TI-2026-100C — The Quiet Transit, Part C: The Table of Seven Dashes

Classification: TLP:WHITE · Confidence: HIGH · Series: The Quiet Transit, Part C Subject: one table in one published dossier — and what was in it

1. Going back to the table

Part A began with a single row in somebody else's dossier. TI-2026-030A — The SHA1 Mask, chapter 8, tabulates the eleven BGP upstreams of AS210558 (1337 Services GmbH). One row read AS41745 — Transit European transit. Pulling that thread produced a Moscow registrant, five maintainer handles and five trading names.

The obvious question was whether that row was unlucky or representative.

Here is the whole table, as published:

Four names. Seven em-dashes.

The four that are named are precisely the four a reader would already recognise. The em-dash is not missing upstream data — every one of these ASNs has a public RIR registration and a resolvable operator, one RDAP call away. The dash is the corpus recording that it did not look.

This dossier resolves all seven.

2. The seven

Not one of the seven is a neutral carrier. Four carry is_bulletproof under the tightened classifier from Part B. One is Spamhaus-listed.

The anonymised half of the table was the interesting half — which is the exact inverse of how any reader would parse it. A dash reads as "nothing here."

3. AS210644

The row reads AS210644 — Transit Small provider.

AS210644 is AEZA GROUP LLC.

On 1 July 2025, the United States Department of the Treasury's Office of Foreign Assets Control designated Aeza Group LLC — a Russia-based bulletproof hosting provider — together with three associated entities and four individuals, for its role in supporting cybercriminal activity: ransomware, infostealer infrastructure, and technology theft. The action was taken in coordination with the United Kingdom's National Crime Agency. Chainalysis, Elliptic and TRM Labs each published analyses the same day.

Our own enrichment records it independently: spamhaus_listed = true, is_bulletproof = true.

It appears exactly once in 775 published pages. That appearance is the em-dash.

The timeline is the finding

Eleven and a half months after a US Treasury designation coordinated with the NCA. One month after the operator's own traffic entered our telemetry.

Nothing was hidden. Nothing was new. The information was public, old, and already in the building.

4. The row we had already unmasked

AS200730 belongs to ISAEV Igor.

This corpus published TI-2026-020B — ISAEV: A Darknet Operator Unmasked on 2026-06-18 at 13:55:36 UTC. It documents the ASN, the Almaty registration, the single announced /24 and more than four thousand honeypot attempts.

TI-2026-030A published on 2026-06-20 at 12:06:31 UTC.

Forty-six hours later, the same corpus rendered AS200730 as an anonymous "— Transit European peer."

Current telemetry for that ASN: 9 IPs, 5,174 honeypot hits — the heaviest hitter of all seven dashes.

This is the single strongest piece of evidence that the dash is structural rather than a research gap. The corpus was not ignorant of AS200730. It had just finished writing a dossier about the man who runs it. The knowledge existed, in print, in the same database, two days earlier — and it did not propagate into the dependency table.

5. It is not one table

If the pattern were confined to one chapter it would be an editing lapse. So the same question was put to the entire corpus.

Every AS number was extracted from all 775 published threat-intelligence pages, and diffed against every ASN ever recorded as formally examined infrastructure in the investigation store.

Seven of those 149 are Spamhaus-listed:

Infrastructure enters this corpus as a supporting detail in someone else's story, and is never promoted to a subject.

A method note, because the first attempt was wrong

The first pass tested whether an AS number appeared in a page title or <h1>. It found 8 subjects out of 553 cited ASNs — an obviously broken result, because dossier titles are thematic (The Phantom ASN, Offshore Bulletproof) and virtually never contain the number.

Substituting formal infrastructure records raised it to 507 and produced a credible gap.

This is worth recording because it is the same error class Part A was built on, and the same one that nearly derailed its research: a coverage check keyed on NAMES will systematically miss entities that only ever appear as NUMBERS. That is precisely why AS41745 survived 773 dossiers unexamined, and it is why the first attempt to measure the problem reproduced the problem.

6. The counter-narrative: this is not a target list

The strongest objection to this dossier is that "cited but never investigated" reads like an indictment queue. It must not be, and the same 149 entries prove why.

On packet evidence these are indistinguishable from attackers. Driftnet shows 35 IPs in our telemetry — more than any of the seven dashes. They are cited in our dossiers about scanning swarms because they were, quite correctly, scanning.

This is Part B's failure mode inverted. There, a victim network was scored as a villain. Here, measurement infrastructure sits unremarked inside a threat corpus on identical evidence.

Being unexamined is a statement about our attention. It is not a statement about the entity.

The 149 is a work queue, not a verdict. AEZA is in it and so is BitSight, and the only way to tell them apart is to look — which is the entire point.

7. What remains open

AS61125 — SABOTAGE LLC (US). The seventh dash and the second never-examined row. 17 observed IPs — all in the Dutch 45.66.35.0/24 range despite a US registration — average threat 45.9, risk 65.2, zero honeypot hits, no Spamhaus listing, no bulletproof flag. No published corporate research was located during this investigation.

That absence is recorded as the finding rather than papered over. This dossier identifies AS61125 as unexamined, not as malicious, and rates it MEDIUM accordingly. A 17-IP presence with a moderate threat average and no hit volume is genuinely unresolved.

8. Defence response

1. Resolve dependency tables at write time. The operator name for any ASN in an upstream, peer or supplier table is one RDAP call away. If the name is known it should be printed even when the entity is out of scope. An em-dash reads as nothing here; it means not examined. Those are different claims and only one of them is true. [INFERRED — proposal, not implemented]
2. Track the debt automatically. A cited-not-examined list should be generated after each publish and triaged, rather than reconstructed a year later by scraping one's own website. [INFERRED — proposal, not implemented]
3. For defenders reading anyone's threat intelligence: treat unnamed entries in dependency tables as unresolved, not as unimportant. The named rows in this table were OVH, GTT and Comcast. The dashes were a sanctioned bulletproof host and a darknet operator.

9. Metadata

Sources

• TI-2026-030A — The SHA1 Mask ch.8
• TI-2026-020B — ISAEV: A Darknet Operator Unmasked
• US Treasury OFAC press release SB0185 — Aeza Group designation, 2025-07-01
• Chainalysis, Elliptic, TRM Labs — Aeza Group analyses, 2025-07-01
• Alpha Strike Labs · Driftnet · SANS ISC · GreyNoise benign-scanner profiling
• LSN threat_intel and dossier_intel, post-fix scoring, 2026-07-26

AEZA GROUP LLC is named here on the basis of a public US Treasury designation. SABOTAGE LLC is named as unexamined infrastructure and no allegation is made against it. Alpha Strike Labs, Driftnet and BitSight are named expressly to record that they are legitimate measurement companies and not threats.