The Bunea Sponsor: A Romanian Telecom Underwrites a UK Shell — and the Upstream That Wasn't

TI-2026-088C — Bulletproof Hosting series · Addendum to TI-2026-088 "The DMZHOST Trinity"

Confidence: HIGH for the sponsorship and maintainer findings (direct RIPE RDAP/RPSL) · the "nested ASN tree" hypothesis is REJECTED after per-ASN RPSL verification.

The finding in one paragraph

The parent dossier established that the DMZHOST operator trades as two UK shell companies — UNMANAGED LTD (AS47890) and TECHOFF SRV LIMITED (AS48090). This addendum reports who underwrites the first of those shells at the registry level, and it is not British. RIPE's own database records Bunea TELECOM SRL, a Romanian LIR in Timișoara (ORG-BTS48-RIPE, reg-nr 32205390), as the sponsoring organisation of AS47890 — and Bunea's own maintainer, ro-btel2-1-mnt, sits directly on both AS47890's aut-num object and UNMANAGED LTD's organisation object. A UK shell's bulletproof ASN is administratively carried by a Romanian telecom whose director shares the surname of UNMANAGED LTD's own director. That is the durable finding. The second half of the report is a debunk: a graph-surfaced "tree" of five downstream ASNs, which looked like a nested operator empire, does not survive RPSL verification — it is commodity-carrier noise, and it is published here with the same weight as the finding.

1. What "sponsoring-org" means — and why it is not forgeable

Two RIPE fields recur in this report and they must not be confused:

• A sponsoring-org is the LIR (a fee-paying RIPE member) that administratively sponsors and is contractually responsible for a non-LIR's number resource. It is a billing and accountability relationship, recorded in the RIPE database, auditable, and set by the LIR — not by the resource holder. You cannot spoof it into someone else's record.
• A shared upstream means two networks merely buy BGP transit from the same carrier. It carries zero ownership, registration, or organisational implication. Any two unrelated companies can share Cogent.

Half of this report rests on the first kind of link. The other half exists to tear down a false inference built on the second.

2. The sponsorship — a Romanian LIR behind a British shell

RIPE RDAP/whois for AS47890 (holder org ORG-UMNG1-RIPE, UNMANAGED LTD, Rushden, England) records, verbatim:

• sponsoring-org: ORG-BTS48-RIPE — Bunea TELECOM SRL, the Romanian LIR.
• mnt-by: includes RIPE-NCC-END-MNT, UNMANAGED, and ro-btel2-1-mnt — Bunea's own maintainer object.
• The organisation object ORG-UMNG1-RIPE (UNMANAGED LTD itself) also carries mnt-by: ro-btel2-1-mnt.

So the tie is not a single field that could be waved away. Bunea's maintainer is stamped on the ASN and on the shell company's org object, and Bunea is the named sponsor. The British shell's registration is, at the registry layer, a Romanian telecom's responsibility. That responsibility is not decorative. Under RIPE policy the sponsoring LIR signs the contract, holds the "End User Assignment Agreement," and is the party RIPE holds accountable if the resource is misused or the paperwork lapses. It is the closest thing the number registry has to a landlord of record. When a network on Spamhaus ASN-DROP has a sponsoring LIR, that LIR is not an innocent DNS entry — it is the entity that vouched for the holder and continues to carry them. A separate registry breadcrumb reinforces the picture: the dossier database flags AS42397 with re_verdict = "rebrand", meaning the entity-resolution layer already independently judged the Bunea network identity to be a rebranded continuation rather than a fresh, unrelated actor.

[DOCUMENTED] Bunea TELECOM SRL (ORG-BTS48-RIPE) is the RIPE sponsoring organisation of AS47890 and shares its maintainer (ro-btel2-1-mnt) directly on both AS47890 and UNMANAGED LTD's org object.

3. Who Bunea TELECOM is — the registry portrait

ORG-BTS48-RIPE is not a shell. It is a functioning Romanian LIR:

This is the "institutional anchor" the parent dossier flagged from the outside: UNMANAGED LTD's sole director is Bunea Petru-Octavian (Romanian, b. 1988), Spamhaus attributes AS47890 to the domain bunea.eu, and the sponsoring LIR is Bunea TELECOM SRL, whose contacts read Petru Bunea / Bunea Petru (PB20595-RIPE, PB22555-RIPE, BP6697-RIPE). The surname is the thread that runs from the UK company register, through the DNS attribution, to the RIPE sponsor.

[DOCUMENTED] the surname convergence (UK director Bunea, network domain bunea.eu, RIPE sponsor Bunea TELECOM). [INFERRED] that the "Petru Bunea" on the RIPE contacts and the "Bunea Petru-Octavian" on the UK filing are the same natural person — strong, consistent, but not proven from the records alone.

4. Bunea's own ASN family — and a synchronized blackout

Bunea TELECOM holds three autonomous systems, all under ORG-BTS48-RIPE, all maintained by ro-btel2-1-mnt:

Two details deserve to be read slowly. First, AS62380 is itself on Spamhaus ASN-DROP and platform-classified bulletproof — the sponsor's own peer network carries the same hostile-by-default judgement as the DMZHOST ASNs it underwrites. Second, AS62380 and AS35478 were withdrawn from the global routing table on the same day, 2026-07-03, roughly five minutes apart (10:44:30Z and 10:49:03Z). Networks do not usually go dark in pairs by coincidence. A synchronized, minutes-apart withdrawal of two ASNs held by one org reads as a single operational decision — a cleanup, a reorganisation, or a response — not two independent events.

The RPSL wiring inside the family is worth one more look, because it shows the three ASNs are genuinely interlinked — not merely co-owned on paper. AS42397 carries import from AS62380 accept ANY and a matching export, a direct peering statement between two of the siblings; AS35478 carries import from AS42397 accept ANY alongside its Cogent transit. So the Bunea ASNs peer with each other at the routing layer, which is exactly the kind of intra-family link that shared_bgp_upstream is not — this is declared, reciprocal RPSL between named siblings, the real thing the debunked tree only imitated. That contrast is the methodological spine of this whole report: the same graph that offered a fake five-ASN empire also contains, three edges over, a real three-ASN family, and the difference between them is legible in the RPSL if you read it instead of trusting the confidence score.

[DOCUMENTED] AS42397/62380/35478 are all Bunea TELECOM SRL, same maintainer, with declared reciprocal RPSL peering between siblings; AS62380 is on ASN-DROP; AS62380 and AS35478 were withdrawn minutes apart on 2026-07-03. [INFERRED] the paired withdrawal reflects a single operational action.

5. The debunk: the upstream that wasn't

The entity-resolution graph surfaced a tempting hierarchy: AS47890 → AS212816 (Cluster Power SRL) → {AS204094, AS205275, AS212221} → AS42708, which read like a nested operator empire hanging off the DMZHOST/Bunea root. It was carried at low confidence (0.4) on a single relation type: shared_bgp_upstream. Per-ASN RPSL verification collapses it entirely:

Look at the maintainers, because the maintainer is the tell. Each of the five is maintained by its own LIR object — lir-ro-clusterpower-1-MNT for Cluster Power, I4W-MNT for the Portuguese host, ro-romargsrl-1-mnt for ROMARG, FX-SOFT-MNT for Internet Broker, GLESYS-MNT for the Swedish provider. Not one of them is ro-btel2-1-mnt. In this cluster the maintainer has been the single most reliable ownership signal — it is what tied the UK shell to the Romanian sponsor two sections ago — and here it points five different directions, none of them Bunea. Their RPSL import statements point away too: Cluster Power imports AS50819/AS12302, I4W imports only AS9186, ROMARG imports from eight unrelated upstreams (AS6939, AS39737, AS174, AS8708, AS5483, AS9002, AS9050, AS12302), Internet Broker imports AS5606/AS6939. None of those import lists names a Bunea ASN, and none of the Bunea ASNs exports to any of the five.

Not one of the five carries ORG-BTS48-RIPE, ro-btel2-1-mnt, or any RPSL import/export statement referencing a Bunea ASN. The only thread linking them is overlapping large transit carriers — AS12302, AS174 (Cogent), AS6939 (Hurricane Electric) recur across all of them, exactly as they recur across thousands of unrelated European networks. shared_bgp_upstream was doing precisely what it always does when it is trusted: manufacturing a family out of shared plumbing. Two of the five, moreover, are already documented as separate operators in their own right — ROMARG SRL as the subject of TI-2026-036C "The SRL Factory," and INTERNET BROKER SRL as the subject of TI-2026-036A "The Romanian Corridor." Folding them into a DMZHOST tree would not merely add a false edge; it would contradict two prior investigations that established them as distinct. The debunk is not just locally correct — it is consistent with the rest of the corpus, and that consistency is itself corroboration that the tree is noise.

[REJECTED] The AS212816/204094/205275/212221/42708 tree is a commodity-carrier artifact, not a DMZHOST/Bunea operator hierarchy. No same-operator or same-owner claim is made across it.

6. Seven questions

Q1. Why would a real Romanian telecom sponsor a UK shell's bulletproof ASN? Because sponsorship is a service an LIR can sell. A RIPE membership can underwrite other people's number resources for a fee. Whether Bunea knows what AS47890 hosts or simply banks the sponsorship, its name is on the paperwork and its maintainer is on the record.

Q2. If Bunea is legitimate, why is one of its own ASNs on ASN-DROP? That is the question the record poses and does not answer. AS62380 (BUNEA-HIGH-PEER-NETWORK) carries Spamhaus's most severe network-level judgement. A sponsor whose own peer network is hostile-by-default is not a neutral bystander to the space it underwrites.

Q3. Two ASNs withdrawn five minutes apart — coincidence? Routing withdrawals are operational acts. Two, minutes apart, on ASNs held by one org, on one day, is one decision. What prompted it on 2026-07-03 is outside this record; that it was deliberate is the plain reading.

Q4. Is the surname enough to tie the UK director to the RIPE sponsor? On its own, no — surnames repeat. But it is not on its own: the UK director is Bunea, the Spamhaus-attributed domain is bunea.eu, and the RIPE sponsor is Bunea TELECOM with contacts named Petru Bunea. Three independent registries converging on one surname around one ASN is an anchor, not a coincidence — while stopping short of proving one natural person.

Q5. Why does the graph keep offering trees that aren't real? Because shared_bgp_upstream is cheap to compute and looks like structure. Every network under Cogent shares an upstream with every other. Treat that as kinship and you will "discover" an empire under every large carrier. The graph flagged it at 0.4 for a reason; the mistake would be to read 0.4 as 1.0 because the shape is pleasing.

Q6. If the tree is fake, why publish it at all? Because the tree was a live working hypothesis, and a debunk that stays private teaches no one. Naming the five ASNs and showing why each is unrelated is worth more than quietly deleting the edge — it inoculates the next analyst against the same trap.

Q7. What would upgrade the sponsorship from "administrative" to "operational"? Evidence that Bunea's own routed space carried DMZHOST botnet traffic, or that Bunea's contacts appear in the operation's tooling. That evidence is not present — Bunea's ASNs show zero honeypot hits. The sponsorship is documented; Bunea's operational involvement is not claimed.

7. The counter-narrative, steelmanned — then defeated

Steelman: "Sponsorship is a routine LIR service; Romanian telecoms sponsor foreign resources all the time. A shared maintainer can be a leftover from a setup done as a favour. And you have just spent a section admitting the scary-looking ASN tree is fake. So Bunea is a normal LIR that once did paperwork for a customer, and you have nothing."

Defeat: Two facts survive that a "routine LIR" story does not absorb. First, the sponsor's own AS62380 is on Spamhaus ASN-DROP and bulletproof-classified — routine LIRs are not hostile-by-default networks. Second, the maintainer is not a leftover on one object; ro-btel2-1-mnt is stamped on the ASN and on the shell's organisation object, and Bunea is the named sponsor — three places, not one. The debunked tree is conceded because it was noise; conceding it is what earns the reader's trust for the two links that are not. Discarding the fake evidence is how you protect the real evidence.

8. Read between the lines

The interesting move in this cluster is not the UK shells — those are the visible facade the parent dossier already dismantled. It is that the facade is underwritten from Romania, by a named LIR, whose own peer ASN is on ASN-DROP, and whose sibling ASNs went dark in a coordinated blackout. The registry is telling a quieter story than the honeypot: the operation's British paperwork rests on a Romanian foundation, and that foundation has its own history. The debunked tree, meanwhile, is the graph's way of testing whether you will accept structure just because it is offered. The report's job was to keep the Romanian foundation and throw the Cogent-shaped mirage back.

9. What if

What if you pivoted on ro-btel2-1-mnt instead of on company names? The maintainer is the thread that ties a Rushden shell, a Timișoara LIR, and a dropped bulletproof peer network into one administrative hand — across two countries and three org names. Company registrations are cheap to spin up and abandon; a shared RIPE maintainer across a UK org object and a Romanian ASN family is the kind of link that persists because it is operationally load-bearing, not cosmetic. The same pivot that reveals the real family is also what protects you from the fake one: if you had chased company names you might have wandered into the five-ASN tree looking for more "Romanian hosting"; if you chase the maintainer, the tree simply never appears, because none of those five carry ro-btel2-1-mnt. One disciplined selector — the maintainer object — simultaneously surfaces the genuine sponsorship and filters out the commodity-transit mirage. That is the practical payload of this dossier: not a longer blocklist, but a better index, and the register itself will tell you which networks belong to this operator if you ask it the right question.

10. Documented vs inferred — the honest ledger

11. Infrastructure & IOCs

Sponsor / anchor    ORG-BTS48-RIPE  Bunea TELECOM SRL (LIR, Timișoara, reg-nr 32205390)
                    maintainer ro-btel2-1-mnt  (also on AS47890 + ORG-UMNG1-RIPE)
                    admin-c PB22555-RIPE | abuse-c AR56129-RIPE | domain bunea.eu

Sponsored           AS47890  UNMANAGED LTD (ORG-UMNG1-RIPE, GB)  sponsoring-org = ORG-BTS48-RIPE

Bunea ASN family    AS42397  BUNEA-HIGH-VOLUME-NETWORK   announced | not Spamhaus | re_verdict rebrand
                    AS62380  BUNEA-HIGH-PEER-NETWORK      DOWN 2026-07-03 10:49Z | Spamhaus ASN-DROP | bulletproof
                    AS35478  DATACENTER Bunea TELECOM SRL DOWN 2026-07-03 10:44Z | not Spamhaus

DEBUNKED (not DMZHOST/Bunea — commodity upstream only):
  AS212816 Cluster Power SRL (RO) · AS204094 I4W Web Solutions (PT) · AS205275 ROMARG SRL (RO, TI-2026-036C)
  AS212221 INTERNET BROKER SRL (RO, TI-2026-036A) · AS42708 GLESYS AB (SE)
  shared carriers only: AS12302, AS174 (Cogent), AS6939 (Hurricane Electric)

Defensive action: track the operator by the maintainer ro-btel2-1-mnt and the sponsor ORG-BTS48-RIPE, which span the UK shell and the Romanian family. Treat AS62380 as ASN-DROP space. Do not blocklist AS212816/204094/205275/212221/42708 as DMZHOST — they are unrelated networks that merely share transit.

12. Sources

RIPE NCC RDAP / whois (organisation, aut-num, maintainer, and RPSL import/export objects for ORG-BTS48-RIPE, AS42397, AS62380, AS35478, AS47890, and the five debunked ASNs); Spamhaus ASN-DROP (AS62380); routing/takedown log (2026-07-03 withdrawals); UK Companies House (UNMANAGED LTD #12461131, director Bunea Petru-Octavian) as carried in TI-2026-088; LSN entity-resolution graph (relation-type audit). All claims reproducible from public RIR data. TLP:WHITE.