The Deed and the Tenant — Who Really Owns the IP That Attacked You

TI-2026-068B · Series: 🧭 Ground Truth · TLP:WHITE · 2026-07-09

068A found 60,077 places where the graph records disagreement. This one walks into the second-largest: the 10,813 IPs where two sources cannot agree who owns them — and shows that the disagreement is not error. It is a market.

📋 The Short Version

Ask two authorities who owns an IP address and you often get two different companies. One answers from BGP — who announces the address to the internet. The other answers from the registry — who the address is registered to. In this graph, 10,813 IPs carry exactly that conflict, and in 79% of them the announcer and the registrant are genuinely different entities.

That gap is not a data-quality problem. It is the IP-leasing economy made visible: a broker holds the deed, a tenant flies the flag, and when the address misbehaves, each can truthfully say "not mine."

And it is not academic. 1,967 of these contested-ownership IPs attacked our own web edge — many with a perfect hostility score. The addresses where "who is responsible" has no clean answer are disproportionately the addresses that attack.

Confidence: HIGH on the census. MEDIUM that any single mismatch is deliberate — because, as §6 admits, lawful leasing wears the identical mask.

1. Two Answers to One Question

Every one of the graph's 10,813 org conflicts sits on an IP entity, and the shape is always the same — Team Cymru (reading BGP) names the announcer; RDAP (reading the registry) names the registrant:

Where both sources are present (10,681 IPs), the two names are genuinely different entities in 8,483 cases — 79%. Disagreement is the rule, not the exception.

2. The Gap Is a Market

Look at who the registrants are, and the mechanism names itself. The RDAP title-holders sitting over differently-announced tenants are frequently the IP-leasing brokers:

This is the lease-an-IP business as raw data. A broker registers a block; an operator announces it; the two are different companies by design. 172.110.219.251 and 172.110.221.82 share one deed-holder (IPv4 Superhub Limited) and two different tenants (YSZ Trading, haoxiangyun) — a landlord and its renters, visible only because the graph kept the disagreement.

Two other patterns ride the same rails:

• Generic brand over a registered shell — 94.183.159.116 announces the anonymous word "Cloud," but the deed says CGI Global Limited, Hong Kong.
• Named operator behind a bulletproof maintainer — 195.26.87.217 flies Sollutium EU (Poland) while the registry maintainer is Virtual Systems LLC / VSYS-MNT, a name that recurs across abuse infrastructure.

3. Contested Identity Is Abuse-Adjacent

The ASNs that carry the most conflicting attributes are not random. They are a roster of networks this publication has already dossiered as bulletproof or shell operators:

Being hard to pin down in the registry and being abuse-tolerant turn out to be the same networks. Identity discrepancy is a weak abuse indicator in its own right — not proof, but a flag worth weighting.

4. The Gap Lands Where the Attacks Come From

Here is why this is not a filing-cabinet curiosity. Of the 10,813 IPs whose ownership the graph cannot reconcile, 1,967 attacked our own web edge with a classified intent — many at an effective-bad-rate of 1.0:

The ownership ambiguity concentrates on exactly the addresses that behave with hostility. When an abuse report needs to land, it arrives at a fork: the announcer says "we only route it," the broker says "we only lease it," the registrant says "we don't operate it." Responsibility is diffused across three parties, each pointing at the next — and that diffusion is densest precisely where the attacks originate.

5. Why the Graph Can See It

068A described the authority ladder: RDAP (priority 95) outranks Team Cymru (60). So the graph resolves each of these IPs to its registered holder — the deed wins. But it does not throw the announcer away; it files the disagreement in re_conflict.

That retained conflict is what makes the leasing layer legible. The canonical answer names the registrant (the landlord); the recorded disagreement names the announcer (the tenant). Read together, the two are a description of the lease. A database that kept only the winning value would have erased the entire market.

6. The Honest Limit — Lawful Leasing Wears the Same Mask

The uncomfortable truth: not every announce-vs-register mismatch is evasion. Leaseweb leasing a block to a legitimate startup produces the identical signature as a bulletproof host fronting for a scanner — registrant ≠ announcer, in both cases.

That indistinguishability is the actual finding. The ownership fields cannot separate a normal tenant from a criminal shell; both split title from operation the same way. So the mismatch is not a malice detector — it is a structural weakness in how the internet records responsibility, and legitimate and criminal leasing exploit it alike.

Which is exactly why identity cannot be the last word. The deed tells you who holds title; only behavior (067, 068A) tells you what the tenant did. This series resolves identity as far as identity can be resolved — and then hands the verdict to conduct.

7. What This Means

• For attribution. Never quote a single ownership source on a leased-space IP. The announcer and the registrant are both true and both incomplete; the honest attribution names both roles.
• For abuse handling. A takedown on a contested IP must be addressed to the registrant and the announcer, because each will otherwise disclaim. The 1,967 hostile contested IPs are the working set where this matters today.
• For the series. 068A gave the method; 068B drilled the ownership conflict. Next, "Ground Truth" turns to the threat-label conflicts (12,561) — what the graph's inability to agree on what kind of malicious reveals about reading the kill chain from the outside.

Investigation Metadata

Cross-references: TI-2026-068A (The Authority — the conflict census) · TI-2026-026D (The IP Marketplace) · TI-2026-066D (The Quiet German — AS200373, one of the contested attackers) · TI-2026-022F (The Geographic Liar) · TI-2026-053F (Fourteen Thousand Tenants — the sub-allocation economy).