The Full Brood: One Reseller Substrate Beneath Three Investigations

TI-2026-088N — Bulletproof Hosting series · Addendum to TI-2026-088 "The DMZHOST Trinity"

Confidence: HIGH on the maintainer bridges verified by live RIPE inverse-whois; explicitly calibrated on the rest — confirmed bulletproof members are separated from a maintainer-association watchlist, and the census is stated as a floor, not a ceiling, because RIPE rate-limited the enumeration mid-sweep.

The finding in one paragraph

088M found that one Bulgarian/German reseller pool provisions TechTies and DEDIK. This letter set out to enumerate the pool's entire brood — every ASN it co-maintains — and the census returned something larger than a customer list. The shared maintainer handles do not just connect two hosts in one series; they connect three previously-separate published investigations. MNT-ZEXOTEK — the maintainer of ZeXoTeK IT-Services GmbH and its bulletproof ASN AS8649 — and mnt-de-xsserver-1 — the maintainer of XSServer GmbH and AS198584 (PIO-Hosting) — are both central members of the Phantom ASN cluster (the German-Dutch "German Gateway," TI-2026-026). And both of those handles also co-maintain the TechTies and DEDIK organisation objects of the Costume Catalog (TI-2026-082) and this DMZHOST series (TI-2026-088). In other words: the German-Dutch phantom-hosting cluster and the Bulgarian costume-foundry pool are not two separate rackets — they share provisioning handles on the same customer accounts. The roster that follows lists what the census confirmed (a core of documented bulletproof brands, plus legacy autonomous systems repurposed into new roles, plus a maintainer-association watchlist that is not accused), and it is honestly incomplete: RIPE hard-blocked the reverse queries partway through. The true brood is larger than what is shown. The extraordinary finding is not the count — it is that the enabler layer is the connective tissue the individual investigations could not see from inside themselves.

1. The method, and the wall it hit

Enumerating a reseller pool means running the registry backwards: for each maintainer handle, ask RIPE -i mnt-by <handle> and -i mnt-ref <handle> to list every object that names it. This works — until RIPE stops you. After five successful inverse queries the source IP was hard-blocked (ERROR:201 — daily limit of controlled objects exceeded), killing all further live RIPE lookups for the day. That limit is itself worth noting: the registry deliberately throttles reverse enumeration, which means a wholesaler's full footprint is structurally hard to map in one pass — an opacity the reseller benefits from and did not have to build.

So this census is explicitly a floor: five handles resolved live against RIPE (mnt-bg-eurocrypt-1, bg-sofcompany-1-mnt, MNT-ZEXOTEK, mnt-bg-myacct-1, mnt-de-xsserver-1); the rest were reconstructed from the LSN entity-resolution graph (RDAP data already ingested from prior investigations). Three handles (GCN-LIR-MNT, MLNL-MNT, RTMNETWORKS-MNT) remain unenumerated. One handle, mnt-nl-skylink2-1, returned an enormous truncated dump that looked like a legitimate large ISP's customer block — it is deliberately excluded from the roster rather than counted, because over-including it would inflate the brood with innocents. That exclusion is the discipline the Costume Catalog itself teaches: write down the yard, but do not clamp every van that ever parked there.

[DOCUMENTED] Five handles resolved via live RIPE inverse-whois before a hard rate-block; the census is partial by external constraint.

2. The bridge — three ecosystems, one substrate

This is the extraordinary result, and it is grounded in the live queries, not inference. Two of the pool's maintainer handles are themselves members of the Phantom ASN cluster, and they reach across into the Costume/DMZHOST accounts:

• MNT-ZEXOTEK maintains AS8649 (Webtraffic ZeXoTeK IT-Services GmbH — Spamhaus ASN-DROP, bulletproof, re_verdict: rebrand) and address ranges under ORG-TI147-RIPE (TechTies) and ORG-DSL56-RIPE (DEDIK). ZeXoTeK is a named actor in the Phantom ASN series (TI-2026-026).
• mnt-de-xsserver-1 maintains XSServer GmbH space and touches AS198584 — PIO-Hosting GmbH — the very ASN at the centre of "The Phantom ASN: PIO-Hosting's Shell Game," alongside TechTies' allocation.

The Phantom ASN investigation documented a German-Dutch border cluster — SkyLink Data Center BV (AS44592), PIO-Hosting GmbH (AS198584), XSServer GmbH, ZeXoTeK, HBING — sharing one phone number and routing space from five RIRs, run by a named team (Edler, Spellerberg, Bellgart) near Aachen. The Costume Catalog investigation documented a different ecosystem — the EMBNEX (AS401661) IPv6 foundry feeding VPSVAULT, DEDIK, and the VASH KREDIT bank ASN. This census shows the two ecosystems are not siloed: the German cluster's own maintainers (ZeXoTeK, XSServer) are co-signatories on the Bulgarian pool's customer org objects. The "German Gateway" and the "Address Foundry" are two intake ramps onto one shared reseller substrate, and TechTies — the floor the DMZHOST tenant rents — sits at their intersection.

[DOCUMENTED] MNT-ZEXOTEK (→ AS8649 ZeXoTeK) and mnt-de-xsserver-1 (→ AS198584 PIO-Hosting), both Phantom-ASN (TI-2026-026) members, co-maintain the TechTies/DEDIK (TI-2026-082/088) org objects — the first evidence these investigations share provisioning infrastructure.

3. The roster — the brood as the census confirmed it

Presented with strict calibration: CONFIRMED members have their own threat telemetry or a prior dossier; WATCHLIST members are maintainer-associated only, with zero observed activity, and are named but not accused; BRIDGE members connect the ecosystems.

Confirmed distinct ASNs touched this session: ~14. New relative to the prior series: AS48452 (a genuinely undossiered pool member) plus four watchlist ASNs (holder identity lost to the RIPE block) and two structural bridges into the Phantom ecosystem. Three pool handles remain unenumerated; mnt-nl-skylink2-1's suggestively enormous result was excluded. Honest estimate of the true brood: 15–20 ASNs — the confirmed 14 is a floor.

[CALIBRATED] 14 confirmed pool-touched ASNs; 4 watchlist (associated, not accused); estimate 15–20 total; enumeration incomplete by RIPE rate-limit.

4. Old iron, new costumes — the legacy-ASN pattern

088L found a repurposed bank ASN (AS209630). The census shows repurposing is a broader habit of this substrate, in a softer form: legacy autonomous systems folded into modern bulletproof roles.

• AS8649 (ZeXoTeK) is a 16-bit legacy ASN — from the 8192–9215 block allocated long before the 32-bit ASN wave the rest of the brood rides. Old, established number resources carry reputation that fresh 21xxxx ASNs do not; a 16-bit ASN reads, to a naive filter, as an incumbent. It is now Spamhaus ASN-DROP and flagged rebrand — established iron re-skinned for a new purpose.
• AS48452 (Telco power Ltd) carries an internal registration stamp BG-TELCO-20080611 — an 18-year-old Bulgarian block anchoring a modern reseller operation. Not a defunct institution like the bank, but the same instinct: build the new operation on aged, credible-looking resources rather than obviously-fresh ones.

The pattern across L and N is consistent: this ecosystem prefers borrowed legitimacy in its number resources — a dormant bank's ASN, a legacy 16-bit ASN, an 18-year-old block — for the same reason it prefers UK company numbers and virtual offices (088G). Age and institutional provenance are trust signals, and the whole operation is an exercise in renting trust signals it did not earn.

[DOCUMENTED] AS8649 (legacy 16-bit, ASN-DROP, rebrand) and AS48452 (2008-vintage block) are aged resources repurposed into the pool. [INFERRED] the preference for legacy/institutional resources is deliberate trust-borrowing.

5. The tentacles — where the substrate touches other documented rackets

Two of the pool's non-Bulgarian handles reach into ecosystems the corpus has already documented separately, widening the substrate further:

• VIA-REGISTRY-MNT (a DEDIK co-maintainer) is the same handle tied in prior investigations (TI-2026-019M / 054A) to the sponsor of ISAEV / AS200730 — the 87.251.64.0/24 "ISAEV" prefix that 088K flagged as touching the tenant's tooling but could not then tie to the operators. It now has a registry-level connection point: VIA-REGISTRY-MNT co-maintains DEDIK and sponsors ISAEV. (Stated carefully — this is a shared provisioning handle, the same class of link as the rest of this letter, not a same-operator claim.)
• netutils-mnt (a second DEDIK co-maintainer) resolves in the corpus to IPXO / Internet Utilities (Belize) — a large, separately-documented IP-leasing racket (TI-2026-019M / 021 / 026D / 043). Its presence means the pool's customers also draw leased space through the IPXO marketplace — another commodity supplier feeding the same brands.

Each tentacle is the same phenomenon: the bulletproof economy is not a set of walled gardens but a densely cross-connected supply market, and the maintainer handle is the thread that reveals the connections the per-ASN view hides. The pool touches the German phantom cluster, the EMBNEX foundry, the ISAEV sponsor, and the IPXO leasing racket — four documented ecosystems, one set of overlapping keys.

6. Telco power Ltd — tenant and provisioner at once

The census resolved the pool's most concrete identity further. lir-bg-telco-1-MNT → Telco power Ltd (ORG-TPL24-RIPE), GB-registered with a Bulgarian phone, abuse routed through abuse@razinetwork.com, and confirmed in the entity graph as a same_entity_org alias of "RAZI Network." It is an operating LIR — it sponsors AS201814 and holds its own netblocks (94.26.32–92, IPv6 2a00:6f40::/32, AS48452). But those very netblocks are mnt-by the shared pool handle mnt-bg-eurocrypt-1 — meaning Telco power is simultaneously an independent LIR and a tenant of the eurocrypt pool it participates in. That duality is the reseller economy in one entity: a real-enough Bulgarian LIR that both sells provisioning to others and buys it from the shared pool, blurring the line between wholesaler and customer until "who provisions whom" has no single answer. It is turtles — resellers reselling resellers — and Telco power / RAZI Network is one turtle we can at least name.

[DOCUMENTED] lir-bg-telco-1-MNT → Telco power Ltd / RAZI Network (ORG-TPL24-RIPE); it sponsors resources and has its own space maintained by the shared pool handle — both provisioner and tenant.

7. Seven questions

Q1. Isn't naming four "watchlist" ASNs with no observed activity exactly the over-accusation you warn against? It would be if they were accused. They are listed, with the status label WATCHLIST and the explicit note "not accused, no observed activity." The Costume Catalog doctrine is precise about this: you write down every van from the yard so you recognise it next time, without clamping the ones you have never seen do wrong. Naming with a correct confidence label is the opposite of over-accusation — it is honest inventory.

Q2. Does the RIPE block undermine the census? It caps it; it does not undermine what resolved. Five handles returned live, verified results before the wall; the bridges to the Phantom cluster are from those live results and corroborated by the existing 026 corpus. The block means the count is a floor, which the letter states plainly. An honestly-incomplete map beats a fabricated-complete one.

Q3. Three investigations sharing maintainers — could that just be a popular registrar everyone uses? The 026, 082, and 088 clusters were each independently assessed as bulletproof/high-risk in separate investigations. A popular legitimate registrar serves a mix; a handle whose resolvable customers are uniformly the subjects of bulletproof dossiers is not a neutral registrar — it is the provisioning layer those dossiers were each describing from the outside. Convergence of three separate threat investigations on shared handles is signal, not a registrar's ordinary customer overlap.

Q4. Why does the ZeXoTeK/XSServer bridge matter more than the Bulgarian handles? Because it collapses a wall. The Phantom ASN series (German-Dutch border) and the Costume Catalog series (Bulgarian/EMBNEX) were investigated as unrelated ecosystems. The bridge shows they share provisioning — which means intelligence about one is now intelligence about the other, and a takedown lever against the shared handle reaches both. Collapsing a false wall between two investigations is a structural upgrade to the whole map.

Q5. Is ZeXoTeK the operator, the reseller, or a customer? All three, at different moments — which is the point of Section 6. MNT-ZEXOTEK maintains ZeXoTeK's own ASN (AS8649), co-maintains others' org objects (TechTies/DEDIK), and ZeXoTeK is itself a tenant-tier member of the German cluster. The roles are not fixed; the same entity wholesales and retails. That role-fluidity is why "operator" is the wrong unit and "handle" is the right one.

Q6. What's the single most exposed, nameable node in the whole brood? Telco power Ltd / RAZI Network — a registered LIR with a real phone number, an abuse domain, and a documented dual role. Unlike mnt-bg-eurocrypt-1 (no standalone identity) or the offshore shells, it is answerable at RIPE under a name. It is the handle to pull first.

Q7. What closes the gap the RIPE block left? Re-running the inverse queries for the unenumerated handles (VIA-REGISTRY-MNT, MLNL-MNT, GCN-LIR-MNT, RTMNETWORKS-MNT) and re-verifying mnt-nl-skylink2-1 after the daily quota resets — plus resolving the four watchlist holders' identities. Each is a concrete next pull that would move members from WATCHLIST toward CONFIRMED or clear them entirely.

8. The counter-narrative, steelmanned — then defeated

Steelman: "You ran five reverse queries, got rate-limited, reconstructed the rest from your own database, and are now declaring that three major investigations are secretly one thing. That is a sweeping claim built on a truncated sweep and a handful of shared registrar handles — thin ground for 'one substrate beneath three investigations.'"

Defeat: The sweeping claim is deliberately narrow: the letter does not say the three ecosystems are one operator — it says they share provisioning handles, which is exactly what the live queries showed and the 026 corpus corroborates (ZeXoTeK and XSServer/PIO are named Phantom members and resolved as TechTies/DEDIK co-maintainers). "Share a reseller substrate" is a far weaker, far better-supported claim than "one operator," and it is the correct one. The truncated sweep is disclosed, the count is called a floor, the watchlist is quarantined from the confirmed, and the excluded skylink dump is named as excluded. Every place the evidence thins, the confidence label thins with it. The claim is not built on thin ground; it is built on the thick part (the verified bridges) and explicitly refuses to build on the thin part (the blocked handles, the watchlist). That is what calibrated looks like.

9. Read between the lines

The deepest thing the census exposes is that the SOC's own investigation boundaries were an artifact. The Phantom ASN series, the Costume Catalog, and the DMZHOST series were written as three separate stories because they were discovered separately — a honeypot cluster here, a border-transit anomaly there, an address broker somewhere else. But the bulletproof economy is not organised the way investigations are filed. Underneath, it is a single supply market with a small number of overlapping provisioning handles — MNT-ZEXOTEK, mnt-de-xsserver-1, mnt-bg-eurocrypt-1, VIA-REGISTRY-MNT, netutils-mnt — that recur across "different" cases because the same wholesalers serve them. The operators change names, the brands rotate, the tenants float between floors, but the reseller handles persist and connect. Which means the unit of the whole map is not the operator, the host, or even the series — it is the handle, and a handful of handles stitch the entire documented bulletproof corpus into one fabric. The individual investigations could never see this from inside; it is only visible by running the registry backwards, across all of them at once. The wall the RIPE block put up is the final irony: the one query that reveals the fabric is the one the registry rations hardest.

10. What if

What if the SOC treated the maintainer handle as a first-class investigative entity — a tracked node with its own dossier — rather than a field noticed in passing inside per-ASN work? A standing map of "which handles co-maintain which bulletproof orgs," refreshed against the RIPE quota daily, would have surfaced this fabric long before a tenant walked us onto the TechTies floor. It converts the bulletproof problem from an endless game of naming vans into a short list of yards to watch — and this letter's contribution is that the list is shorter than three investigations implied, because several of the yards turn out to be the same yard. Pull the handle, and you do not degrade one host; you illuminate every brand it ever provisioned across every series it touches.

11. Documented vs inferred — the honest ledger

12. Infrastructure & IOCs

THE SHARED RESELLER SUBSTRATE (handles that recur across investigations):
   mnt-bg-eurocrypt-1   (no standalone identity; signs TechTies routing + Telco power blocks)
   lir-bg-telco-1-MNT   -> Telco power Ltd / RAZI Network (ORG-TPL24-RIPE, BG; abuse@razinetwork.com)
   MNT-ZEXOTEK          -> ZeXoTeK IT-Services GmbH / AS8649 (DE; also PIO-Hosting orbit)  [Phantom 026]
   mnt-de-xsserver-1    -> XSServer GmbH / AS198584 PIO-Hosting (DE)                        [Phantom 026]
   bg-sofcompany-1-mnt, mnt-bg-myacct-1  (BG; unresolved standalone identity)
   VIA-REGISTRY-MNT     -> co-maintains DEDIK; sponsor of ISAEV/AS200730                    [019M/054A]
   netutils-mnt         -> IPXO / Internet Utilities (Belize) leasing racket               [019M/021/026D/043]
   (excluded: mnt-nl-skylink2-1 = likely legitimate ISP block; unenumerated: MLNL-MNT, GCN-LIR-MNT, RTMNETWORKS-MNT)

CONFIRMED BULLETPROOF BROOD:  AS197170 TechTies · AS209413 DEDIK · AS215925 VPSVAULT · AS8649 ZeXoTeK
REPURPOSED/LEGACY:            AS209630 VASH KREDIT (bank) · AS8649 (16-bit) · AS48452 (2008 BG block)
FOUNDRY:                      AS401661 EMBNEX (IPv6 2604:be0::/32)
WATCHLIST (associated, NOT accused): AS47878, AS197160 (DE) · AS207144, AS24750 (BG)
THREE INVESTIGATIONS BRIDGED: TI-2026-026 (Phantom ASN) · TI-2026-082 (Costume Catalog) · TI-2026-088 (DMZHOST)

Defensive action: promote the maintainer handle to a tracked entity. Watch mnt-bg-eurocrypt-1, lir-bg-telco-1-MNT (Telco power / RAZI Network), MNT-ZEXOTEK, and mnt-de-xsserver-1 as provisioning nodes; any org they co-maintain is a bulletproof candidate before it earns a reputation. Treat the WATCHLIST ASNs as recognition targets, not blocklist entries, until their own activity is observed. Re-run the RIPE inverse queries after the daily quota resets to close the census. Distinguish provisioning-handle links (this letter) from same-operator claims (which require control evidence).

13. Sources

Live RIPE NCC inverse-whois (-i mnt-by for mnt-bg-eurocrypt-1, bg-sofcompany-1-mnt, MNT-ZEXOTEK, mnt-bg-myacct-1, mnt-de-xsserver-1; halted by ERROR:201 rate-limit); LSN entity-resolution graph (sec_intel_org_dossier, dossier_entity, uses_maintainer edges) for the reconstructed handles and Telco power / RAZI identity; Spamhaus ASN-DROP (AS197170, AS215925, AS8649). Cross-references: the Phantom ASN series (TI-2026-026A/C/G/K — SkyLink, PIO-Hosting, XSServer, ZeXoTeK), the Costume Catalog series (TI-2026-082 — EMBNEX, VPSVAULT, DEDIK, VASH KREDIT), IPXO/Internet Utilities (TI-2026-019M/021/026D/043), and this series' 088L/088M. TLP:WHITE. Census is a documented floor, not a ceiling.