The Directors: Two Names on the Paperwork, One Firewall Between Them

TI-2026-088J — Bulletproof Hosting series · Addendum to TI-2026-088 "The DMZHOST Trinity"

Confidence: HIGH for the corporate-record facts (UK Companies House); the operators' true identities are held deliberately open — that openness is the finding, not a failure of it.

The finding in one paragraph

Behind the DMZHOST network stand two real, named human beings: Bunea Petru-Octavian, a Romanian national, sole director of UNMANAGED LTD (which holds AS47890); and Luca Palo, an Italian national, sole director of TECHOFF SRV LIMITED (which holds AS48090). Both are Persons with Significant Control on file at UK Companies House. And yet the human layer, examined closely, is built to be a dead end: the two companies are legally separate, with different directors of different nationalities incorporated four years apart, so that pressure on one touches the other not at all; one of the two companies is filed dormant and its director's identity was verified not in person but through a company-formation agent; and the only thread that leads anywhere real — the surname Bunea — ties UNMANAGED LTD's director to the Romanian telecom that sponsors the whole network at the registry layer. This letter documents what the filings say, states plainly what they cannot prove, and reads the structure of the corporate split as what it is: not two businesses, but one operation wearing a legal firewall.

1. The two directors, on the record

Everything in this section is public UK company record, and none of it is in dispute:

Two individuals, two nationalities, two companies, two ASNs. On the surface this reads as two unrelated small hosting businesses that happen to sit next to each other on Spamhaus ASN-DROP. The parent dossier's central finding is that this separation is the disguise, not the reality — and the human layer is where the disguise is engineered.

[DOCUMENTED] UNMANAGED LTD (dir. Bunea Petru-Octavian, RO) and TECHOFF SRV LIMITED (dir. Luca Palo, IT) are legally distinct UK companies holding AS47890 and AS48090 respectively.

2. The split is a firewall, not a coincidence

Why would one operation deliberately run under two separate companies with two different directors? Because a corporate split is a legal firewall. Consider what a single-company structure would expose: one strike-off, one director disqualification, one registrar action, and the entire network's registrant collapses at once. Split across two legally independent entities with different principals of different nationalities, the operation gains redundancy at the legal layer that exactly mirrors the redundancy it built at the routing layer:

• At the routing layer, the dual-origin prefix (088F) lets the operator fly its address space under either ASN if one gets filtered.
• At the corporate layer, the two-shell split lets the operator survive the loss of either company or either director without losing the other.

The same design philosophy — never a single point of failure — runs through both. And the corporate layer has an extra feature the routing layer does not: it can be refreshed. As 088G documents, when a company name starts appearing in threat reports the operator simply incorporates another dormant shell (PPTECHNOLOGY LIMITED → TECHOFF SRV LIMITED) at the same formation-agent address and moves the registry handle across. The directors are, in that sense, consumable. A structure that treats its named directors as replaceable parts is not a structure that expects those directors to be held accountable.

[INFERRED] The two-shell / two-director split is a deliberate legal-resilience firewall, homologous to the network's routing resilience — not two independent businesses.

3. The nominee question — named, not answered

The forensic method requires stating what the evidence does not establish, and here it does not establish that the men named on the filings are the people who operate the network. Several features of the record specifically raise the possibility of nominee directors — individuals who lend their name to a company's filings without controlling its operations:

• TECHOFF SRV LIMITED is dormant with a generic non-hosting SIC code (96090), yet it holds a routed, heavily-abused European network. A dormant company is, by its own filing, not trading — so the trading is happening somewhere the company record does not show.
• Luca Palo's identity was verified through a formation agent (Paramount Company Formations, an ACSP), not in person at Companies House. Formation agents legitimately verify identities, but the pattern — a young foreign national, verified remotely via an agent, as sole director of a dormant shell holding a bulletproof ASN — is consistent with a nominee arrangement.
• The company was incorporated six days before it assumed the DMZHOST RIPE handle, a tempo (see 088G) that fits a pre-arranged substitution rather than a founder building a business.

None of this proves Palo (or Bunea) is a nominee; it is entirely possible they are the principals. But the honest position is that the filings give us names, not operators, and the structure is built precisely so that the two need not be the same. This is why the parent dossier holds hoster identity at high confidence (the companies and their filings are documented fact) but operator identity at medium (who actually runs the campaigns is not established by a company name).

It is worth being precise about what "verified via a formation agent" does and does not mean, because the UK's identity-verification regime is easy to over- or under-read. An Authorised Corporate Service Provider (ACSP) like Paramount Company Formations is permitted to confirm that a named individual exists and matches an identity document. That is a real check against wholesale invention — it makes a pure ghost director harder. But it establishes identity, not control: it confirms that a person named Luca Palo exists and consented to be filed as director, and says nothing about whether that person directs the network, was paid a nominal fee to lend a name, or has ever touched a router. The distinction is exactly the one that matters for attribution. Wholesale fabrication is ruled out; nominee arrangement is not. So the correct reading of the record is narrow and specific: a real, identity-verified individual is the director of record of a dormant shell that holds a bulletproof ASN — which is precisely the profile a nominee arrangement produces, and also, in fairness, the profile a genuine-but-secretive founder produces. The record does not choose between them, and this dossier does not pretend it does.

[DOCUMENTED] Palo's identity was verified via a formation agent (confirming existence, not operational control); TECHOFF SRV is dormant. [INFERRED, not proven] the directors may be nominees; the filings name identity-verified individuals, not established operators.

4. The one thread that leads somewhere — the Bunea surname

If the human layer is mostly a dead end by design, it has exactly one live wire, and it runs through UNMANAGED LTD's director. The surname Bunea appears at three independent registries around this one network:

• UK Companies House: UNMANAGED LTD's sole director is Bunea Petru-Octavian.
• DNS / Spamhaus: Spamhaus attributes AS47890 to the domain bunea.eu.
• RIPE: AS47890's sponsoring organisation (088C) is Bunea TELECOM SRL, whose contacts read Petru Bunea / Bunea Petru (PB20595-RIPE, PB22555-RIPE, BP6697-RIPE).

Three registries, maintained by different authorities for different purposes, converging on one surname around one autonomous system. That convergence is a genuine attribution anchor — far stronger than the dead-end Italian director of the dormant shell — and it points the human layer of DMZHOST toward Romania, and specifically toward the Bunea network documented in 088C, not toward the British companies on the letterhead. Whether "Bunea Petru-Octavian" the UK director and "Petru Bunea" the RIPE contact are the same natural person is not provable from the records alone (the surname repeats), but the odds that three separate registries independently attach the same surname to the same ASN by coincidence are negligible.

[DOCUMENTED] the surname Bunea recurs across UK Companies House, DNS/Spamhaus (bunea.eu), and RIPE (Bunea TELECOM SRL) around AS47890. [INFERRED] the UK director and the RIPE contact are one person / one family network; the human centre of gravity is Romanian, not British.

5. Seven questions

Q1. If two real people are named as directors, isn't attribution basically done? No — a named director is a starting point, not a conclusion. UK company filings will accept a nominee, a remotely-verified foreign national, or a founder equally; the record does not distinguish them. Naming is cheap; establishing operational control is the hard part, and it is not done by a Companies House printout.

Q2. Why two different nationalities — a Romanian and an Italian? Because divergence is the point. Two directors of the same nationality invite the question "are these the same crew?" A Romanian and an Italian, on companies incorporated four years apart, read as unrelated — until the network layer (dual-origin prefix, shared maintainer, shared Gmail abuse desk) collapses them back into one operation. The corporate diversity is camouflage over network unity.

Q3. Is calling Palo a possible nominee fair to him? It is stated as a possibility, not a conclusion, and it is grounded in specific record features (dormant company, agent-verified identity, six-day substitution tempo). If Palo is the genuine principal, the evidence would show trading, staff, and operational control; the filed record shows a dormant shell. The fair — and forensic — statement is exactly the one made: the filings name him; they do not establish what he controls.

Q4. Why does the Bunea thread matter more than the actual directors? Because it is corroborated across independent registries, which a single company filing is not. One registry naming a director is one source. Three registries (Companies House, DNS, RIPE) naming the same surname around one ASN is multi-source convergence — the difference between a claim and an attribution anchor.

Q5. Could the Bunea surname be coincidence — it's a common Romanian name? Individually, on any one registry, yes. Across three registries all attached to the same autonomous system (AS47890), the coincidence explanation requires three independent flukes to align on one network. That is not how coincidence behaves; it is how a real thread looks.

Q6. What does the dormant status actually tell you? That the company is a nameplate, not the operation. A dormant company cannot lawfully be trading, yet AS48090 is unmistakably operating. So the operation exists outside the company's filed reality — which is the whole point of a shell: to hold the asset (the ASN) while disclosing nothing about the activity.

Q7. What would move this from "named" to "attributed"? Evidence tying a director to operational control — correspondence, payment flows, infrastructure access, or the same identity appearing in the operation's own tooling or the maintainer objects. For the Bunea thread, the RIPE sponsorship and the bunea.eu attribution already push it toward attribution; for the Palo thread, the record currently supports only "director of record of a dormant shell."

6. The counter-narrative, steelmanned — then defeated

Steelman: "You have two named directors on public filings. That IS the attribution — Bunea Petru-Octavian and Luca Palo run these networks. Everything else is you refusing to accept a plain answer and inventing 'nominee' doubt to sound rigorous."

Defeat: The plain answer would be correct if company filings established operational control. They do not — by design, UK incorporation records a director of record, which is exactly as reliable as the person's willingness (or payment) to be named, and no more. The record itself supplies the reasons for doubt, not this analysis: a dormant company cannot be conducting the trade its ASN is plainly conducting, and an identity verified through a formation agent is a weaker link than one established operationally. Rigour here is not manufactured doubt; it is refusing to upgrade "named on a filing" to "operates the network" without the evidence that upgrade requires. And note where the rigour does let us commit: the Bunea thread, corroborated across three registries, is stated as a genuine anchor. The method is not doubt for its own sake — it is calibrated to what each piece of evidence actually carries.

7. Read between the lines

The lesson of the human layer is that it was built to have no lesson — to be a hall of names that lead nowhere. That is itself informative. An operation that fronts its bulletproof network with a Romanian director on one shell and an Italian director on a dormant shell, refreshes the shells when the names get hot, and verifies identities through formation agents, is telling you it expects the names to be looked at and has arranged for the looking to fail. The design assumes an investigator who stops at the director field. The one place the design leaks is the place the operator could not fully sanitise: the surname on the sponsoring LIR, because that sponsorship is a real contractual relationship that had to be signed by a real accountable party, and the party's name is Bunea. The facade controls what the company registry says; it could not fully control what the number registry required. The human truth of this network is not on the UK letterhead. It is in the RIPE sponsor object, and it is Romanian.

8. What if

What if enforcement treated the two directors asymmetrically, according to what the evidence carries? The Palo/TECHOFF thread supports registrar and abuse-desk action against a dormant shell — useful for degrading the facade, but unlikely to reach an operator, because the record does not place one there. The Bunea/UNMANAGED/Bunea-TELECOM thread supports something more: a corroborated, cross-registry, Romania-centred attribution that a Romanian authority or RIPE could act on at the sponsorship level, where a real accountable party signed. Spending equal effort on both directors would waste it on the nominee-shaped dead end; weighting effort toward the corroborated Bunea thread follows the evidence to where a real person had to sign their name.

9. Documented vs inferred — the honest ledger

10. Infrastructure & IOCs

UNMANAGED LTD        UK #12461131 | inc 2020-02-13 | dir/PSC Bunea Petru-Octavian (RO, b.1988)
                     holds AS47890 | office Business First, Rushden NN10 6EN
TECHOFF SRV LIMITED  UK #16090235 | inc 2024-11-20 | DORMANT | SIC 96090
                     dir/PSC Luca Palo (IT, b.1995); id via Paramount Company Formations (ACSP)
                     holds AS48090 | office 72 Halliwick Road N10 1AB / 35 Firs Avenue N11 3NE

Live attribution thread (surname Bunea, 3 registries → AS47890):
   Companies House  Bunea Petru-Octavian (UNMANAGED LTD director)
   DNS / Spamhaus   bunea.eu (AS47890 domain attribution)
   RIPE             Bunea TELECOM SRL (ORG-BTS48-RIPE) sponsors AS47890; contacts Petru Bunea

Confidence split     hoster identity HIGH (company records) | operator identity MEDIUM (unnamed)
Human centre of gravity:  Romania (Bunea thread), NOT the UK letterhead

Defensive action: treat the named directors as directors of record, not established operators — the Palo/TECHOFF name is a dead end fronting a dormant shell, useful for registrar/abuse action but unlikely to reach an operator. Weight attribution effort toward the corroborated Bunea thread (Companies House + bunea.eu + Bunea TELECOM SRL sponsorship), which is cross-registry, Romania-centred, and rests on a real signed RIPE sponsorship relationship.

11. Sources

UK Companies House public records (UNMANAGED LTD #12461131, TECHOFF SRV LIMITED #16090235 — directors, PSC, dormant status, SIC, identity-verification method); Spamhaus ASN-DROP (AS47890 → bunea.eu); RIPE NCC RDAP/whois (AS47890 sponsoring-org Bunea TELECOM SRL / ORG-BTS48-RIPE; contacts). Cross-references: TI-2026-088C (the Bunea sponsorship), 088F (dual-origin routing resilience), 088G (shell substitution). All corporate facts reproducible from public registries. TLP:WHITE.