Jingle Shells: The Virtual-Office Facade Over a Bulletproof Network

TI-2026-088G — Bulletproof Hosting series · Addendum to TI-2026-088 "The DMZHOST Trinity"

Confidence: HIGH for the corporate-record facts (UK Companies House, RIPE) and the independent Team Cymru corroboration; the intent behind the facade is INFERRED and marked as such.

The finding in one paragraph

The DMZHOST operation does not hide behind offshore anonymity. It hides behind the opposite — the appearance of ordinary, respectable British companies. Two UK limited companies, UNMANAGED LTD and TECHOFF SRV LIMITED, hold the two autonomous systems (AS47890 and AS48090) that route the bulletproof address space. Both are real Companies House registrations with named directors. But scratch the surface and the respectability is a stage set: one of the two companies is filed as dormant, its business classification is a generic catch-all unrelated to hosting, its registered "offices" are formation-agent virtual addresses shared by dozens of unrelated shells that batch-migrate between them on the same dates, and the other company's registered address was independently found by Team Cymru to be a self-storage facility. This is not incidental sloppiness. It is the product: a facade of legitimacy, assembled from company-formation-agent parts, wrapped around a network that hosts — by Team Cymru's own finding — a Metasploit command-and-control server. The shells are the disguise, and the disguise is the point.

1. The two companies, on paper

Both ASNs trace to UK limited companies whose registration details are public record:

Two immediate tells sit in that table. TECHOFF SRV LIMITED — the company that holds the DMZHOST ASN and whose maintainer (TECHOFF-MNT) signs the network's route objects — is registered with SIC code 96090, a generic "other service activities not elsewhere classified" bucket that has nothing to do with hosting, and is filed at Companies House as a dormant company. A dormant company is, by its own filing, one not trading. Yet this dormant, non-hosting company is the registrant of a routed European network on Spamhaus ASN-DROP. And the director's identity was verified through Paramount Company Formations Limited, an Authorised Corporate Service Provider — a company-formation agent, not the director walking into Companies House himself.

[DOCUMENTED] TECHOFF SRV LIMITED is a dormant, SIC-96090 UK company holding AS48090; UNMANAGED LTD holds AS47890; both are Companies House public records with named foreign directors.

2. The addresses that aren't places of business

A registered office is supposed to be where a company can be reached. The DMZHOST shells' addresses are the opposite — they are mailboxes operated by formation agents, shared by crowds of unconnected companies.

• Rushden NN10 6EN (UNMANAGED LTD) is "Business First," whose own website advertises "fully serviced offices, hot desks, virtual offices & industrial units" with a dedicated virtual-office product page. Team Cymru went further and found the specific location "appears to correspond to a self-storage facility." A network operator's headquarters is a self-storage unit.
• 72 Halliwick Road N10 1AB and 35 Firs Avenue N11 3NE (TECHOFF SRV LIMITED, across its Companies House and RIPE records) are formation-agent registered-address products. Public records show dozens of unrelated companies at these two addresses — Recruiting Base Ltd, Delltron Ltd, Maystone Corporation, Crestcom Ltd, First Move Solutions, and more — with firms visibly migrating between the two addresses on the same dates, the identical change-of-address text repeated verbatim across otherwise-unconnected companies ("Registered office address changed from 35 Firs Avenue… to 72 Halliwick Road… on 2025-11-21"). That batch-migration pattern is the diagnostic signature of a company-formation-agent's address service, not a real premises.

The company that holds the DMZHOST ASN even lists two different addresses across its Companies House filing (72 Halliwick Road) and its RIPE org object (35 Firs Avenue) — both formation-agent mailboxes, neither a place where anyone hosts anything.

[DOCUMENTED] the addresses are serviced/virtual/formation-agent addresses shared across many unrelated companies. [INFERRED] they were chosen deliberately to manufacture the appearance of a UK business presence.

3. The independent name: Team Cymru's "Jingle Shells"

This cluster is not only visible to the LSN honeypot. In December 2024, Team Cymru's S2 Research Team (author Lewis Henderson) published "Jingle Shells: How Virtual Offices Enable a Facade of Legitimacy" — and it names this exact infrastructure, in these words:

• "IP 2.57.122.72 is identified as a Metasploit C2 server… This IP address is assigned to AS47890, operated by UNMANAGED LTD."
• "The filing for UNMANAGED LTD reveals that the company was incorporated in February 2020 and lists its business address as being in Rushden, England. Upon further investigation, this address appears to correspond to a self-storage facility operating at the location."
• "According to the RIPE database, the /24 subnet containing this IP address is associated with the domain name dmzhost[.]co."
• "Within the WHOIS records, references are also made to another UK-registered company, TECHOFF SRV LIMITED, with a registered address in London… TECHOFF SRV LIMITED was incorporated less than a month ago (at the time of writing) while the RIPE record… was created in 2019."
• "Until 04 October 2024, the subnet 2.57.122.0/24 was associated with 'pptechnology.' … a company, PPTECHNOLOGY LIMITED, registered at the same business address as TECHOFF SRV LIMITED… dormant since its registration in August 2019."

That is independent, prior (December 2024) attribution of the same UNMANAGED LTD / TECHOFF SRV LIMITED / dmzhost.co cluster this series documents — reached from public registries by a different research team, and placing offensive Metasploit C2 infrastructure squarely inside it. When two teams, working separately from the same open records, converge on the same shells, the shells are not a coincidence.

[DOCUMENTED] Team Cymru independently named UNMANAGED LTD, TECHOFF SRV LIMITED and dmzhost.co, identified a Metasploit C2 at 2.57.122.72, and characterised the Rushden address as a self-storage facility.

4. The shell-substitution chain — a network older than its owner

The most revealing detail is the lineage of the prefix 2.57.122.0/24, because it exposes the mechanic by which the facade is renewed. The address space is older than the company that now holds it, and it has been passed between dormant shells like a baton:

• The prefix's inetnum was created 2019-03-21 — five years before TECHOFF SRV LIMITED existed.
• Until 2024-10-04, the prefix was associated with PPTECHNOLOGY LIMITED, a UK company dormant since its August 2019 registration, sharing TECHOFF SRV LIMITED's registered address.
• On 2024-10-04 the org handle on the prefix changed.
• 2024-11-20: TECHOFF SRV LIMITED is incorporated.
• 2024-11-26: the RIPE org object updates to TECHOFF SRV LIMITED — six days after incorporation.

Read that as a sequence and the pattern is unmistakable: a dormant shell parks the address space, the registry handle is switched, a fresh dormant shell is incorporated at the same formation-agent address, and the RIPE record is updated to the new nameplate within days. When one company's paperwork begins to attract attention, another — same address, same dormant profile — is stood up to take its place. The network persists; only the name on the door changes. A six-day gap between a company's incorporation and its assumption of a routed European network is not the tempo of organic business formation; it is the tempo of a pre-arranged substitution.

[DOCUMENTED] the prefix predates TECHOFF SRV; PPTECHNOLOGY LIMITED (dormant, same address) held it until 2024-10-04; TECHOFF SRV was incorporated 2024-11-20 and took the RIPE handle 2024-11-26. [INFERRED] this is a deliberate shell-substitution mechanism, not administrative lag.

5. What the brand says out loud

The facade is polished for the registries; the sales pitch is blunter. dmzhost.co and its operators' forum posts advertise exactly the service a bulletproof host sells, in plain language:

• dmzhost.co markets "Offshore Dedicated Server," streaming-optimised servers, and "VPS with exceptionally generous resources," and a secondary page claims to be "the largest all-in-one IT infrastructure supplier in the Netherlands."
• Forum listings (bitcointalk, wjunction) under the DMZHOST name advertise "STREAMING — DMCA FREE | OffShore | LIR Service" and "cheap full offshore Dedicated Server… DMCA Ignored."
• Team Cymru summarised the same: the company "offers 'offshore' dedicated and virtual private servers" and "advertise their policy of ignoring DMCA… requests," which it flagged as "at least an amber flag."

"DMCA Ignore" is the tell that ties the respectable-shell front to the bulletproof back. A genuinely legitimate UK IT-consultancy does not build its marketing around ignoring lawful takedown requests. The corporate registrations exist to look accountable; the marketing exists to promise the customer they will not be accountable. Both are true at once, and the contradiction is the business.

6. Seven questions

Q1. If they wanted to hide, why register real UK companies at all? Because visibility is the disguise. An offshore Seychelles shell screams "bulletproof." A UK Ltd with a London address and a Companies House number reads, at a glance, as a normal European hosting business — until you check whether the company trades (it is dormant), what it does (SIC 96090, nothing), and where it lives (a mailbox). The respectability is a decoy that costs £12 to file.

Q2. Does a dormant company holding a routed network prove wrongdoing? Not by itself — but it proves the company is not the operation. A dormant, non-trading, non-hosting SIC-96090 entity cannot be running a European ISP. So the entity is a nameplate, and the real operation sits behind it. That is precisely the host/operator separation the parent series draws.

Q3. Two directors, two nationalities — are Bunea and Palo the real principals? They are the named principals of record, and Palo's identity was verified through a formation agent, not in person. Whether they are the operators or paid nominees is not established here; what is established is that the companies are formation-agent constructs, whichever human signed them.

Q4. Why does Team Cymru's finding matter if you already had honeypot data? Because it is out-of-network corroboration from December 2024 — earlier than, and independent of, the LSN telemetry. Two teams reaching the same shells from the same public registries is the difference between a hypothesis and a documented cluster.

Q5. A self-storage unit as a company HQ — really? Really, per Team Cymru's investigation of the Rushden address, and consistent with "Business First" being a serviced/virtual-office provider. The registered office is a place to receive mail, not to run a network. The network runs in Romania and the Netherlands; the address runs in a filing cabinet.

Q6. Isn't "DMCA ignore" marketing just edgy advertising, not evidence? On its own it is a marketing claim. Combined with a dormant shell, a formation-agent address, a self-storage HQ, a shell-substitution lineage, and a Metasploit C2 on the prefix, it stops being edgy advertising and becomes a coherent statement of the actual product: unaccountable hosting sold to people who need it.

Q7. What would collapse this finding? Evidence that the companies genuinely trade — real offices, real staff, real hosting operations, an active (not dormant) filing. The public record shows the opposite: dormant status, generic SIC, shared formation-agent addresses, and a self-storage "headquarters." Until the filings change, the facade reading is the documented one.

7. The counter-narrative, steelmanned — then defeated

Steelman: "Thousands of legitimate small businesses use virtual offices and formation agents — it is cheap, normal, and legal. Plenty of real hosting companies file minimal SIC codes and use registered-address services. You are criminalising ordinary UK company administration and dressing it up as a conspiracy."

Defeat: Each individual fact is indeed ordinary; the conjunction is not, and the conjunction is the finding. Ordinary businesses use virtual offices — but ordinary businesses are not simultaneously dormant, filed under a non-hosting catch-all SIC, holding a Spamhaus-ASN-DROP network, hosting a Metasploit C2 (per Team Cymru), advertising "DMCA ignore," and standing in a substitution chain behind a prior dormant shell that held the same prefix. Any one of these is legal noise; all of them, stacked on the same two companies and the same address family, describe a deliberately-constructed facade. The steelman requires reading each fact in isolation; the evidence only makes sense read together.

8. Read between the lines

The offshore-anonymity model of bulletproof hosting is loud and legible — a Seychelles shell tells you exactly what it is. The DMZHOST model is quieter and, for that reason, more durable: it borrows the credibility of a real jurisdiction without accepting any of its accountability. A UK company number is a trust signal; the operators bought the signal wholesale from a formation agent and spent none of the substance behind it. And when the signal degrades — when a company name starts appearing in threat reports — the model has a built-in refresh: incorporate another dormant shell at the same mailbox, switch the registry handle, carry on. The genius, and the vulnerability, is the same: the operation is anchored not to a place or a company but to the maintainer and the address family, which persist across every nameplate. Chase the company names and you will always be one substitution behind. Chase the address and the maintainer, and the shell game runs out of shells.

9. What if

What if the unit of tracking were the registered-address + maintainer pair, not the company? PPTECHNOLOGY LIMITED and TECHOFF SRV LIMITED are different companies with different directors and different incorporation dates — a name-based watch treats them as unrelated. But they share an address family and sit in one prefix's lineage, and TECHOFF-MNT signs the routing. A defender who keyed on the address and the maintainer would have seen the substitution as it happened in November 2024, rather than discovering each new shell only after it starts showing up in abuse feeds. The facade is renewable; the anchors it hangs from are not.

10. Documented vs inferred — the honest ledger

11. Infrastructure & IOCs

UNMANAGED LTD        UK #12461131 | inc 2020-02-13 | dir Bunea Petru-Octavian (RO)
                     office Business First, Rushden NN10 6EN (serviced/virtual; "self-storage" per Team Cymru)
                     holds AS47890 (UNMANAGED-DEDICATED-SERVERS) | ORG-UMNG1-RIPE

TECHOFF SRV LIMITED  UK #16090235 | inc 2024-11-20 | DORMANT | SIC 96090 (non-hosting)
                     dir Luca Palo (IT); id verified via Paramount Company Formations (ACSP)
                     office 72 Halliwick Road N10 1AB (CH) / 35 Firs Avenue N11 3NE (RIPE) — formation-agent addresses
                     holds AS48090 (DMZHOST) | ORG-TSL73-RIPE | mnt-by TECHOFF-MNT

Prior shell          PPTECHNOLOGY LIMITED — dormant since Aug 2019, same address; held 2.57.122.0/24 until 2024-10-04
External C2 (Cymru)  2.57.122.72 — Metasploit C2 on AS47890/UNMANAGED LTD
Brand                dmzhost.co — "Offshore / DMCA Ignore / LIR Service"; "largest IT infra supplier in the Netherlands"
Durable anchors      registered-address family (Halliwick/Firs Avenue) + maintainer TECHOFF-MNT

Defensive action: treat UNMANAGED LTD and TECHOFF SRV LIMITED as one operator's disposable nameplates, not two vendors. Track the operator by the registered-address family and the TECHOFF-MNT maintainer, which survive every shell substitution, rather than by company name (which is refreshed on demand). Read "UK-registered" here as a purchased trust signal, not evidence of a real, accountable business.

12. Sources

UK Companies House (public officer/company/filing records for UNMANAGED LTD #12461131, TECHOFF SRV LIMITED #16090235, PPTECHNOLOGY LIMITED); RIPE NCC RDAP/whois (ORG-UMNG1-RIPE, ORG-TSL73-RIPE, TECHOFF-MNT, 2.57.122.0/24 lineage); Team Cymru S2 Research, "Jingle Shells: How Virtual Offices Enable a Facade of Legitimacy" (2024-12-20); Business First (businessfirst.com) virtual-office listing; dmzhost.co and operator forum posts (bitcointalk, wjunction). All corporate facts reproducible from public registries. TLP:WHITE.