TI-2026-096C — The Retail Floor: Autonomous Systems Held in One Person's Name

Classification: HIGH · Forensic threat intelligence · Entity-graph / lifecycle vector · Series: The Unannounced

Part B looked at the top of the market — one company holding two dozen numbers. This letter looks at the bottom. Scattered through the dark census are autonomous systems whose registered holder is not a company at all, but a single human being: a first name and a surname where an org should be. This is the retail floor of the number economy, where a globally-routable AS number costs about what a decent laptop does and is held like a personal possession. And it is the most honestly difficult stratum in the whole census — because two completely different populations live here, wearing the same clothes, and the registry usually cannot tell you which is which.

1. A Person Where a Company Should Be

The dark census (TI-2026-096A) is mostly organisations: SRLs, LLCs, B.V.s, defunct ISPs. But a distinct stratum breaks that pattern. Its holder field contains a person.

…and more by name only in the census: Sabire Irmak Mala (ipv4-net), Fazel Rezaei Kalantari (Tajook), Hossein Zangooei, Daniel Thomas Atkinson, Thomas Dubois, Simon Mariacher, Zhaikov Aitolkyn Bekbolatkyzy.

An autonomous system is, formally, infrastructure — a unit of the internet's routing backbone, the kind of resource a university or a telecom holds. Here it is held the way a person holds a domain name or a phone number: individually, personally, disposably. That inversion — critical infrastructure registered to Firstname Surname — is what defines the retail floor. It is not rare, and as the next section shows, it is getting more common.

2. The 2024 Wave

The allocation dates are not scattered randomly. Three of the four sampled — and many of the census's individual holders — cluster in a tight band:

• AS214357 — Mashayekhi — 2024-08-14
• AS214422 — Nebaba — 2024-08-02
• AS214576 — Berdiev — 2024-07-05

Consecutive-range AS numbers (all AS214xxx) allocated to different individuals in different countries within roughly six weeks of mid-2024 — and every one of them dark by our 2026 census. That is a cohort: a batch of person-held numbers acquired in the same window, from the same registry, and dormant within about two years.

Against that fresh wave sits AS39720 (Manilich, 2017) — a 16-bit personal ASN, from the older and scarcer number space, held for the better part of a decade before going dark. The two together make the point: the individual-holder pattern is neither new nor stable. It has a long tail (a 2017 legacy holding) and a sharp recent spike (the 2024 wave). Something made acquiring a personal ASN markedly easier and more attractive in the mid-2020s, and the census caught a slice of the result.

3. The Honest Problem: Two Populations, One Costume

Here is where this letter refuses the easy story. A cynical reading would line up eleven foreign-looking personal names against a "dark ASN" flag and imply a rogues' gallery. That reading is wrong, or at least unprovable, and the reason is AS214422.

Dmytro Nebaba's autonomous system publishes a website at https://as214422.lol/ and describes itself, in peeringdb, as Non-Profit, under the handle NET67X. A .lol vanity domain named after your own AS number, plus a non-profit self-label, is not the tradecraft of a bulletproof host. It is the unmistakable fingerprint of the hobbyist-AS subculture — the growing community of network enthusiasts who acquire a personal ASN to run IPv6 tunnels, join the DN42 hobby-network scene, experiment with BGP, or simply because owning a piece of the internet's backbone is a fun and now-affordable thing to do. These people are not criminals. They are the maker-community of routing, and their numbers go dark for the most mundane reason imaginable: the hobby project fizzled, the tunnel got turned off, life moved on.

But now hold that next to AS214576 (Berdiev) or AS214357 (Mashayekhi) — same 2024 wave, same personal-name holder, same dark status, no vanity site, no self-description. Are these fizzled hobby projects too? Or are they retail-bulletproof fronts, where a real person's name (or a rented one) is the disposable mask on a network meant to be spun up, abused, and burned? From holder name, allocation date, and dark status alone, you cannot tell. The hobbyist and the front wear the same costume: one individual, one cheap number, currently announcing nothing.

That indistinguishability is not a gap in our data. It is the structural finding. The hobbyist-AS boom is real and benign, and it has, as a side effect, normalised the individual-held AS number — which lowers the cost and raises the camouflage for anyone who wants a personal-name front. The front hides in the hobby crowd. Naming that dynamic precisely, without accusing the crowd, is the only honest thing to do with this stratum.

4. Why the Retail Floor Matters Anyway

If the stratum is mostly benign and the rest is unprovable, why document it? Because the structure is intelligence even when the individuals are not.

Part A framed the bulletproof reserve as inventory — held numbers waiting to be lit. The corporate accumulator (Part B) is one supply channel into that inventory. The retail floor is another, and a more elastic one: where an SRL costs a company formation, a personal-name ASN costs almost nothing socially — no shell to file, no corporate paper trail, just an individual walking up to a sponsoring LIR. The 2024 wave shows that channel running warm. A defender who understands that the individual-holder tier is both a healthy hobby community and a low-friction front-supply channel can calibrate correctly: don't block the tier, but don't dismiss it either.

There is also a durable-identifier lesson hiding in the hobbyist tell. as214422.lol is, ironically, more trackable than a faceless shell — a vanity domain, a handle (NET67X), a self-published identity. The genuinely benign holders leave fingerprints; the fronts tend not to. That asymmetry — presence of a public persona correlating with legitimacy, absence correlating with nothing either way — is a weak but usable signal, and it is exactly the kind of edge the golden graph's coalescence surfaces.

5. The Counter-Narrative

Steelman. "This is innuendo dressed as analysis. You have a list of foreign personal names, no attacks, and one guy with a joke website, and you have insinuated that some unknown subset are criminal fronts while admitting you can't identify which. That's worse than saying nothing — it casts a shadow over real hobbyists by association."

The objection is serious and it is the reason the letter is written the way it is:

• "Innuendo against individuals." Refused explicitly. No named person here is accused of anything. AS214422 is presented as benign-leaning. The others are presented as unresolvable from registry data — which is a statement about the limits of the evidence, not about the people. The holder names are public RIPE data; they are named to characterise a market, and the letter's central move is to insist the market cannot be read off the names.
• "You can't identify the fronts, so drop it." No — name the ambiguity. The intelligence product is precisely the finding that hobbyist and front are indistinguishable at the registry layer, and that the hobby boom supplies cover. That is actionable for a defender (calibrate, don't overblock) without requiring any individual to be judged.
• "One joke website proves nothing." Agreed — it proves benignity for one holder, not a theory for the rest. The .lol site is offered as an existence proof that the benign population is real and present, which is what forbids the rogues'-gallery reading. It is deliberately not extrapolated to anyone else.

What is not claimed: that any named individual is a criminal or a front (none is so alleged); that the 2024 cohort is coordinated (consecutive allocation is consistent with an ordinary registry batch); that dark = malicious (it does not); or that hobbyist ASNs are a problem (they are not — they are the benign majority whose existence the letter is at pains to protect).

Confidence: HIGH that a person-held stratum exists in the dark census with a distinct 2024 allocation wave; HIGH that a benign hobbyist-AS population is present and identifiable within it; MEDIUM that the stratum also contains retail-bulletproof fronts indistinguishable from hobbyists at the registry layer; LOW on any individual attribution (none is made).

6. Defence Response

• Never blocklist on personal-name holder alone. The individual-holder tier is majority-benign hobby infrastructure. Treating "held by a person" as a threat signal will bury real enthusiasts and teach your feed to cry wolf. Holder-is-a-person is context, not a verdict.
• Read the public-persona asymmetry. A person-held ASN with a vanity site, a handle, and a self-description is more legitimate-looking and more trackable; a bare personal-name holding with no public footprint is neither more nor less suspicious — just opaque. Weight the presence of a persona as mild reassurance, its absence as nothing.
• Watch the wave, not the person. The actionable object is the allocation cohort — a batch of person-held numbers acquired together and going dark together. If any member of such a cohort later lights up abusively, the rest of the cohort is worth a look, because batch-acquired fronts tend to travel together. That is a structural pivot, not a judgement of any named holder.

7. A Note on Method

Built entirely through the entity-graph MCP layer, no direct database access — entity_changes(change_type=taken_down) to isolate the person-held stratum, and entity_detail per holding to recover ASN numbers, allocation dates, the entity_class: person resolutions, and the AS214422 website/Non-Profit/NET67X attributes that surface the hobbyist tell. All holder names are public RIPE registry data, presented to characterise a market structure. No SQL touched the investigation, and no individual is accused of wrongdoing.

8. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence