TI-2026-096A — The Dark Census: 197 Autonomous Systems That Route Nothing

Classification: HIGH · Forensic threat intelligence · Entity-graph / lifecycle vector · Series: The Unannounced

Every dossier this program has published looks at what is announcing now: the IP that hit the honeypot last night, the ASN routing the prefix that scanned us this morning. This one turns the telescope around. It reads the registry's change-log — the ledger of what changed, not what is live — and asks a different question: what is allocated but dark? What autonomous systems exist on paper, hold a globally-routable number, and announce nothing at all? The answer is a population of 197 of them, and the interesting thing is not that they are dark. It is who they are.

1. A New Instrument, Pointed at the Void

The golden entity-resolution graph is large: 984,451 entities, 1.71 million edges, twenty-one ingestion sources. Most of it is the ordinary furniture of the internet — subnets, ASNs, domains, the organisations that hold them. For most of this program's life we have queried it the way you query a map: where is this IP, who announces this prefix, what is this operator's neighbourhood. A map answers "where is X now."

Recently the graph grew a second faculty: a change-log. It does not just record the current state of an entity; it records the transitions — a dated feed of three event types. owner_changed (9,239 events), renamed (187), and the one this dossier reads, taken_down (197). A change-log is a fundamentally different instrument from a map. A map shows the terrain; a change-log shows the terrain moving. And when you filter the change-log to taken_down, you are no longer looking at what routes. You are looking at what has gone dark.

This is the first dossier in a new series, The Unannounced, that treats the change-log as its primary instrument. The premise is simple and, as far as this program's 750-plus published dossiers go, unworked: lifecycle is a vector. Not the packet, not the prefix, not the port — the ledger. What the ledger records when infrastructure dies, changes hands, or puts on a new name is its own kind of intelligence, invisible to any point-in-time query. This letter maps the dark. The letters that follow it take the reserve apart operator by operator.

2. What "Taken Down" Actually Means — The Honest Version

Before a single conclusion, the caveat, because it governs everything after it.

The taken_down feed contains 197 autonomous systems, each with an announced attribute that reads false. It is tempting — and it would be wrong — to read that as "197 ASNs were withdrawn." Here is what the raw records actually say. Every one of the 197 carries old_value: null and new_value: "false". The changed_at timestamps do not spread across weeks or months; they cluster inside a single thirty-minute window on 2026-07-03, between 10:29:23 and 10:59 UTC, arriving in descending sub-batches at 10:29, 10:36, 10:41, 10:44, 10:47, 10:49, 10:50, 10:52, 10:54, 10:55, and 10:56 (with a small tail on 07-05 and 07-19).

A null old value is the tell. It means the resolver never observed these ASNs in an announced: true state and then watched them fall to false. It observed them already dark, on its first full pass over the announced attribute, and dutifully logged the first thing it saw as a "change" from nothing to not-announced. This is a first census of the dark, taken in one sweep — not the recording of 197 withdrawals that happened at 10:50 in the morning on a Thursday.

So the honest framing is not "a mass-takedown event." Anyone who tells you 197 networks were killed on 2026-07-03 is reading a measurement artifact as a news story. What we actually have is more modest and, in truth, more useful: an inventory snapshot of the RIPE-region autonomous systems that the graph knows about and that announce no routes. The date is the instrument's birthday, not the cohort's date of death.

That distinction is the spine of this series. We are not counting corpses. We are taking stock of a warehouse.

3. Dark Is Not Guilty

The second load-bearing caveat. It would be equally cheap, and equally wrong, to wave at 197 un-announced ASNs and call them a criminal cohort. So the first thing to do with any suspicious population is to check it against ground truth — our own honeypot.

The result is clarifying. Take the two most prominent members by sub-cluster size and by name recognition: AS209982 (Contrust Solutions S.R.L., Moldova) and AS211762 (Region40 LLC, Russia). Pull each one's full honeypot dossier and the activity fields are empty across the board:

These ASNs did not attack us. They are not in our attacker set at all. The graph flags them observed: true, but that flag only means the ASN entity was ingested from a naming/registry feed — it is a statement about our data pipeline, not about our victimhood. Reading observed: true as "observed attacking" would be a category error, and this dossier does not make it.

That matters because it sets the correct register for the whole finding. The dark census is not an incident report. It is inventory intelligence — a picture of held, dormant capacity. The value is not "these are hitting you"; it is "this is the stock behind the flow." Which brings us to the only question worth asking of a warehouse: what is on the shelves?

4. The Four Strata

Sort the 197 by holder name and the population does not blur into an undifferentiated mass. It separates cleanly into four strata, and the separation is the finding.

Stratum I — The Bulletproof Reserve

The smallest stratum and the whole reason this dossier exists. Inside the dark census sit operators this program has already documented from entirely independent evidence — honeypot hits, prefix history, court-anchored shell structures. They are not new names. They are known names, seen here in a new state: dormant.

The AS62380 row is the anchor. Bunea TELECOM is the root operator of the DMZHOST/Bunea bulletproof structure dissected in TI-2026-088 (The DMZHOST Trinity) and the Bunea Sponsor dossier — the latter of which independently noted that AS62380 and its sibling were withdrawn minutes apart on 2026-07-03. Our census records AS62380 as dark at exactly 10:49:03 on that date. Two instruments, two vectors, one operator, the same day. That corroboration is what turns "the census contains a Romanian ASN" into "the census contains a known bulletproof root, and the lifecycle vector confirms what the prefix-history vector already found."

The others read like a greatest-hits of the offshore-incorporation playbook. Chang Way Technologies — a Hong Kong corporate coat over Russian operations, three separate ASNs sitting dark. 1337TEAM LIMITED — the name is leet for "elite," the network handle is ELITETEAM-ANTIDDOS, the registration is Seychelles; the entire identity is bulletproof-retail marketing wearing an offshore IBC. Atis Omran Sevin PSJ — an Iranian "DDoS-protection" and CDN brand, two ASNs. LLC BIGNET UKRAINE holding three differently-named ASNs. This stratum is small in count and heavy in meaning: it is the reserve of the abuse economy, allocated and held, announcing nothing, waiting.

Stratum II — The Named Individuals

Below the corporate shells sits the retail floor: autonomous systems whose holder is not a company at all but a single natural person. The census is full of them — Berdiev Ruslan Mukhabatovich (AS214576, RU, allocated 2024-07-05), Dmytro Nebaba (NET67X), Abdolmajid Mashayekhi (First-Host), Sabire Irmak Mala (ipv4-net), Manilich Alla Valerievna, Fazel Rezaei Kalantari (Tajook), Hossein Zangooei, Daniel Thomas Atkinson, Thomas Dubois, Simon Mariacher, Zhaikov Aitolkyn Bekbolatkyzy.

A globally-routable autonomous system is, in principle, a piece of critical internet infrastructure — the kind of thing telecoms and universities and clouds hold. Here it is held in one person's name, allocated (in Berdiev's case) barely two years before going dark. That is not, by itself, a crime; RIPE policy permits natural-person LIRs. But it is a signature — the retail tier of a market where an AS number is a cheap, personal, disposable commodity rather than an institutional asset. This stratum gets its own letter, TI-2026-096C.

Stratum III — The Never-Routed Bulk

The largest stratum, and the honest control group. A great many of the 197 are small businesses — heavily India-weighted — that were granted an ASN and simply never announced a route with it: HEEBS HEALTHCARE PRIVATE LIMITED, SRJN HOSPITALITY, VEDIMANTRA LIFECARE, HERBZOOT HEALTHCARE, RM HOSPITALITY, ALGOZINI SERVICES, Datawings Teleinfra, dozens of Pvt Ltd firms whose core business is manifestly not networking. A healthcare company does not run a bulletproof host. These are allocations of administrative inertia — an AS number acquired for a project that never shipped, or by a reseller who over-provisioned, sitting dark because no one ever turned it on.

This stratum is why the "dark is not guilty" caveat is not throat-clearing but method. If you skip the sorting step and treat all 197 as sinister, you have just accused a pile of Indian small businesses of bulletproof hosting. The forensic skill this dossier is really demonstrating is stratification: the ability to look at one undifferentiated "un-announced" flag and separate the reserve from the residue.

Stratum IV — The Legacy Graveyard

The archaeological layer. A handful of the dark ASNs belong to companies that have been out of business for two decades: Pilot Network Services, Inc, CAI Wireless Systems, Inc., Empire Communications, StormNet Communications, Novx Systems, Networldtron Corp, Management Alliance Group Inc.. These are dot-com-era and pre-dot-com US ISPs whose ASNs were allocated in the 1990s, never reclaimed, and have simply outlived their holders. They route nothing because there is no one left to route. They are the fossil record of the number system, and they are the cleanest possible proof that "un-announced" spans everything from active reserve to genuine antiquity.

5. Why the Reserve Matters — The Stock Behind the Flow

Strip away strata III and IV and the residue — the reserve — is the payload. Here is why it is worth a dossier.

Two of this program's most cited pieces describe the same machine from different angles. TI-2026-024G (The Dead ASN Graveyard) reconstructed, by hand and for a single prefix, the "dead-ASN carousel": address space walked through a sequence of successively-burnt ASN wrappers — a Romanian shell, then a Russian operator, then a Kazakh holder — so that abusive space could outlive each toxic identity. TI-2026-021G (The Reputation Laundry) generalised it: churn is a laundry function, because once movement is normal, defenders bear the burden of proving continuity every time an ASN changes.

Both of those dossiers described the machine in motion. Neither could see the stock the machine draws from — because a point-in-time query only shows you the wrapper that is currently announcing. The dark census is the first look at the shelf: the allocated, held, dormant numbers available to be spun up as the next wrapper when the current one burns. Bunea sitting dark is not the end of Bunea; it is Bunea's number in inventory. The carousel needs a supply of fresh-enough, clean-enough ASNs to rotate through. The reserve is that supply, and reading lifecycle is the only way to count it.

That is the core methodological claim of the series, stated plainly: point-in-time attribution sees the flow; the change-log sees the stock. The reserve is invisible to every "who is attacking me now" tool ever built, and visible only in the ledger of change.

One more structural note. The reserve's allocation dates span 2013 (Bunea) to 2024 (Berdiev) — eleven years. This is not a single cohort that aged out together. It is a continuously replenished stock, restocked year over year, exactly as you would expect of an economy that treats autonomous-system numbers as consumable packaging rather than durable identity.

6. The Counter-Narrative

Steelman. "You have over-read a data artifact. announced=false at one snapshot means almost nothing — ASNs flap, RIPEstat lags, an AS can be un-announced on a Tuesday and live again on Friday. You caught a single non-announcement reading, called it a 'census of the dark,' and then decorated it with scary Russian and Moldovan names that were going to be un-announced anyway. There is no event here, and possibly no signal."

This is the right objection, and the finding survives it only by conceding most of it:

• "No event." Fully conceded — and stated first, in §2. There is no mass-takedown event. The null old-values prove the 2026-07-03 timestamp is the instrument's first pass, not a real-world synchronized withdrawal. This dossier makes no event claim. It makes an inventory claim.
• "A snapshot means nothing." Bounded. For strata III and IV the snapshot is corroborated by structure, not just timing: a defunct 1990s ISP and an Indian healthcare Pvt-Ltd are dark because they are permanently dark, which allocation age and zero routing footprint independently support. For the reserve, I explicitly do not claim any single ASN is permanently dark from this reading alone — an AS can indeed re-light. What I claim is about the population: that it is dominated by never-routed allocations, and that named, independently-documented bulletproof operators sit inside it. That claim does not depend on any one ASN's flap state.
• "Scary names, cherry-picked." Answered by the honeypot check and the strata. The scary names are a minority stratum, explicitly separated from the innocuous bulk that is the majority. And the reserve names are not decoration — AS62380's dark timestamp is cross-confirmed by an independent prior investigation using a different data source. That is corroboration, not cherry-picking.

What is not claimed: that 197 networks were taken down on 2026-07-03 (they were not — it is a census date); that the dark ASNs attacked this estate (they did not — zero honeypot activity); that every un-announced ASN is malicious (most are mundane); or that any single reserve ASN is permanently dead (it may re-light, which is precisely the point of calling it reserve).

Confidence: HIGH that the change-log enumerates a real, stratifiable population of 197 un-announced RIPE-region ASNs, that the 2026-07-03 clustering is a first-census artifact rather than an event, and that named bulletproof operators (Bunea, Chang Way, 1337TEAM, Contrust, Region40) sit within it. MEDIUM on the interpretation that the reserve functions as active dead-ASN-carousel inventory rather than coincidental dormancy.

7. Defence Response

• Add the reserve to your watchlist before it lights up. The single most useful product of a dark census is a pre-registered blocklist candidate. An ASN that is allocated, held by a known bulletproof operator, and currently dark is the definition of a network to flag the instant it begins announcing. Point-in-time defence reacts to the first packet; lifecycle defence can be armed one step earlier, against the number itself.
• Stratify before you act — never block on "un-announced" alone. The census is two-thirds innocuous bulk. A defender who imports "all un-announced ASNs" as bad has just poisoned their own feed with Indian small businesses and dead 1990s ISPs. The rule is: block the reserve (named operator + dark), watch the individuals, ignore the bulk.
• Treat a reserve ASN re-lighting as a high-value event. Because these numbers are held dormant on purpose, the transition from dark to announcing is not noise — it is the carousel turning. Wire an alert on announced: false → true for any ASN in the reserve stratum; that edge is worth more than a thousand routine scans.
• Use lifecycle to pierce reputation laundering. The laundry function (021G) works because defenders can't prove continuity across ASN changes. A maintained dark-reserve inventory is that continuity record: when burnt space reappears behind a fresh wrapper, the reserve census is where you go to show the fresh wrapper was held, dark, by the same hand all along.

8. A Note on Method

Built entirely through the entity-graph MCP layer, with no direct database access — entity_stats for the change-type totals, entity_changes(change_type=taken_down) paginated across all 197 rows for the census, entity_detail to resolve marquee holders to concrete ASN numbers and allocation dates, and honeypot_asn_dossier to ground-truth the reserve against our own attack data. The change-log is a freshly-exposed faculty of the graph; this letter is the first of a series built to work it. No SQL touched the investigation — the instrument is the graph's own lifecycle feed.

9. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence