The DMZHOST Trinity: One Operator, Three Shells, Two Autonomous Systems

TI-2026-088 · Honeypot Field Reports · Confidence: HIGH (network + registry primary sources)

A honeypot does not care what a company calls itself. It records what an address does. Over eight weeks our SSH sensor watched a set of addresses log in with stolen-looking root passwords, fingerprint the machine, and move on — and every time we asked the registry who owns this, it answered with a different name. UNMANAGED LTD. TECHOFF SRV LIMITED. DMZHOST. Three names, two autonomous systems, one operation. This is the anatomy of that operation — and of the paperwork built to keep you from seeing it as one.

The finding in one paragraph

AS47890 ("UNMANAGED-DEDICATED-SERVERS," holder UNMANAGED LTD, GB) and AS48090 ("DMZHOST," holder TECHOFF SRV LIMITED, GB) are two separately-incorporated UK companies that are, at the network layer, provably one operation. Both sit on the Spamhaus ASN-DROP list — the most severe network-level verdict Spamhaus issues, meaning the entire address space should be dropped because the network is controlled by, or leased to, threat actors. Both are classified bulletproof (risk 92–95/100). They are registered in Great Britain, routed out of Romania and the Netherlands, and their RDAP objects variously claim Andorra, Bulgaria, the Netherlands and the Seychelles. The two "separate" companies are welded together by a single shared network maintainer (TECHOFF-MNT), a single free-Gmail abuse desk (dmzhostabuse@gmail.com), and a single prefix — 2.57.122.0/24 — that is announceable from both autonomous systems at will. On top of this infrastructure runs a coordinated SSH credential-stuffing and server-profiling botnet; the loader it drops is documented separately in TI-2026-083C, "The Appraiser." This dossier is about the landlord, not the tenant.

1. What the honeypot saw

Between late May and late July 2026, addresses across four Romanian /24s (2.57.121.0/24, 2.57.122.0/24, 80.94.92.0/24, 92.118.39.0/24) and one Dutch /24 (195.178.110.0/24, plus 45.148.10.0/24) hammered our SSH service. The pattern was monotonous and identical across every node:

• Login: root:123456, root:1234, root:111111, root:12345, admin:admin, ubuntu:ubuntu — a shared weak-credential dictionary. On AS47890 alone, root:123456 was tried 49 times from 12 distinct IPs, root:1234 45 times from 13 IPs.
• On success: a single ~2 KB profiling one-liner — a uname probe with five fallbacks, /proc/version, then CPU/GPU/uptime/login-history harvesting. Zero downloads. The cluster steals nothing and drops nothing on first contact; it appraises the machine. (The full loader behaviour is dissected in TI-2026-083C.)
• Fingerprint: the SSH client HASSH 16443846184eafde36765c9bab2f4397 — a Go-based scanner — recurs across the whole footprint, alongside one shared command-automation hash 668c13b46ed6fac0 spanning a 28-IP cluster.

Multiple nodes sustain a threat score of 100 with successful root logins. Behaviour classifier verdict: botnet(c2_infrastructure), confidence 0.8–0.9. This is not opportunistic noise; it is a managed operation running the same toolkit from every address.

[DOCUMENTED] The hosted addresses run one coordinated SSH operation. [DOCUMENTED] The hosting is deliberate and long-lived — the same ranges appear in ~50 AlienVault OTX pulses each, including SSH Brute-Force Honeypot Live.

2. Three names — and why the registry lies cleanly

Ask the registry who owns an attacking IP and you expect one answer. Here you get three, and they are interchangeable:

An IP on the UNMANAGED autonomous system answers as TECHOFF, or as DMZHOST. This is not database rot. It is the operator using three labels across two networks so that any automated attribution — the kind that files an abuse report to "the registered owner" — fragments into three dead ends.

Our entity-resolution graph collapses the three labels to a single operator. The interchangeability is the identity. When sources disagree on who owns something, the disagreement is not noise to be resolved by picking a favourite — it is the finding.

3. The corporate layer: two real shells, engineered apart

Here the story sharpens, and it is more interesting than "one company with aliases." The two names correspond to two genuinely separate UK companies:

UNMANAGED LTD — Companies House #12461131, incorporated 13 February 2020. Registered office: Business First Northampton, Brindley Close, Rushden, NN10 6EN — a "Business First" serviced/virtual-office address, not a data centre. SIC codes cover IT consultancy, facilities management, hosting and web portals. Sole director and 75%+ Person with Significant Control: BUNEA, Petru-Octavian, Romanian, born April 1988, resident England. Filings are current — no strike-off, no overdue accounts. On paper, a tidy little British IT company.

TECHOFF SRV LIMITED — Companies House #16090235, incorporated 20 November 2024 — weeks before it assumed the DMZHOST (AS48090) org handle in RIPE (last-changed 2024-11-26). Registered office: 72 Halliwick Road, London N10 1AB. But its RIPE org object (ORG-TSL73-RIPE) lists a third address — 35 Firs Avenue, London N11 3NE. Its SIC code is 96090, "Other service activities not elsewhere classified" — a generic catch-all with nothing to do with hosting. Sole director and PSC: Luca Palo, Italian, born March 1995, resident Milan.

Two companies. Different directors, different nationalities, different addresses — no overlap. A naive registry check reads two unrelated British firms. That is exactly the intended effect: the corporate separation is the disguise. If you attribute at the corporate layer, you conclude these are two different businesses that merely happen to both host abuse. You would be wrong.

[DOCUMENTED] UNMANAGED LTD and TECHOFF SRV LIMITED are legally distinct entities with no shared registered address or director. [INFERRED] The separation is deliberate compartmentalisation, not coincidence — because the network layer betrays them.

4. The smoking gun: one prefix, two origins, one maintainer

Corporate registries can be gamed. Routing registries are harder, because the network has to actually work. And the network gives it away.

The RIPE whois record for 2.57.122.0/24 — the /24 behind our single most-abused node — reads:

• netname: DMZHOSTdotco
• org: TECHOFF SRV LIMITED
• abuse-c: dmzhostabuse@gmail.com
• mnt-by: TECHOFF-MNT

…and then it carries two route objects: origin: AS47890 and origin: AS48090 — both mnt-by: TECHOFF-MNT.

Read that slowly. This is a TECHOFF-maintained block, named for dmzhost.co, that can be announced from the UNMANAGED autonomous system or the DMZHOST autonomous system, at the operator's discretion. The maintainer TECHOFF-MNT and the abuse handle dmzhostabuse@gmail.com therefore sit on both ASNs. The two "separate companies" share the one thing that cannot be faked without breaking the network: control of the route.

This is dual-origin routing, and it is a deliberate resilience-and-evasion design. If one ASN gets de-peered, blocklisted harder, or burned, the prefix flips to the sibling. It is the network-engineering equivalent of holding two passports.

[DOCUMENTED · HIGH] A single maintainer (TECHOFF-MNT) and a single abuse address control prefixes announced from both AS47890 and AS48090; 2.57.122.0/24 is dual-origin-announceable from both. This is the operational identity the corporate paperwork conceals.

And the abuse desk? A free Gmail address. A hosting operation of this scale routing its entire abuse function through dmzhostabuse@gmail.com is not an oversight — a Gmail abuse contact on commercial infrastructure is, as it is across this ecosystem, the tell. It is the address to which the 81,943 AbuseIPDB reports against one of its IPs are, in theory, delivered.

5. Jurisdictional arbitrage: registered nowhere it operates

Trace the operation across jurisdictions and it dissolves on contact:

• Registered: Great Britain (both ASNs, RIPE; both companies, Companies House).
• Routed: Romania (AS47890 — upstream AS9050 Orange Romania, plus RETN, Telia/Arelion, Vodafone Romania) and the Netherlands (AS48090 — sole upstream AS57717 FiberXpress BV).
• Declared in RDAP: the Netherlands, Bulgaria (Team Cymru geolocation), and Andorra — 195.178.110.0/24 literally declares country AD and uses route-maintainer MNT-NETERRA (Neterra, Bulgaria).
• Attributed by Spamhaus: AS47890 → Romania, domain bunea.eu; AS48090 → Seychelles, domain dmzhost.co.
• Marketed: "the best place in Europe" (dmzhost.co).

A single IP can read Romania by AbuseIPDB, Romania or Bulgaria by Team Cymru, and the Netherlands or Andorra by RDAP. The GB registration touches nothing operational. No British data centre, no British transit, no British director for the DMZHOST half. The United Kingdom is a letterhead.

This is jurisdictional arbitrage in its purest form: incorporate where the paperwork is cheap and respectable-sounding, route where the transit is tolerant, declare a scatter of small countries with weak abuse enforcement, and let every would-be reporter guess which national CERT, registrar or police force has authority. The answer is designed to be: none of them, alone.

6. The human thread: Bunea, and a network that carries his name

Most bulletproof dossiers dead-end at a shell. This one has a rare personal anchor. UNMANAGED LTD's sole director is Bunea Petru-Octavian. Spamhaus attributes AS47890 to the domain bunea.eu. And AS47890's downstream customer is AS42397 — "BUNEA-HIGH-VOLUME-NETWORK."

The director's surname threads through the ASN's Spamhaus domain attribution and a named downstream autonomous system. A UK-registered "IT consultancy" whose network is attributed to a personal domain and feeds a "high-volume network" bearing the director's own name is not an arm's-length hosting reseller. [INFERRED · MEDIUM-HIGH] The British company is administrative cover for a Romania-run network personally associated with its director. The TECHOFF/DMZHOST half, by contrast, is a fresher construction — an Italian-directed shell incorporated in November 2024 to take over an older offshore brand (dmzhost.co claims trading since 2009). One veteran operator, one newly-minted shell wearing an old brand.

7. What it hosts — and the discipline of not over-claiming

The botnet on this infrastructure shares a wordlist, a Go-scanner HASSH, and a command-automation fingerprint. Those same signals also reach 91.92.40.0/24. It would be easy — and wrong — to fold 91.92.40 into "the DMZHOST botnet."

91.92.40.0/24 is announced by AS197170, TechTies Inc. — Seychelles-registered, created 2026-05-29, abuse abuse@tech-ties.net, Spamhaus-attributed to hostslick.de (the German "HostSlick" offshore brand). It shares no maintainer, no org, no abuse contact with UNMANAGED/TECHOFF. It is a different bulletproof operator.

So what does the shared tooling mean? It means either one botnet tenant renting from multiple bulletproof hosts, or a commodity wordlist and scanner used by many crews. A weak-password dictionary and an off-the-shelf Go scanner are forgeable, copyable signals — the kind that any unrelated operator running the same tool reproduces. They are evidence of a shared toolkit or a shared abuse-tolerant ecosystem, not of shared ownership.

We hold this line deliberately, because the opposite error — fusing everyone who shares a public artifact into one imaginary mega-actor — is how attribution graphs rot. DMZHOST and TechTies/HostSlick are two separate landlords in the same bad neighbourhood, and some of the same tenants knock on both doors.

[DOCUMENTED] 91.92.40.0/24 belongs to a distinct operator (TechTies/HostSlick, AS197170). [DOCUMENTED] Shared forgeable signals do not establish common ownership.

8. The institutional-anchor pass: who keeps a dropped network alive

Nothing operates without anchors in official structures. For a network on Spamhaus ASN-DROP — a network the industry has formally recommended dropping in its entirety — the interesting question is what keeps it reachable at all. The anchors:

• RIPE NCC — allocated and still maintains AS47890 (2020) and AS48090 (2019); memberships remain active despite dual ASN-DROP listing.
• UK Companies House — provides two "respectable," current-filing corporate identities.
• Upstream transit — Orange Romania (AS9050), a national incumbent telco, carries AS47890; FiberXpress BV (AS57717) carries AS48090; Neterra (Bulgaria) maintains a route object on the Andorra-declared block. These carriers are the load-bearing anchor: a bulletproof network is only bulletproof while a legitimate transit provider keeps announcing its routes.

The gap is the abuse function: a free Gmail address that, against 81,943 reports on a single IP, demonstrably does not act. The anchors that enable the network (RIR allocation, incumbent transit, tidy corporate filings) are robust; the anchor that would constrain it (a working abuse desk) is a webmail inbox. That asymmetry is the business model.

9. Seven questions

Who is it? Two legally separate UK shells — UNMANAGED LTD (dir. Bunea, RO) and TECHOFF SRV LIMITED (dir. Palo, IT) — operating AS47890 and AS48090 under the brand DMZHOST, merged at the network layer.

What did it do? Hosted a coordinated SSH credential-stuffing/server-profiling botnet; both ASNs earn Spamhaus ASN-DROP and bulletproof classification.

Where is it? Registered GB; routed RO (Orange Romania) and NL (FiberXpress); declared variously AD/BG/NL/SC. Nowhere it claims and everywhere it needs.

When? AS48090 since 2019, AS47890 since 2020; TECHOFF SRV LIMITED incorporated Nov 2024 to assume the DMZHOST brand; observed attacking continuously May–July 2026.

How are the two ASNs one operator? Shared maintainer TECHOFF-MNT, shared Gmail abuse desk, and a dual-origin prefix (2.57.122.0/24) announceable from both.

Why the structure? Jurisdictional arbitrage and attribution fragmentation: separate shells defeat corporate-registry attribution; dual-origin routing defeats single-ASN takedown; a scatter of declared countries defeats single-jurisdiction enforcement.

Why should you care? Because the "UK company" label on an attacking IP means nothing here, and the tooling it hosts is the loader documented in TI-2026-083C — the appraiser that decides whether your server is worth keeping.

10. The counter-narrative, steelmanned — then defeated

The strongest innocent reading: "UNMANAGED LTD and TECHOFF SRV LIMITED are legitimate discount hosts. Bulletproof classification is guilt-by-association; any cheap unmanaged VPS provider accumulates abuse because customers misuse servers the host never inspects. Spamhaus ASN-DROP over-blocks. The three names are just resellers and rebrands. The Gmail abuse desk is amateurism, not malice."

It is a fair argument for a single budget host. It does not survive this evidence:

1. A legitimate host does not dual-origin a customer prefix across two separately-incorporated companies' ASNs. That is not how reselling works; it is an operator-controlled failover between networks it both controls. Legitimate separation would show separate maintainers.
2. A legitimate host answers abuse. 81,943 reports on one IP, last delivered 2026-07-20, with the IP still live and still attacking, is not a backlog — it is a policy.
3. A legitimate host does not need to declare Andorra. The country smear across AD/BG/NL/SC/RO has no operational purpose except to frustrate reporting.
4. Independent convergence. Spamhaus (registry-level DROP), AbuseIPDB (six-figure reports), Team Cymru (names the shells and the virtual-office facade by hand), and our honeypot all arrive at the same place from different data. Guilt-by-association requires one accuser; this has four, disjoint.

The innocent reading explains a messy host. It cannot explain a coordinated one.

11. Read between the lines

• The virtual office in Rushden and the catch-all SIC code in London are not sloppiness; they are the minimum viable corporate footprint — enough to exist on the register, not enough to be anywhere.
• TECHOFF incorporated in November 2024, days before taking the DMZHOST handle, tells you the brand is the asset and the company is disposable. When TECHOFF becomes toxic, another Companies House filing and another £12 buys a fresh face for the same ASN.
• The dual-origin prefix tells you the operator planned for one of the ASNs to burn. They built the escape hatch before they needed it.
• The director's name on the downstream ASN (BUNEA-HIGH-VOLUME-NETWORK) tells you the UNMANAGED half is not an anonymous shell at all — it is a named person's network wearing a British coat.

12. What if

What if AS48090 is dropped hard tomorrow? The 2.57.122.0/24 route flips to AS47890; the DMZHOST brand migrates to a new TECHOFF-successor shell; nothing meaningful stops. Takedown of one ASN is a speed bump, by design.

What if you filed a perfect abuse report? It lands in a Gmail inbox with, on current evidence, no operational consequence. The constraining anchor does not answer.

What if you treated the three names as one from the start? You would have attributed correctly on day one — which is precisely why the operation is built to make you treat them as three.

13. Documented vs inferred — the honest ledger

14. Infrastructure & IOCs

Autonomous systems

• AS47890 UNMANAGED-DEDICATED-SERVERS / UNMANAGED LTD (GB; routed RO). Upstreams: AS9050 (Orange Romania), AS9002 (RETN), AS1299 (Telia/Arelion), AS12302 (Vodafone Romania). Downstream: AS42397 (BUNEA-HIGH-VOLUME-NETWORK). Abuse: abuse@unmanaged.uk.
• AS48090 DMZHOST / TECHOFF SRV LIMITED (GB; routed NL). Upstream: AS57717 (FiberXpress BV). Maintainer: TECHOFF-MNT. Abuse: dmzhostabuse@gmail.com.

Prefixes: 2.57.121.0/24, 2.57.122.0/24, 80.94.92.0/24, 92.118.39.0/24 (AS47890); 195.178.110.0/24, 45.148.10.0/24, 93.123.109.0/24 (AS48090). Note 2.57.122.0/24 = dual-origin (AS47890 + AS48090).

High-threat nodes (threat score 100): 2.57.122.238, 80.94.92.55, 2.57.122.209, 92.118.39.14, 92.118.39.71, 193.46.255.86 (AS47890); 195.178.110.228, 195.178.110.232, 195.178.110.217, 45.148.10.240 (AS48090).

Behavioural IOCs: HASSH 16443846184eafde36765c9bab2f4397 (Go scanner); command-automation hash 668c13b46ed6fac0; shared credential set root:123456 / root:1234 / es:12345678 / docker:123456 / centos:12345678 / ftpuser:12345.

Adjacent, distinct operator: AS197170 TechTies Inc. (SC) / HostSlick (hostslick.de) — 91.92.40.0/24. Same ecosystem, different landlord.

15. Sources

• UK Companies House — UNMANAGED LTD #12461131 · https://find-and-update.company-information.service.gov.uk/company/12461131
• UK Companies House — TECHOFF SRV LIMITED #16090235 · https://find-and-update.company-information.service.gov.uk/company/16090235
• RIPE NCC RDAP — AS47890 · https://rdap.db.ripe.net/autnum/47890 ; AS48090 · https://rdap.db.ripe.net/autnum/48090
• RIPE NCC whois — 2.57.122.0/24 (dual-origin) · https://apps.db.ripe.net/db-web-ui/query?searchtext=2.57.122.0/24
• Spamhaus ASN-DROP · https://www.spamhaus.org/drop/asndrop.json
• AbuseIPDB — 2.57.122.238 · https://www.abuseipdb.com/check/2.57.122.238
• Team Cymru, "Jingle Shells: How Virtual Offices Enable a Facade of Legitimacy" · https://www.team-cymru.com/post/jingle-shells-how-virtual-offices-enable-a-facade-of-legitimacy
• dmzhost.co (operator homepage) · https://dmzhost.co/
• AlienVault OTX · https://otx.alienvault.com/
• Related: TI-2026-083C, "The Appraiser" (the loader hosted here) · https://www.shuffle-on.com/threat-intel/ti-2026-083c-the-appraiser
• Related: TI-2026-001, "W1n LTD: Bulletproof Hosting Network" · https://www.shuffle-on.com/threat-intel/ti-2026-001-w1n-ltd-bulletproof-hosting.html

TLP:WHITE. Every claim above anchors to a primary registry record, a blocklist, a report aggregator, or direct honeypot observation. Where sources disagree on a country or a name, the disagreement is recorded as the finding, not resolved by preference. Forgeable signals (shared wordlists, common scanners) are treated as toolkit/ecosystem evidence, never as proof of common ownership.