TI-2026-100G — The Quiet Transit, Part G: The 2026 Wave — Seven Old Numbers, New Owners

Classification: TLP:WHITE · Confidence: MEDIUM · Series: The Quiet Transit, Part G Measured: 2026-07-26 · Population: 383 examined ASNs

1. Measuring what Part F guessed

Part F found, in a cohort of six, that two autonomous systems had been announced for over a decade before their current registration began — the signature of address space that changed hands. Two out of six is not a finding. It is a reason to measure.

So the comparison was run against every ASN this corpus has ever examined: 515 distinct, 423 with a registration date, 383 resolved. For each, the current RIR registration date minus the RIPEstat routing first_seen.

The method was validated first: our stored registration dates matched ARIN's RDAP registration events exactly for both Part F cases.

The signature is common, not exotic. One examined network in eight carries it.

2. It correlates — and it still identifies nobody

A decade-plus gap carries roughly four times the bulletproof rate and five times the Spamhaus rate of baseline. As a way to sort a queue, that is genuinely useful.

As a way to reach a conclusion, it is worthless — because the same band contains:

The largest gap measured in the entire sweep belongs to a commercial hosting company. DigitalOcean is in the band.

Sort with it. Never conclude from it. The same discipline as Part B and Part F.

3. The thing I was not measuring

Among the 28 decade-plus gaps, the year of re-registration:

2012  █ 1
2015  ██ 2
2017  ██ 2
2018  █ 1
2019  █ 1
2020  █ 1
2021  ██ 2
2022  ██ 2
2023  ████████ 8
2024  █ 1
2025  █ 1
2026  ██████ 6   ← in five months

Six in the first five months of 2026 — plus AS205759 Ghosty Networks at an 8.6-year gap on 20 January, giving seven — against eight in the whole of 2023.

And the spacing is regular. Roughly one every three to four weeks:

All seven went through RIPE NCC — despite country codes spanning US, DE, KZ, ES, GB and SC, including two entities that would ordinarily sit under ARIN and AFRINIC.

Six jurisdictions, three continents, one registry.

4. Not one actor

The obvious hypothesis is a single buyer behind seven names. The registry says no.

Six of seven use a dedicated vanity handle matching their own trading name. No shared maintainer. No shared organisation object. No shared abuse contact. No shared address.

On the registry evidence these are independent parties, and this dossier declines to call them one operator.

The interesting question is not who bought. It is through whom.

5. The brokerage layer, visible twice

Two records connect outward. The other five connect to nothing.

VIA-REGISTRY-MNT — on ISAEV's ASN

AS200730 carries a second registrant maintainer alongside its own: VIA-REGISTRY-MNT.

That handle is already in this corpus. It is one of the recurring RIPE maintainer handles forming the shared bulletproof reseller substrate — alongside mnt-bg-eurocrypt-1, MNT-ZEXOTEK, mnt-de-xsserver-1, lir-bg-telco-1-MNT and netutils-MNT — the handles that bridge the previously siloed Phantom ASN (TI-2026-026), Costume Catalog (082) and DMZHOST (088) investigations.

A February 2026 acquisition carries a maintainer already documented across three published series.

lir-de-lain-1-MNT — on a Spanish individual's ASN

AS199428 belongs to Alvaro Navas, a natural person in Granada, Spain. It is the only member of the cohort with no vanity handle of its own. Its registrant maintainer is lir-de-lain-1-MNT — the lir-de- prefix denoting a German Local Internet Registry.

A German LIR handle maintaining a Spanish individual's autonomous system is the sponsor seam: the party that executed the transfer and retains registry control.

That is what a market looks like from outside. Many buyers, few brokers, and the brokers only occasionally visible in the record.

6. Addresses that repeat known shapes

AS198189 Throttle Limited — 124 City Road, London EC1V 2NX. Its administrative, technical and abuse objects all sit at that one address. Companies House data indexed by Lursoft records 5,823 companies registered there; it is operated as a virtual office by Capital Office.

AS197170 TechTies — Victoria House, Mahe, Seychelles.

Both are lawful and ubiquitous corporate-services addresses. As with Keurenplein 41 in Part E, they are recorded to bound what the address can prove, not as evidence of anything.

And both US entities are in rural Kentucky

• Ghosty Networks LLC — 110 N Court St, Scottsville, KY 42164
• VPS Dedicated LLC — 106 Max Hurt Drive, Murray, KY 42071

Two small towns in south-western Kentucky, roughly 150 miles apart. Both of the cohort's US registrations.

This is an observation, not a link. No shared handle, officer, address or contact connects the two records. Kentucky LLCs are unremarkable. It is recorded because it is odd, and because recording an oddity without inflating it is the whole method of this series.

7. What they did afterwards varies enormously

Five orders of magnitude, from the heaviest attacker in our entire corpus down to complete silence.

The two named natural persons are the quietest members — one observed IP each, zero hits, no flags. Whatever they acquired aged space for, it is not visibly being used against our sensor, and nothing here is adverse to either of them.

Acquiring an aged ASN is not itself evidence of anything.

8. The objection that matters most

The sample is biased, and the wave may be an artefact. This needs stating plainly rather than buried in a footnote.

All 383 ASNs swept are networks this corpus had already examined in prior threat investigations. The population is drawn, by construction, from infrastructure that attracted our attention. A temporal cluster inside that population is evidence about the acquisition behaviour of operators we already track — nothing wider.

It is not a random sample of the RIPE service region and supports no claim about market-wide transfer volumes in 2026. Establishing whether aged-ASN transfers actually rose would require RIPE's published transfer statistics as a denominator. This investigation did not use them.

Three further points, all conceded:

• ASN transfers are entirely lawful, and RIPE operates a legitimate published process for them.
• Small hosting businesses buy autonomous systems for ordinary commercial reasons.
• Seven events in five months is a small absolute number from which to infer a trend.

This dossier claims a documented cluster within a known population. Nothing more.

9. Track the broker, not the buyer

Six of seven buyers presented a fresh vanity maintainer that reveals nothing and connects to nothing. Investigating them one at a time yields seven separate dead ends.

The two records that do connect outward do so through an intermediary: a reseller handle already bridging three published investigations, and a German LIR sponsoring a Spanish holder.

If aged-ASN acquisition is a service being sold, then the sponsoring LIR and the reseller maintainer are the durable entities, and the buyers are inventory.

The proposal: promote sponsoring-LIR and maintainer handles to first-class tracked entities, and alert on their appearance against newly re-registered aged space — rather than continuing to investigate holders one at a time. [INFERRED — untested]

This is consistent with what this corpus already established elsewhere: the bulletproof economy is organised by supplier, not by operator.

10. Metadata

Sources

• RIPE NCC RIPEstat routing-status — 383 ASNs, measured 2026-07-26
• RIPE NCC RDAP — AS205759, AS200730, AS199428, AS198189, AS197769, AS197170, AS200912
• ARIN RDAP — validation of registration dates (AS5065, AS54801)
• Companies House via Lursoft — 124 City Road occupancy
• LSN threat_intel / dossier_intel; sweep script agedspace.py
• Part A · Part B · Part F · TI-2026-020B · TI-2026-026 · TI-2026-088

All seven holders are named as the registered parties of the autonomous systems indicated, per public RIR records. Acquiring aged address space is lawful and this dossier alleges no wrongdoing by any holder. Joel Krause and Alvaro Navas are rated LOW risk with zero adverse observations. The co-location of two US entities in Kentucky is explicitly recorded as an observation and NOT as a connection. RIPE NCC and the sponsoring LIR are named as structural facts; sponsoring transfers is exactly what an LIR lawfully does.