | abuse@novahost.kz | |
| Brand | novahost.kz | Zero SSL certificates (no legitimacy effort) |
| Cross-link | Shares RDAP org with SOLDATOV (80.66.66.x) | CONFIRMED SAME ENTITY |
๐ The Smoking Gun: ru-avm-1-mnt
Both SOLDATOV and ISAEV share the maintainer ru-avm-1-mnt. In RIPE database terms, a maintainer is an authentication credential โ whoever holds this key controls both networks. This is not a business relationship. This is unified ownership operated from Russia through Kazakh front registrations.
Additionally, our entity link analysis confirms: 80.66.66.x shares RDAP organization AND HASSH fingerprints with 87.251.64.x. Same SSH clients, same organization, same controller. Two "different" hosting companies that are one operation.
The Ukrainian Ghost
๐บ๐ฆ "Individual Entrepreneur Dyachenko Valentina Ivanovna"
| Field | Value | Significance |
|---|---|---|
| Network | 94.154.32.0 - 94.154.39.255 (/21!) | 2,048 IPs โ substantial allocation |
| Registered Address | Kharkiv region, Balakleya area, village Andreevka, Zavodskaya str. 18, 64220 | A VILLAGE near Balakleya โ active war zone since 2022 |
| Contact Person | Artem Sevastyanov, 61108 Kharkov | Named individual with phone number |
| Phone | +380509626832 | Ukrainian mobile |
| Network Name | SKAYVIN-BROADBAND-UA | |
| Description | "This network is not used for hosting, VPN or proxy" | A LIE โ it hosts attack infrastructure |
| Announces As | Turkey (TR) | Ukrainian network pretending to be Turkish |
| Sponsoring Org | ORG-LA684-RIPE |
โ ๏ธ The Balakleya Factor
Balakleya, Kharkiv Oblast, was occupied by Russian forces from February to September 2022. The infrastructure registered to this area raises profound questions: Was this registration made before or after occupation? Does this network operate under Ukrainian or Russian de facto control? The explicit false claim "not used for hosting, VPN or proxy" โ included in RIPE records as a deliberate deception โ suggests the registrant knows the network's true purpose must be concealed.
The Deception Architecture
A clear pattern emerges when mapping the announced countries versus actual registration countries:
The Seychelles Layer
๐ธ๐จ TechTies Inc.
| Field | Value | Significance |
|---|---|---|
| RIPE Org | ORG-TI147-RIPE | |
| Address | 306 Victoria House, Victoria Mahe, Seychelles | Classic offshore shell address |
| Network | 45.153.34.0/24 | Announces as Netherlands |
| Secondary MNT | mnt-de-xsserver-1 | German hosting provider (XSServer) |
| Hosted via | XSServer.de infrastructure | Seychelles paper, German hardware |
The perfect layering: a Seychelles entity, registered in RIPE as Dutch, physically hosted in Germany. Three jurisdictions = three different legal frameworks = no single point of enforcement.
Certificate Transparency: The Language Tells
SSL certificate records for DMZhost.co reveal 31 subdomains. Among them:
prova.dmzhost.coโ "Prova" means "test" or "proof" in Romanian and Italian. A developer's test subdomain, accidentally revealing their native language.pptechnology.cc.dmzhost.coโ A .cc (Cocos Islands) domain nested as a subdomain. The .cc TLD is heavily associated with fraud operations.mytry.dmzhost.coโ Another test: "my try." English as second language construction.server.dmzhost.co/server1.dmzhost.coโ Infrastructure scaling evidence.cpanel.dmzhost.co/whm.dmzhost.coโ cPanel/WHM: the standard bulletproof hosting control panel.
The word "prova" is the linguistic fingerprint. Combined with UNMANAGED LTD's ro-btel2-1-mnt (Romanian BTEL2 maintainer), we have dual confirmation: the operators behind these UK companies are Romanian-speaking.
The Formation Timeline
| Date | Entity | Significance |
|---|---|---|
| February 2020 | UNMANAGED LTD incorporated (UK) | The pioneer โ oldest shell in the network |
| May 2022 | W1N LTD incorporated (UK) | Second shell โ immediately after Russia invades Ukraine |
| 2022-2023 | SOLDATOV + ISAEV RIPE registrations (KZ) | Kazakhstan front companies activated |
| November 2024 | TECHOFF SRV LIMITED incorporated (UK) | Newest shell โ already has dual ASN in 7 months |
| 2025-present | Active attack campaigns from all networks | Full operational capacity |
The timeline reveals expansion. Every 12-18 months, a new corporate entity is created. Each provides additional IP space, additional jurisdictional complexity, additional layers between the operators and their infrastructure.
The Cost of the Veil
๐ฐ Operating Economics
- UK company formation: ยฃ12 (Companies House fee)
- Virtual office address: ยฃ50-200/year
- RIPE LIR membership: โฌ1,400/year
- IP allocation (/24): โฌ0 (included with LIR membership)
- Additional /24 blocks: โฌ50-200/year from secondary market
- Abuse email on Gmail: ยฃ0
Total cost to create a bulletproof hosting company with its own ASN: <โฌ2,000/year.
Revenue from hosting attack infrastructure: โฌ50,000-500,000/year per /24 block.
Return on investment: 25x to 250x.
The Jurisdictional Maze
To take down a single IP (2.57.122.238 โ the Crypto Hunter from 058I), a law enforcement agency would need to:
- Identify the IP belongs to DMZhost.co (brand)
- Trace DMZhost.co to TECHOFF SRV LIMITED (company)
- Serve a UK court order on 35 Firs Avenue, London N11 3NE (residential address)
- Discover no one at that address controls the infrastructure
- Trace the RIPE maintainer to Romania (ro-btel2-1-mnt connection)
- Request mutual legal assistance treaty (MLAT) with Romania
- Wait 6-18 months for MLAT processing
- Meanwhile, the operator registers a new company in 24 hours and migrates
This is not a bug in the system. This is the system working exactly as designed โ by those who designed it to be unenforceable.
The Network of Networks
The Verdict
๐ฏ Corporate Forensics Summary
The SSH attack enterprise operates through a minimum of 7 corporate entities across 6 jurisdictions (UK, Kazakhstan, Ukraine, Romania, Seychelles, Germany). All networks announce as Western European while actually controlled from former Soviet Union territories.
Key proof of coordination:
- SOLDATOV + ISAEV share
ru-avm-1-mnt= same Russian controller - TECHOFF SRV + UNMANAGED LTD share
ro-btel2-1-mnt= same Romanian operator - W1N LTD has Ukrainian phone (+380) = Ukrainian operational staff
- Dyachenko V.I. registered in Kharkiv war zone = jurisdictional chaos exploited
- DMZhost.co "prova" subdomain = Romanian language confirmation
- All announce Netherlands/Poland/Turkey = systematic deception
The enterprise doesn't just attack systems. It has incorporated itself into the legitimate corporate registry of the United Kingdom. It files dormant accounts. It has registered offices. It exists, on paper, as a collection of respectable technology businesses. The only thing it doesn't do is respond to abuse complaints sent to its Gmail address.
Read Between the Lines
"35 Firs Avenue, London N11 3NE" is a real house on a real street in the borough of Enfield. Someone lives there. That someone either knowingly provides their address for bulletproof hosting registration โ or doesn't know their address is being used. Both scenarios are crimes under UK law: either complicity in fraud (Fraud Act 2006, s.2) or identity fraud against the householder (s.6).
The village of Novoselovka, North Kazakhstan region, population approximately 800, is officially the registered business address of a hosting company with 46 confirmed malicious relationship links in our intelligence database. A village of 800 people. Running bulletproof hosting. From Jambula Street.
W1N LTD declared itself dormant to Companies House โ meaning it filed no accounts, declared no revenue, paid no taxes. While simultaneously operating dedicated server infrastructure. This is not creative accounting. This is tax fraud combined with corporate fraud, committed in writing, submitted to a public registry.
Next: TI-2026-058L โ "The Indonesian Amplifier" โ Why Indonesian infrastructure hits 47.75 times per IP while the global average is 3.2.
โ ๏ธ Correction & Update โ 2026-07-04
Reason for update: Live re-verification and a confirmed cross-link, 2026-07-04. Nothing above has been altered or removed; this is an append-only forensic addendum.
The ISAEV network remains active and ties directly to the botnet. As of 2026-07-04, 87.251.64.0/24 (RDAP org ru-avm-1-mnt, abuse contact abuse@novahost.kz, announced from Poland) was last seen 2026-06-29 and remains highly active; its node 87.251.64.176 (threat 100/100, GreyNoise malicious) is a confirmed member of the 026M 1,313-node libssh botnet โ directly connecting the shell-company hosting to the botnet infrastructure.
Methodological note: in the live RDAP data, the SOLDATOV network resolves its org handle to soldatov-av-mnt (a distinct handle that shares the same Kazakh operator brands, hostup.kz / novahost.kz). The unification of SOLDATOV and ISAEV under a single ru-avm-1-mnt maintainer rests on the RIPE mnt-by object; the shared abuse-contact and operator-brand evidence independently supports the same conclusion. Original analysis preserved above.
Added by automated platform-wide correctness audit (LSN threat-intel), 2026-07-04. Method: cross-checking published claims against live honeypot / campaign / entity-resolution data via MCP tools.