TI-2026-100D — The Quiet Transit, Part D: Aeza, or What a Sanction Does Not Do

Classification: TLP:WHITE · Confidence: HIGH · Series: The Quiet Transit, Part D Subject: AS210644 / AS216246 — AEZA GROUP LLC · Measured: 2026-07-26

1. The dash, resolved

Part C went back to a table in an old dossier and resolved seven rows that had been published as em-dashes. One of them, described as — Transit Small provider, was AEZA GROUP LLC.

On 1 July 2025, the US Department of the Treasury's Office of Foreign Assets Control designated Aeza Group as a bulletproof hosting provider, in coordination with the United Kingdom's National Crime Agency. Per Treasury, Aeza provided hosting to the Meduza and Lumma infostealer operators — used to target the US defense industrial base — and hosted BianLian ransomware, RedLine infostealer panels, and BlackSprut, a Russian darknet marketplace for illicit drugs.

Part C established that we had overlooked it. This dossier asks the only question our own instruments can actually answer:

Twelve months later, what changed?

The answer, measured rather than asserted, is: almost nothing observable.

2. Still registered

RDAP, queried 2026-07-26. Both autonomous systems return status: ["active"].

Two distinct RIPE organisation objects, at two different Saint Petersburg addresses, for one designated company.

Note what is not happening here. There is no attribution friction. No layered maintainer handles, no inverted object kinds, no brand multiplicity of the sort Part A documented on AS41745. The real company name, the real street address and working telephone numbers are all published and current.

Aeza does not need to hide.

3. The Sheffield contact

The administrative and technical contact published on AS216246 is:

AN33336-RIPE
Aeza International LTD
311 Shoreham Street, Sheffield, S2 4FA, United Kingdom

Aeza International Ltd is a designated entity. OFAC named it explicitly, with the UK's own National Crime Agency coordinating, describing it as "the United Kingdom branch of Aeza Group" which "Aeza Group uses to lease IP addresses to cybercriminals, including Meduza infostealer operators."

A year after the United Kingdom's own crime agency helped designate it, that company remains the registry contact of record for a live autonomous system announcing 12,288 addresses.

There is no mystery in this. Registry contact objects are not sanctions-screened. Nothing in the RIPE database checks a person or role object against an OFAC or NCA list, because nothing was ever built to.

4. Still routed

This is the central measurement, and it is a routine public query anyone can repeat.

RIPEstat routing status, 2026-07-26:

Roughly 107,000 addresses, across 365 prefixes, kept reachable by 85 peering relationships, twelve months after designation by the United States Treasury and the United Kingdom's National Crime Agency.

The designation is real. The infrastructure is still on the internet. Both statements are true at once, and the space between them is what this dossier is about.

5. What arrived at our sensor

Our honeypot first saw Aeza address space on 21 May 2026 — ten and a half months after the designation.

Seven IPs, arriving in a rolling pattern across seven weeks — three in May, one in June, one in late June, two in July. The most recent contact is 12 July 2026, twelve months post-designation.

This is not residual infrastructure winding down. It is new address space arriving at a sensor, well into a sanctions regime.

The estate is European

DE 4 · FI 2 · LV 1 · Russia 0.

A Saint Petersburg company under US and UK designation reaches our sensor exclusively from EU and EEA address space.

The operational consequence is blunt and worth stating plainly for defenders: a control built on blocking Russian address space would have blocked none of these seven addresses.

6. One company, two reputations

By every automated measure available to us, AS216246 is clean — while announcing twelve thousand addresses through forty-two neighbours and publishing a designated UK company as its contact.

Any blocklist, feed or firewall rule keyed on the flagged ASN silently omits the other 12,288 addresses of the same designated group.

The correct unit of control here is the corporate identity, not the ASN reputation.

Our own low score is the right answer

AS210644 computes risk_score 15.8 under the classifier tightened in Part B — because we have seen seven IPs of a 94,720-address estate, and the coverage term correctly refuses to extrapolate from a keyhole. Its is_bulletproof=true comes from the Spamhaus branch, the external-authority path that carries no sample floor.

That is the fix working exactly as designed. A scoring system that had confidently rated this ASN 90+ on seven observations would have been right by accident — for precisely the reason it was wrong about Charter.

Local telemetry is a keyhole. The designation is the daylight.

7. The counter-narrative, steelmanned

The strongest reading against this dossier's framing deserves full weight, because most of it is correct.

1. A sanction is not a routing protocol. OFAC designations bind US persons and US-touching financial flows. They do not create an obligation for RIPE NCC — a Dutch association operating under Dutch and EU law — to revoke a registration, nor for non-US networks to stop peering.
2. Peering is private commerce. Eighty-five networks each decide commercially whether to accept a prefix. There is no technical mechanism by which a designation propagates into the routing table, and no registry can withdraw a route another network chooses to carry.
3. Aeza was not untouched at home. Treasury's own text records that CEO Penzev and general director Bozoyan were arrested by Russian law enforcement over the placement of BlackSprut on Aeza infrastructure. Whatever else is true, this was not a company facing zero consequences.
4. Hosting providers have lawful customers. An estate of ~107,000 addresses certainly carries legitimate services that de-routing would destroy.
5. Our own evidence is thin. Seven IPs. Low hit counts. No malware captured, no C2 observed, no ransomware seen. Nothing in our telemetry independently proves what Treasury alleges.

This dossier accepts all five points.

It makes no claim that any party failed a legal duty. RIPE NCC is not accused of wrongdoing; neither are the 85 neighbours, which is why they are counted and deliberately not named — observed adjacency is not evidence of knowledge or intent.

What survives is narrower, and it is measurable:

Designation and disconnection are different events. Only the first one happened.

8. Why the gap exists

Three layers sit between a sanctions designation and an unreachable network. None of them is automatic, and a designation addresses none of them directly.

This observation follows from the evidence. The remedy is a policy question well outside the competence of a honeypot operator writing from an apartment in Iaşi, so none is advocated here. [INFERRED]

9. Defence response

1. Block by corporate identity, not by ASN. AS216246 is clean by every automated signal and belongs to the same designated group as AS210644. Enumerate both, and re-enumerate periodically — an entity that holds two ASNs can hold a third.
2. Do not rely on country-of-registration filters. All seven observed addresses were German, Finnish or Latvian. The registration is Russian. These are unrelated facts.
3. Treat sanctions lists as an intelligence source, not a control. A designation tells you an entity is worth blocking. It does not block it. If you want a designated network off your perimeter, you must put it there yourself.
4. Check your transit. If a designated ASN can be an upstream of a provider you use — as AS210644 is listed for AS210558 in TI-2026-030A — that is a supply-chain question worth asking your vendors.

10. Metadata

Sources

• US Treasury OFAC press release SB0185 — Aeza Group designation, 2025-07-01
• RIPE NCC RDAP — AS210644, AS216246
• RIPE NCC RIPEstat routing-status — measured 2026-07-26
• LSN honeypot telemetry, threat_intel, 2026-05-21 → 2026-07-12
• TI-2026-100C — The Table of Seven Dashes
• TI-2026-030A — The SHA1 Mask ch.8

AEZA GROUP LLC, Aeza International Ltd, and the four named individuals are identified solely on the basis of the public US Treasury designation of 1 July 2025 and public RIPE registry records. No allegation is made beyond what those public sources state. RIPE NCC and the 85 observed BGP neighbours are named or counted as structural facts, not as wrongdoers; individual neighbours are deliberately not enumerated, because observed adjacency is not evidence of knowledge or intent.