The Enabler: The Reseller Pool Beneath Two Investigations

TI-2026-088M — Bulletproof Hosting series · Addendum to TI-2026-088 "The DMZHOST Trinity"

Confidence: HIGH — the maintainer-handle bridge is verified by direct RIPE whois of two organisation objects; the enabler identities and the DMZHOST/TechTies independence are documented, the reseller intent inferred and marked.

The finding in one paragraph

Every letter so far has climbed up the stack — from the honeypot sessions to the prefixes, the shells, the directors, the tenant. This one climbs to the layer above the operators entirely: the reseller pool that provisions them at the registry. Following the TechTies maintainer mnt-bg-eurocrypt-1 (surfaced in 088L) leads to a result that reframes the whole map. TechTies is not a standalone bulletproof host; its RIPE organisation object is co-maintained by a cluster of Bulgarian and German reseller handles — and the exact same four of those handles co-maintain a completely different, already-documented bulletproof ASN: DEDIK SERVICES LIMITED (AS209413), a subject of the Costume Catalog series (TI-2026-082). In plain terms: the host the DMZHOST tenant rents its second floor from is a product of the same Bulgarian ASN-provisioning shop that mass-produces the EMBNEX-brokered "costumed" ASNs documented in a separate investigation. That shop has a name — Telco power Ltd (Sofia) sits behind lir-bg-telco-1-MNT; ZeXoTeK IT-Services GmbH / PIO Hosting GmbH behind MNT-ZEXOTEK. And the single most important structural fact this bridge establishes is a separation: DMZHOST's enabler chain (TECHOFF-MNT, ro-btel2-1-mnt, the Bunea RO sponsorship) and TechTies' enabler chain (mnt-bg-eurocrypt-1, Telco power, EMBNEX) have zero overlap. They are two independent bulletproof supply chains. The only thing that crosses between them is the tenant. The map is not one conspiracy — it is a market, and this letter finds the wholesalers.

1. The bridge, quoted from the registry

The claim is not inferential; it is a diff of two RIPE organisation objects, fetched live. The maintainer-reference (mnt-ref) lists — the handles a RIPE org authorises to act on its behalf — read as follows:

ORG-TI147-RIPE (TechTies Inc., AS197170, Seychelles): bg-sofcompany-1-mnt, lir-bg-telco-1-MNT, mnt-nl-skylink2-1, MNT-TRAFFIC, mnt-de-xsserver-1, MNT-ZEXOTEK, mnt-bg-eurocrypt-1, NETERRA-MNT, MNT-NETERRA, techties-mnt

ORG-DSL56-RIPE (DEDIK SERVICES LIMITED, AS209413, GB): VIA-REGISTRY-MNT, netutils-mnt, mnt-bg-eurocrypt-1, bg-sofcompany-1-mnt, lir-bg-telco-1-MNT, DEDIKIO-MNT, MNT-ZEXOTEK, mnt-bg-myacct-1, GCN-LIR-MNT, RTMNETWORKS-MNT, MLNL-MNT

The intersection is unambiguous: mnt-bg-eurocrypt-1, bg-sofcompany-1-mnt, lir-bg-telco-1-MNT, and MNT-ZEXOTEK appear on both. Four shared reseller handles across two organisations that are otherwise entirely distinct — a Seychelles shell (TechTies) and a UK shell (DEDIK), different addresses, different directors, different abuse desks (abuse@tech-ties.net vs abuse@dedik.io), different ASNs. Two bulletproof brands, one provisioning pool. And the tie runs tighter still: DEDIK's own sponsoring-org is ORG-VSS29-RIPE — VPSVAULT, the "Borrowed Vault" of the Costume Catalog — placing DEDIK, VPSVAULT, and TechTies in one reseller-and-sponsorship web.

[DOCUMENTED] The four maintainer handles mnt-bg-eurocrypt-1, bg-sofcompany-1-mnt, lir-bg-telco-1-MNT, MNT-ZEXOTEK co-maintain both TechTies (AS197170) and DEDIK (AS209413) — verified by direct RIPE whois of both org objects.

2. What the pool signs — the reverse-maintainer map

mnt-bg-eurocrypt-1 is not a passive citation on those org objects; it is the active maintainer that signs the routing. On the TechTies prefixes it is the mnt-by of the inetnums 91.92.40.0/24 and 91.92.42.0/24 and of all four route objects across them — including both the AS197170 origin and the repurposed-bank AS209630 origin that 088L documented. So the same hand that co-maintains DEDIK's organisation also builds TechTies' dual-origin failover apparatus. The pool does not merely lend its name; it operates the registry mechanics.

Tracing the shared handles outward, the pool's footprint is a spread of bulletproof and high-risk ASNs, several already dossiered in the Costume Catalog:

The picture that assembles is a supply chain with four distinct layers: an American address foundry (EMBNEX) leasing IPv6 space; a Bulgarian/German reseller pool (mnt-bg-eurocrypt-1 / Telco power / ZeXoTeK) standing up the ASNs and signing the routing; the bulletproof brands themselves (TechTies, VPSVAULT, DEDIK); and, riding on top, the tenants (The Appraiser and its peers). Each layer is a separate business, rented by the layer above. The Costume Catalog series mapped the foundry and the brands; this letter adds the reseller pool between them, at the tightest granularity yet — the maintainer handle, not the allocation block.

[DOCUMENTED] mnt-bg-eurocrypt-1 signs TechTies' inetnums and all their route objects; the shared-handle pool spans TechTies, DEDIK, VPSVAULT, and the EMBNEX/AS209630 costume cluster.

3. Who the wholesalers are

The pool is not wholly anonymous. Two of its four shared handles resolve to real companies:

• lir-bg-telco-1-MNT → Telco power Ltd, Sofia, Bulgaria (2 Peter Beron Str; phone +359887888951; maintainer created 2025-04-09). The identity link is a distinctive one — the same phone number appears on both the maintainer object and an RDAP registrant record for hosting IP space (ISP "Telco power Ltd", BG). A shared bespoke phone number across a maintainer and a registrant is a strong same-entity signal, not a common-field coincidence. Telco power reads as a Bulgarian LIR reselling number resources — a legitimate-on-paper registrar whose customers include bulletproof brands.
• MNT-ZEXOTEK → ZeXoTeK IT-Services GmbH, tied via the shared abuse address abuse@pio.hosting to PIO Hosting GmbH — a German reseller, not Bulgarian, riding in the same pool. The pool is multinational: Bulgarian and German intermediaries provisioning Seychelles and UK shells.

The remaining two shared handles are harder: bg-sofcompany-1-mnt did not resolve to a standalone identity in this pass, and mnt-bg-eurocrypt-1 itself — the most active handle, the one that signs the routing — has no recoverable standalone organisation record. "Eurocrypt" corresponds to no registered trading name found in RIPE or the entity graph; it exists, functionally, as a bare maintainer label that builds bulletproof routing and vanishes into no company. That opacity is itself a finding: the most operative handle in the pool is the least attributable, exactly as an operator would arrange it.

[DOCUMENTED] lir-bg-telco-1-MNT → Telco power Ltd (BG, shared phone); MNT-ZEXOTEK → ZeXoTeK / PIO Hosting (DE, shared abuse email). [UNCONFIRMED] mnt-bg-eurocrypt-1 has no standalone identity record — the most active handle is the least attributable.

4. The separation — two supply chains, one shared tenant

Here is the structural payload, and it corrects a natural but wrong assumption. It would be tempting, having found DMZHOST and TechTies sharing a tenant and both being bulletproof, to fold them into one mega-operator. The registry refuses that fold. A full relationship search across the DMZHOST cluster (144 entity edges, all self-clustering DMZHOST / TECHOFF-MNT / TECHOFF SRV LIMITED via the dmzhostabuse@gmail.com abuse desk) finds zero edges to mnt-bg-eurocrypt-1, lir-bg-telco-1-MNT, Telco power, or any handle in the TechTies pool. No shared maintainer, no shared organisation, no shared abuse contact, no shared phone, no shared sponsor. DMZHOST's enabler chain is GB shells + a Romanian sponsor (Bunea TELECOM) + TECHOFF-MNT/ro-btel2-1-mnt. TechTies' enabler chain is Bulgarian/German resellers + the EMBNEX foundry + mnt-bg-eurocrypt-1. Two entirely separate provisioning ecosystems.

So the two bulletproof hosts this series has documented are not the same operator and not provisioned by the same wholesaler. The only thread that crosses between them is the tenant — The Appraiser, which rents a floor from each (088L). This is the market thesis, proven at the infrastructure layer: a customer shops independent bulletproof providers, each standing on its own separate supply chain, and the appearance of a single conspiracy is an artifact of the shared customer, not of shared ownership. The honest map has two foundries, two reseller chains, two hosts — and one tenant walking between them.

[DOCUMENTED] No entity-graph or whois link connects DMZHOST's enabler chain to TechTies' — two independent supply chains; the sole crossover is the shared tenant.

5. The carrier that isn't complicit

One handle in the TechTies pool demands a fair hearing, because naming it carelessly would be its own kind of error. NETERRA-MNT / MNT-NETERRA resolve to Neterra Ltd, a large, legitimate Bulgarian transit carrier (Sofia; abuse@neterra.net; the public contact matches Neterra's real one). Neterra's handle appears as a mnt-ref on both the TechTies and VPSVAULT org objects — but for a genuine upstream transit provider, a mnt-ref citation is routine IRR/route-validation hygiene, the normal way a customer references the carrier that routes it. There is no evidence that Neterra is compromised, spoofed, or knowingly enabling the bulletproof brands beneath it; a real carrier inevitably has some bad customers, and appearing as their referenced upstream is not complicity. This is stated explicitly because the whole series depends on not over-linking: the reseller pool (mnt-bg-eurocrypt-1, Telco power, ZeXoTeK) is the enabler; a referenced legitimate carrier is not. The difference is the difference between the wardrobe and the road the van drives on.

[INFERRED, exculpatory] Neterra's mnt-ref presence is a routine upstream citation, not evidence of enabling — the carrier is distinguished from the reseller pool.

6. Seven questions

Q1. Isn't a shared maintainer just a shared hosting reseller — perfectly legal? Reselling ASN registration is legal; that is exactly what makes the pool durable. The finding is not "a crime happened at the registrar," it is "one reseller pool is the common origin of multiple bulletproof brands," which is an intelligence fact regardless of legality. You track the wholesaler because it predicts the next brand, not because the wholesaler is charged.

Q2. Why does the maintainer bridge beat the earlier ASN-level links? Because it is tighter and harder to explain away. Two ASNs in the same allocation range, or drawing IPv6 from the same broker, can be coincidence of a popular supplier. Four bespoke maintainer handles co-signing two specific org objects is a deliberate account relationship — the same reseller logins standing up both brands. It is the difference between "same neighbourhood" and "same set of keys."

Q3. If mnt-bg-eurocrypt-1 has no company behind it, how is it evidence? Its anonymity is not the evidence; its activity is. It provably signs TechTies' inetnums and routing and co-maintains DEDIK — those are documented actions. That the handle hides behind no trading name is a characterisation of the pool (operative but unattributable), not the basis of the link.

Q4. Doesn't finding two separate supply chains weaken the DMZHOST case? It strengthens it, the same way 088H did. An investigation that merged DMZHOST and TechTies on their shared tenant would be brittle and wrong. Proving they are separately provisioned — and saying so — is what makes every same-operator claim in the series (AS47890↔AS48090 via TECHOFF-MNT) credible: the method links what control-evidence links and separates what it doesn't.

Q5. Where does the tenant fit in this four-layer stack? On top, and orthogonal to it. The foundry, the reseller, and the host are a provisioning stack (who built the address space). The tenant is a usage layer (who attacks from it). The Appraiser rents from TechTies and DMZHOST without caring who provisioned either — which is precisely why tenant-tooling overlap is a bad basis for merging hosts, and why this letter keeps the two layers apart.

Q6. Is the Costume Catalog series wrong to have missed this? No — it found the foundry (EMBNEX) and the brands, using ASN-level and address-broker signals. This letter adds the reseller pool between them by pivoting on a maintainer handle that surfaced only because the DMZHOST tenant led us onto the TechTies floor. Two investigations, approached from opposite ends, meeting at mnt-bg-eurocrypt-1. That convergence is corroboration, not contradiction.

Q7. What would deepen this further? Resolving mnt-bg-eurocrypt-1 and bg-sofcompany-1-mnt to real registrants (a direct RIR query beyond this toolchain); enumerating every org the pool co-maintains to size the full brood; and establishing whether Telco power Ltd's LIR is being used with the knowledge of its principals or by a sub-reseller operating under its account. Each is a concrete next pull.

7. The counter-narrative, steelmanned — then defeated

Steelman: "Maintainer handles are shared all the time — resellers, LIRs, and registration agents legitimately co-maintain hundreds of unrelated customers. Four shared handles between two hosting companies proves they used the same registrar, nothing more. You've found a busy Bulgarian LIR and dressed it up as a criminal keystone."

Defeat: The objection would hold if the shared customers were ordinary hosting companies — but they are not. Every brand this pool co-maintains that has a threat profile is bulletproof or high-risk: TechTies (Spamhaus ASN-DROP), VPSVAULT (Spamhaus ASN-DROP), DEDIK (high-risk, flood-velocity scanner harvesting), and a repurposed bank ASN used as disposable routing. A busy legitimate LIR's customer list is a mix; this pool's threat-bearing output is uniformly bulletproof, drawing addresses from one broker (EMBNEX) that a separate investigation already characterised as a costume foundry. A registrar is known by its customers, and when the identifiable customers are all wearing the same wardrobe, "just a busy registrar" stops explaining the data. The keystone claim is not "sharing a maintainer is criminal" — it is "this maintainer pool is the common provisioning origin of a specific set of bulletproof brands," which the registry documents and which predicts the next one.

8. Read between the lines

The deepest thing this letter exposes is that the bulletproof underground is not organised by operator; it is organised by supplier. We instinctively map it as a hierarchy of criminal organisations — this gang owns these networks. The registry tells a different story: a layered service economy in which an address foundry, a reseller pool, a set of interchangeable brands, and a floating population of tenants are each a distinct business, and any participant can be swapped without disturbing the others. TechTies and DMZHOST are competitors provisioned by different wholesalers; the Appraiser is a customer of both; EMBNEX and Telco power are suppliers to whoever pays. This is why the enforcement instinct to "take down the operator" keeps failing: there is no operator to take down, only a supply chain, and every node of it is individually deniable and individually replaceable. The unit that actually persists — the one thing that predicts the next bulletproof brand before it is even named — is the reseller pool. That is the Costume Catalog's own doctrine, arrived at from the other direction: you will never keep up with the names; you only ever needed to watch where they come from. This letter names one of the yards, and shows it feeds two investigations at once.

9. What if

What if intelligence and enforcement targeted the reseller pool as the unit, the way this series targets the maintainer? A single RIR-level challenge to mnt-bg-eurocrypt-1 / Telco power Ltd's account — why does this LIR co-maintain a Seychelles bulletproof host, a UK flood-scanner ASN, a Seychelles "vault," and a repurposed Ukrainian bank ASN? — reaches every brand beneath it at once, in a way that chasing each brand serially never will. And it is a filable question: it lives at RIPE, under a named Bulgarian LIR with a real phone number, not in an offshore void. The tenant is trackable by its tool (088L); the host is challengeable at its maintainer; the reseller is answerable at its LIR; the foundry is watchable at its allocation block. Four layers, four levers — and this letter's contribution is the third one, which nobody had a handle on until the tenant walked us to it.

10. Documented vs inferred — the honest ledger

11. Infrastructure & IOCs

THE RESELLER POOL (shared across TechTies + DEDIK org objects):
   mnt-bg-eurocrypt-1   (signs TechTies inetnums + all route objects; no standalone identity)
   lir-bg-telco-1-MNT   -> Telco power Ltd, Sofia BG (+359887888951)
   bg-sofcompany-1-mnt  (unresolved)
   MNT-ZEXOTEK          -> ZeXoTeK IT-Services GmbH / PIO Hosting GmbH (DE, abuse@pio.hosting)
   (also on TechTies: mnt-nl-skylink2-1, mnt-de-xsserver-1->XSServer GmbH, NETERRA-MNT [legit carrier, not complicit])

THE FOUR-LAYER SUPPLY CHAIN (TechTies side):
   foundry   EMBNEX LLC / AS401661 (US)  -> IPv6 2604:be0::/32
   reseller  mnt-bg-eurocrypt-1 pool / Telco power Ltd (BG) + ZeXoTeK (DE)
   brands    AS197170 TechTies (SC) · AS215925 VPSVAULT (GB) · AS209413 DEDIK (GB) · AS209630 VASH KREDIT (UA, route-only)
   tenant    The Appraiser (rides TechTies AND DMZHOST — the only cross-chain thread)

SEPARATION (verified, no overlap):
   DMZHOST chain:  TECHOFF-MNT · ro-btel2-1-mnt · Bunea TELECOM SRL (RO sponsor) · GB shells
   TechTies chain: mnt-bg-eurocrypt-1 · Telco power Ltd (BG) · EMBNEX foundry · SC/GB shells
   -> two independent supply chains; ONLY the tenant crosses between them

Cross-references: Costume Catalog series TI-2026-082 (EMBNEX foundry, VPSVAULT, DEDIK, VASH KREDIT)

Defensive action: treat the reseller pool as a tracking unit in its own right — any new ASN/org co-maintained by mnt-bg-eurocrypt-1 / lir-bg-telco-1-MNT (Telco power Ltd) / MNT-ZEXOTEK is a bulletproof brand to watch before it earns its own reputation, exactly as the Costume Catalog watches the EMBNEX allocation block. Do NOT merge DMZHOST and TechTies — they are separately provisioned; track the shared tenant across both instead. Distinguish the reseller pool from the legitimate upstream carrier (Neterra).

12. Sources

RIPE NCC whois (direct queries — ORG-TI147-RIPE/AS197170 and ORG-DSL56-RIPE/AS209413 organisation objects and their mnt-ref lists; mnt-bg-eurocrypt-1 route/inetnum signing; lir-bg-telco-1-MNT, NETERRA-MNT maintainer objects); LSN entity-resolution graph (sec_intel_entity_links — Telco power Ltd shared-phone link, ZeXoTeK↔PIO shared-abuse link, the negative DMZHOST↔TechTies search across 144 edges); Spamhaus ASN-DROP (AS197170, AS215925). Cross-references: the Costume Catalog series (TI-2026-082 — "The Address Foundry" EMBNEX, "The Borrowed Vault" VPSVAULT, "The Flooder Next Door" DEDIK, "The Bank That Wasn't" VASH KREDIT); this series' 088F (dual-origin), 088H (TechTies as separate operator), 088L (the second floor). TLP:WHITE.