TI-2026-100E — The Quiet Transit, Part E: SABOTAGE LLC, and the Discipline of Not Knowing

Classification: TLP:WHITE · Confidence: MEDIUM · Series: The Quiet Transit, Part E Subject: AS61125 — SABOTAGE LLC · Verdict: UNRESOLVED

1. The last dash

Part C resolved seven em-dashes in a published upstream table. Five were already documented somewhere in this corpus. Two had never been examined at all.

Part D took the first of those two and found AEZA GROUP — a bulletproof host designated by the US Treasury and the UK National Crime Agency, still routing 107,000 addresses a year after sanction.

This is the other one.

Applying the identical method to AS61125 — Transit — Small provider, the evidence stops.

This dossier does not resolve SABOTAGE LLC. It explains precisely where the resolution fails, and declines to guess.

That is not a failure of the series. It is the series working. A method that can only ever return a culprit is not a method — it is a machine for generating accusations.

2. What is documented

RIPE RDAP, 2026-07-26. The record is candid — no layered handles, no brand multiplicity of the sort Part A found on AS41745.

RIPEstat routing:

A domain registered twenty-eight years ago. An ASN routed for twelve. One prefix, one upstream.

Whatever this is, it is not disposable infrastructure — it is the opposite of the throwaway-shell pattern documented across the bulletproof-reseller dossiers.

3. Four sources, four countries

And a temporal disagreement on top: our allocated_at reads 2020-05-25, while RIPEstat records the ASN in the global routing table from 2014-01-18 — six years apart.

No source here is clearly authoritative for where the operator actually is. Per house method, the disagreement is recorded rather than resolved. Picking the most incriminating option would be a choice, not a finding.

4. The thing that decides it

Every claim this corpus holds about SABOTAGE LLC comes from one place.

All 17 addresses carry:

tags        = {ioc_feed_match}
honeypot_hits = 0
first_seen  = 2026-05-21
last_seen   = 2026-05-21

Identical first and last timestamps on every record. That is not activity observed across time — it is a single ingestion event. greynoise_class is empty for all of them.

Our sensor has never recorded a single packet from this network.

In Part D the equivalent question had a real answer: seven Aeza IPs actually arrived at the honeypot, across seven weeks, with rolling first-contact dates. Here there is nothing of our own to weigh at all. Everything is a third party's assertion that we imported once and never independently corroborated.

And the scale of the claim is small

17 of 256 addresses — 6.6%.

Compare:

Its local risk_score of 65.2 comes from the ratio term over a small sample — precisely the kind of number Part B established must not be read as a verdict.

5. A detection defect worth more than the subject

The 17 addresses sit in the same table, with the same threat_score and abuse_score columns, as addresses our honeypot genuinely observed.

Only the tags column and those identical timestamps distinguish an ingested claim from an observation.

Any query, ranking, export or dossier that does not inspect provenance will treat a third party's assertion as first-party evidence — with the same weight, in the same fields, under the same schema.

This is a direct sibling of the Part B defect. There, a score was computed without a denominator. Here, a record is consumed without a provenance check. In both cases a number acquires more authority than its underlying evidence supports.

6. The table was wrong, not just silent

TI-2026-030A called AS61125 — Transit — Small provider.

An ASN announcing one prefix through one upstream, with no downstreams, is a leaf network. It carries no third-party traffic. It has no transit customers. It is not a transit provider in any sense.

So the table made two errors on this row: it withheld the name and assigned an incorrect role.

That extends Part C's finding. Unexamined entries in dependency tables are not merely blank — they can be positively wrong.

And it flattened the topology

AS61125's single upstream is AS24875 NovoServe B.V. A second NovoServe ASN — AS215224 — was itself one of the seven em-dash rows in the same table.

The table listed a provider family and one of its own single-homed customers side by side, as separate and equally anonymous "transit" entries, with nothing to indicate the two rows were related.

Resolving the dashes does not merely name entities. It recovers the topology the table flattened.

7. The counter-narrative — against ourselves

Here is the incriminating reading, stated at full strength, then dismantled.

1. "A mailbox address at Keurenplein 41 is a shell." Registered-office services are lawful and ubiquitous for Dutch entities. The same building hosts an e-commerce consultancy, a company trading as a hookah retailer, and dozens of others at their own unit numbers. It proves the address cannot tell us who operates the network — nothing more.
2. "A maintainer named spectre on an ASN named SABOTAGE is brand-layering." One alternate handle is nothing like the five-handle, five-brand structure documented on AS41745, and is unremarkable where infrastructure has changed hands.
3. "An inetnum flagged Seychelles is offshore obfuscation." The country field on a Provider Aggregatable sub-assignment frequently reflects the parent holder's registration, not the customer's.
4. "6.6% of its addresses are on an abuse feed." Any hosting provider with customers accumulates abusive addresses. That is the entire lesson of Part B, where a consumer ISP was scored as a bulletproof host on three infected subscriber routers.
5. "It is called SABOTAGE." Evidentially worthless. Companies choose names.

None of these facts, alone or together, establishes wrongdoing.

8. What would actually settle it

Three things, none available from passive sources:

• The feed's own evidence for the 17 listings — what was observed, when, and by whom. We hold the conclusion without the reasoning.
• First-party observation — which requires waiting for a network that has never contacted our sensor to contact it.
• Dutch Chamber of Commerce filings for the registered entity, establishing directors and beneficial ownership.

Active scanning of the /24 was deliberately not performed. Probing a network against which nothing is established is not proportionate, and this series has spent four dossiers arguing that unexamined does not mean guilty. It would be a poor ending to prove the point by violating it.

The correct action is to leave AS61125 on the watch list, with its provenance stated, and revisit if it ever reaches the sensor.

9. Why publish a dossier with no verdict

Because the alternative is worse.

This series began because an operator hid for 773 dossiers behind an em-dash. It would be a strange conclusion to replace one silence with a different kind of dishonesty — a confident narrative assembled from a mailbox, an evocative company name, and someone else's blocklist.

Four dossiers in, the pattern of this series is not "we found the bad guys." It is:

The em-dash was wrong because it hid something knowable. "Unresolved," stated with its evidence and its gaps, is not an em-dash — it is an honest answer.

10. Metadata

Sources

• RIPE NCC RDAP — AS61125, 45.66.35.31
• RIPE NCC RIPEstat — routing-status, prefix-overview, asn-neighbours, measured 2026-07-26
• ICANN WHOIS — sabotage.net (NextName B.V. / RegistrarHub)
• OpenCorporates / OpenCorpData / KadastraleKaart — Keurenplein 41 occupancy
• LSN threat_intel — 17 ioc_feed_match records, ingested 2026-05-21
• TI-2026-030A ch.8 · TI-2026-100C · TI-2026-100D

SABOTAGE LLC is named here solely as the registered holder of AS61125 per public RIPE records. This dossier establishes no wrongdoing by SABOTAGE LLC, makes no allegation against it, and explicitly records that the only adverse information held about its address space is an uncorroborated third-party feed listing. NovoServe B.V. is named as an upstream provider and no finding is made against it.