The Nursery: One RIPE Allocation Range, a Brood of Costumes

TI-2026-082F · The Tripwire Ledger, Part F Confidence: MEDIUM-HIGH — the shared allocation range and the lead actor are documented; the coordination reading is a hunting heuristic, stated as such and no further Classification: TLP:WHITE

A second thread from the same knot

Part C of this series found the first foundry: EMBNEX, a three-month-old broker whose single IPv6 /32 was carved into costumes for a cone of tiny ASNs. The lesson was that laundered identities collapse into one object when you cluster them by number-resource provenance — the block they route from — rather than by the brand they wear.

That was one axis. This part finds a second one, running perpendicular to it.

When Part A (VASH KREDIT) and Part E (DEDIK) were written, each carried a small, easily-overlooked footnote: both autonomous systems were minted from the same RIPE ASN-allocation range. At the time that was a corroborating detail. Followed on its own, it becomes the subject. Because when you list every small assignment in that one contiguous range and score it, a pattern falls out that neither the honeypot nor the web pipeline would ever surface: a strip of adjacent AS numbers, disproportionately populated by abuse-100 costumed budget hosts. A nursery.

This dossier maps that nursery, states with care what it does and does not prove, and profiles its most substantial resident — a novel, dual-vector penny host that had never appeared in the corpus until the enriched router ledger put it there.

The lead exhibit: OC NETWORKS LIMITED, trading as "1Cent Host"

AS209693 announces under the holder name OC-NETWORK OC NETWORKS LIMITED (GB), and fronts a retail brand that tells you its whole business model in a word: 1cent.host — penny hosting, the cheapest floor of the market. The domain was registered 2023-10-15 through NameSilo and hides behind Cloudflare.

It is the biggest costume the series has profiled. Where VASH KREDIT and DEDIK were two-prefix shells, OC Networks is a real multi-prefix operation — thirteen-plus IPv4 /24s (95.85.246.0/24, 64.188.83.0/24, 45.88.88.0/24, 77.239.126.0/24, 31.76.22.0/24, …) plus IPv6 2a12:bec4:1482::/48, riding twenty-seven BGP upstreams including Hurricane Electric and M247. This is not a facade with nothing behind it; it is a functioning budget host with real capacity.

And it wears the same costume as everything else in this series, only one layer deeper. Pull its RIPE registrations apart and the jurisdiction will not hold still:

• The ASN holder is GB (United Kingdom).
• Its inetnums carry netname CENTHOST / EE-CENTHOST, with registered countries PL (Poland), DE (Germany) and EE (Estonia).
• Its IPs geolocate variously to CZ, NL, DE.
• Two prefixes are maintained by lir-us-acedatacenter-1-MNT — a US LIR trading as "acedatacenter."
• And one of its announced prefixes, 45.88.88.0/24, is not its space at all: the RIPE org-name is Neterra Ltd (BG), tagged WAF — Bulgarian space sublet and announced under OC Networks' ASN.

Count them: GB, PL, DE, EE, CZ, NL, US, BG. A penny host stretched across eight jurisdictions, reselling a Bulgarian block, maintained by a US LIR, wearing an Estonian netname under a British holder. This is not a company with an international footprint. It is the series' costume — the geography that refuses to resolve — worn by an operation big enough to matter.

Dual-vector: the first to trip both sensors

Every prior part of this series was caught by one door. VASH KREDIT and VPSVAULT (A, B) touched only the router's management ports. DEDIK (E) came only at the web edge. OC Networks is the first to appear on both of this estate's independent sensors at once:

• On the router tripwire: 95.85.246.45 tripped the mikrotik-attack management-port auto-ban (2026-06-26/27) — the same zero-false-positive sensor that opened this series.
• On the SSH honeypot: 95.85.226.199 probed the Cowrie honeypot and carries the tag actor_cluster_001 — this estate's single largest documented honeypot actor cluster — with further sessions from 64.188.83.244 and 64.188.83.134. AbuseIPDB scores the cluster IP 100.

That dual presence matters for two reasons. First, it raises OC Networks above a mere ban-list entry: it is a live participant in the estate's biggest honeypot cluster and a management-plane prober, from the same address space, in the same window. Second, it is the cleanest demonstration yet that the enriched router ledger and the honeypot are now one intelligence surface — the promotion pipeline built earlier this month means an IP seen on the router and an IP seen in the honeypot land in the same graph, and OC Networks is where those two sensor-worlds visibly meet on one operator.

The nursery, stated precisely

Now the structural finding — and here the discipline matters most, because it is the easiest place in the whole series to over-claim.

List every abuse-90-or-higher assignment inside the RIPE ASN range around 209308–209700, and this is the brood:

Six small, abuse-heavy, sensor-active budget hosts, packed into one stretch of adjacent AS numbers. That is the nursery.

What this proves, and what it does not. Every one of these ASNs returns the identical ARIN RDAP date — 2018-08-20. It is tempting to read that as "all registered on the same day, therefore coordinated." It is not that, and this dossier will not say it is. That date is the ERX block-record date for the RIPE ASN range, not a per-ASN assignment timestamp — it stamps the whole number-block, so every member shows it. What the evidence supports is precise and narrower: these hosts occupy one shared RIPE allocation range, and that range shows an abnormal density of abuse-100 costumed budget hosts among its small assignments. That is a provenance axis — a hunting heuristic — not a proof of single operation. To claim a common operator from a shared number-range would be exactly the invented-certainty this series exists to avoid.

And the nursery is mixed. The same range holds assignments that are perfectly legitimate — AS209366 SEMrush (an SEO crawler), AS209341 A2 Hosting — and at least one, MODAT, that is a security scanner, not an attacker. So the range is not a block where every tenant is hostile. It is a mixed nursery: a number-range whose small assignments are disproportionately, but not exclusively, abuse hosts. It is documented here exactly as the Part D costume catalog was — a watchlist keyed on provenance, a reason to flag a new resident on sight, and explicitly not a reason to convict the whole range.

Two axes, one population

Put Part C and this part together and the method sharpens into something more general than either alone.

Part C's axis was the IPv6 broker: costumes that draw their address space from one parent /32 are one supplier's output. This part's axis is the RIPE ASN-allocation range: costumes assigned adjacent AS numbers in one issuance range share a provenance too. They are independent axes — one keyed on the address block, the other on the autonomous-system number — and the most telling fact is that the series' anchor actors sit on both at once. VASH KREDIT and DEDIK appear in the EMBNEX-adjacent IPv6 neighbourhood and in this ASN nursery.

That is what "cluster by provenance, not by name" actually means in practice: an actor wearing a fresh, clean, unrelated brand is nonetheless pinned by the number resources it could not choose — the IPv6 parent it was handed, the ASN range it was assigned from. Two axes give two independent ways to collapse a costume back onto its origin. An operator can rebrand endlessly and cheaply; it cannot as easily escape the block its addresses and its AS number came from. Watch the origins, and the wardrobe stops working.

The honest ledger

Three limits, as every part of this series has carried:

• OC Networks / 1Cent Host is a novel, dual-vector, multi-jurisdiction penny host — HIGH confidence, on the routing, the registration, and its presence on both estate sensors.
• The nursery is a shared allocation range with abnormal abuse density — HIGH confidence on the range and the density; the coordination reading is a MEDIUM-confidence hunting heuristic, and the shared 2018-08-20 date is explicitly a block record, not proof of same-day registration.
• No individual is named, and the range is not convicted wholesale. The costume template, the privacy fronts, and the mixed legitimate tenants all forbid it. What is characterised is a provenance axis and a trade, not a person or a guilty block.

What survives all three: a second number-resource axis for pinning laundered identities, and a substantial new actor found sitting on it and on both of the estate's sensors.

The translation, for everybody

In this series you've been catching burglars whose vans all trace back to one rental yard. Part C found the yard that rents the licence plates. This part found something next to it: a single page of the vehicle registry — one block of consecutive plate numbers — where an oddly large share of the plates were handed to the exact kind of one-man "moving companies" that keep turning up at your doors.

Not all of them. On that same page of the registry there's a real courier firm and a legitimate survey company. So you don't accuse the whole page. But you've noticed that this particular run of plate numbers breeds a lot of trouble — so when a new van rolls up wearing a fresh name and a freshly-painted sign, you don't just read the sign. You check two things the driver can't repaint: which plate-yard the plates came from, and which page of the registry the number was issued on. If both point at the bad block, you keep an eye on him — no matter how nice the sign.

And the van this time — "1Cent Host" — is a bigger operation than the earlier ones: a real fleet, not a single decoy van, its papers claiming eight different countries, one of its trucks borrowed from a Bulgarian firm. You caught it twice on the same day — once trying your back service-panel, once at your front door — which is how you know it's not a stray. You will never get the driver's name. You didn't need it. You needed the plate-yard and the registry page, and now you have both.

The Tripwire Ledger — Part F

A shared RIPE allocation range, six costumed budget hosts packed into it, and one substantial new resident — OC Networks / 1Cent Host — caught on both the router tripwire and the honeypot, laundered across eight jurisdictions, reselling borrowed space. Not a proof of one hand; a second axis of origin for pinning the many hands that wear the same costume. Two foundries now, two provenances, one population.

The Tripwire Ledger continues. Watch the block the addresses came from, and the block the number came from — the costume changes, the origin doesn't.

The series

Cross-references

• TI-2026-082C — The Address Foundry — the EMBNEX IPv6-broker axis this ASN-range axis complements.
• TI-2026-082A / 082E — VASH KREDIT and DEDIK, the anchor actors sitting on both provenance axes.
• TI-2026-082D — The Costume Catalog — the watchlist discipline this mixed nursery is documented under.

This dossier documents a shared-provenance hosting nursery and a novel budget-host actor, for defensive purposes and as a watchlist. Only OC Networks / 1Cent Host is profiled as an actor; the other range members are listed on the basis of shared allocation-range provenance and their independent AbuseIPDB/sensor records, and the range is expressly NOT convicted wholesale — it holds legitimate assignments. The shared 2018-08-20 date is a RIPE block record, not proof of coordinated registration. No individual is named. Named upstreams/maintainers/Neterra are identified for routing accuracy. TLP:WHITE.