TI-2026-100F — The Quiet Transit, Part F: Six Flags, Five Registries, One Blind Spot

Classification: TLP:WHITE · Confidence: HIGH · Series: The Quiet Transit, Part F Measured: 2026-07-26

1. The remainder

Part C swept the corpus and found 149 ASNs cited but never examined, of which seven carried a Spamhaus listing. Part D took one of them and found AEZA — a Treasury-designated bulletproof host, still routing 107,000 addresses.

These are the other six.

The question worth asking of a group rather than an individual is whether the group is one: does "Spamhaus-listed and never examined" identify a coherent kind of infrastructure — a cluster, a shared operator, a technique — or does one flag conceal six unrelated things?

It conceals six unrelated things. But the looking was not wasted, and two of them turned out to share something I was not looking for.

2. The cohort

All five Regional Internet Registries are represented in a set of six. Ages run from twenty-two years to four months. Estates run from 279,808 addresses to 1,024 — a factor of 273. Upstream counts from 24 to 1. Honeypot contact from 150 hits to none.

They were cited in six different, thematically unrelated dossiers — The Food Code, The Nursery, Eighty-Four Flags, Dutch Backbone, The mdrfckr Botnet, Recruiters' Handshake. No shared campaign. No shared operator. No shared technique.

The only property these six demonstrably hold in common is that this corpus named them and never looked.

A flag is a pointer, not a class.

3. All six are still routed

Every member was last seen in the global routing table on 2026-07-26, the morning of writing. Together:

989 prefixes · ~484,000 addresses · 59 BGP neighbours.

Part D established that an OFAC designation left 107,000 addresses routed. At cohort scale the same holds for reputation listings: six independent Spamhaus entries leave nearly half a million addresses reachable.

Blocklists are advisory inputs that individual operators choose to consume. They are not mechanisms that remove address space from the internet, and they have never claimed to be.

4. What I was not looking for

Two of the six carry a specific and identical structural signature.

Both are the largest estates in the cohort. Both carry suite-or-box style registered addresses — 254 Chapman Road, Newark is a commercial address widely used for registered-agent services. And both show address space announced for over a decade before the current registrant's record begins.

That gap is the documented shape of an autonomous system that changed hands. Legacy space carries inherited reputation that a fresh allocation does not — it is older than most blocklists' memory and it looks established.

The other four show registration and first-routing within months of each other. This is a real sub-pattern in exactly one third of the cohort, and I found it only because the cohort was assembled and compared rather than triaged one at a time.

No claim of shared operation is made between Bunny and Zillion — two instances of a common technique is not evidence of a common operator.

5. The youngest one is the live one

AS402253 — SKN Subnet & Telecom Ltd, Saint Kitts and Nevis.

A four-and-a-half-month-old ASN in an offshore jurisdiction, single-homed, already Spamhaus-listed, still probing this morning.

One address, two spellings, three names

ARIN publishes two contact objects registered the same day:

ABUSE9540-ARIN   "Harnilton Development, Charlestown, Saint Kitts and Nevis"
CORPO54-ARIN     "Hamilton  Development, Charlestown, Saint Kitts and Nevis"

An rn versus m difference in the street name, within one registration. ARIN records both objects as status: validated.

A third name attaches: the ASN holder is SKN Subnet & Telecom Ltd, the admin/tech contact is SGC Corporation, and the abuse role is a third object.

I do not assert this is deliberate — a transcription error is at least as likely. What it does establish is narrower and more useful: registry "validated" status attaches to the contact object, not to the accuracy of the address inside it.

And it does not operate where it is registered

All four observed IPs are in Switzerland. The registration is Nevis.

That split recurs across the cohort: Zillion is Delaware-registered with addresses in Singapore and the Seychelles; Bunny is US-registered with addresses in the Philippines and Japan. It is the same registration-versus-operation separation documented on AS41745 in Part A and on AEZA in Part D.

6. The provenance defect, again

AS329325 Maxko for Gaming Development holds two records. Both honeypot_hits = 0. Both tags = {ioc_feed_match}. Both first_seen and last_seen = 2026-05-21.

A single feed ingestion. Zero first-party observation.

This is precisely the pattern Part E documented on SABOTAGE LLC — and its recurrence here matters, because this cohort was selected on a completely different criterion. Feed-only records are not confined to one unlucky case; they are scattered through the corpus, indistinguishable from observations unless someone checks tags.

The other five members all produced genuine honeypot hits, from 1 to 150.

7. Our keyhole, and our score admitting it

Bunny announces 193,536 addresses. We have seen 3 IPs and 1 hit. Its risk_score is 7.6.

Zillion announces 279,808 addresses. We have seen 3 IPs and 8 hits. Its risk_score is 21.8.

Under the classifier corrected in Part B, the coverage term refuses to extrapolate from a handful of addresses across a very large estate — so both score low despite carrying an external listing.

That is the fix behaving correctly, and it marks a real limit. Our score and a Spamhaus listing measure different things, over different windows, at different scales. Collapsing them into one verdict would reintroduce exactly the error Part B documented.

8. The counter-narrative — and it lands

The obvious objection: this dossier criticises a reputable blocklist for lacking a coherence it never claimed.

That objection is correct, and it is accepted.

Spamhaus lists individual networks on its own evidence, for its own reasons, over its own observation windows. It has never asserted that its listees form a cluster. Heterogeneity across six independent listings is exactly what a well-functioning per-network process should produce — finding it is a sign the process works, not that it fails.

A second objection also stands: large networks accumulate abuse because they have customers. That is the Part B lesson. A listing against a 279,808-address estate and one against a 1,024-address estate are simply not comparable quantities.

The defect documented here is entirely ours. We treated a shared external flag as though it identified a shared kind of thing, and then left all six unexamined on the strength of that assumption. The finding is about our inference, not their listing.

9. What the cohort was actually good for

Selecting on "externally flagged and never examined" produced no cluster — and paid for itself anyway:

• One live, fast-moving target — AS402253, four months old and still arriving
• Two instances of a specific reacquisition pattern worth testing corpus-wide
• One more instance of the feed-provenance defect — confirming it is systemic

The proposal that follows is to stop treating such a list as a candidate cluster and start treating it as a triage queue whose members are expected to diverge.

And one concrete next step: run the routing-first-seen versus registration-date comparison across all 507 examined ASNs. Two hits in a sample of six suggests aged-space reacquisition is not rare, and unlike everything else in this dossier it is cheap to measure at scale. [INFERRED — untested]

10. Metadata

Sources

• RIPE NCC RIPEstat routing-status — all six, measured 2026-07-26
• ARIN RDAP — AS5065, AS54801, AS402253
• LSN threat_intel — honeypot telemetry and Spamhaus enrichment
• TI-2026-100C · TI-2026-100D · TI-2026-100E

Each network is named as the registered holder of the ASN indicated, per public registry records, and as carrying a Spamhaus listing per our own enrichment. Risk levels are assigned individually and several are LOW. Nothing here alleges criminal conduct by any of the six. The observation that AS5065 and AS54801 share a reacquisition pattern is explicitly NOT a claim of shared operation. Spamhaus is named as the source of the selecting flag and is not criticised: the methodological defect documented is our own.