Who Goes Loud

Four named individuals, one mail drop, and a Panamanian company with a Swiss telephone

TI-2026-103C · Series: The Loud Hour · Letter C of 15 Operates under the rules of evidence in Letter O — The Instrument. Per R7, where enrichment sources disagree the disagreement is reported as the finding. Per R8, a derived index's silence is evidence about the index, not the world.

### ⚠ CORRECTION — 2026-07-30 Section 4 of this letter is withdrawn. The shared RIPE maintainer ru-avm-1-mnt was read here as an operator link between 87.251.64.176 and 80.66.66.10. It is the maintainer object of a Local Internet Registry — ORG-PMAV1-RIPE, org-type: LIR — which holds allocations in both 87.251.x and 80.66.x. **The two addresses are customers of the same registry, not demonstrably machines under one operator.** The two behavioural signals in §4 (campaign hassh-eff4c24daffc8532 and actor_cluster_014) are unaffected and still stand. Full resolution: TI-2026-103P — The Sponsor. The original text below is retained unaltered.

1. What this letter is for

Letter B established that five machines hold 72.2% of every successful login this sensor has ever granted, and that none of them has ever run a command. It left open whether those five are one operator or five, and observed that their credential proportions argued for independence while their credential set argued for a shared origin.

This letter goes to the registrations. It finds something the behavioural data could not: two of the five are hard-linked by an object one of their operators wrote by hand.

It also finds that the "named individual ASN" — a private person, at a residential or commercial street address, holding an autonomous system number — is not an oddity in this record. It is the dominant registration form, appearing in four of five cases, and in one case three times over within a single address's provenance.

2. The five registrations

[DOCUMENTED] All values below are RDAP and BGP data with recorded as_of timestamps in the enrichment store, retrieved 2026-07-24 to 2026-07-30.

179.43.139.58 — the only company

[DOCUMENTED] A Panamanian corporation, with a Panamanian administrative contact at a Panamanian address, publishes a Swiss telephone number as its only voice contact — and AbuseIPDB geolocates its traffic to Switzerland while Cymru and BGP place it in Panama.

[INFERRED — confidence MEDIUM] The Swiss number and the Swiss geolocation are consistent with operations conducted from Switzerland behind a Panamanian registration. They are equally consistent with a Panamanian company using a Swiss VoIP number and Swiss transit. The record does not choose, and Letter H's institutional-anchor pass is where this is pursued.

185.246.128.133 — the mail drop

[DOCUMENTED] The registrant of this network is recorded as a bare forename. Not a company, not a person with a surname — "Anastasiia", typed into an organisation field.

[DOCUMENTED] The address is a Dept-numbered unit on Owston Road, Carcroft. [INFERRED — confidence HIGH] "Dept 302" at a single street address is the format of a mail-forwarding or virtual-office provider, not of a datacentre. A network announcing a /24 and generating 461,966 recorded attacks does not operate from a numbered mail department in a Doncaster suburb; the address is a correspondence point.

The four-way spread is total: a British address, a Ukrainian telephone number, a Dutch abuse domain, and Swedish geolocation on a British-registered ASN.

[DOCUMENTED] Shodan reports ports 135 and 445 open — a Windows host. Every other machine in this letter presents SSH. Letter D takes what that implies about the tooling.

87.251.64.176 — three names on one address

[DOCUMENTED] The prefix 87.251.64.0/24 is registered to one named individual and announced by a different one. Isaev holds the RIPE object; Shesternin's autonomous system carries the routes. Both are private persons.

[DOCUMENTED] Four sources give four different countries for one address.

80.66.66.10 — the village

[DOCUMENTED] The registered address of this autonomous system is a house number on a street in a village in the North Kazakhstan steppe. Four sources give four countries.

[DOCUMENTED] Its threat score is 59.4 and its abuse-report count is six, against 100 and thousands for the others — while its behaviour is identical: 198 sessions, 198 successes, one credential, zero commands. Letter N takes the detection consequence, which is blunt: reputation scoring does not see this class at all.

94.154.35.215 — the entrepreneur

[DOCUMENTED] A Seychelles-registered company; a Ukrainian sole trader as registrant; a different Ukrainian individual as contact; a Ukrainian broadband network object; Dutch geolocation. This infrastructure is already the subject of published work — see The Omegatech Empire (TI-2026-024C) — and the finding recorded there, that the corporate layer is a shell, is consistent with everything above.

3. The pattern: the ASN as a personal possession

[DOCUMENTED] Of the five registrations, four resolve to a natural person or a bare personal name rather than to a functioning corporate entity:

And the count rises to five once the announcement layer is included: 87.251.64.176's routes are carried by Shesternin Vladimir Anatolievich, a sixth name.

[DOCUMENTED] Registered addresses include a village house in North Kazakhstan, a street address in Almaty, and a numbered mail department in a Doncaster suburb.

[INFERRED — confidence HIGH] An autonomous system is an institutional object. It requires an LIR relationship, a membership fee, and a contractual counterparty. When the registrant of one is a forename with no surname, and the registered premises are a village house, the institutional layer that should sit behind the network is not where the paperwork says it is. This is not evidence of criminality on the registrant's part — a name in RIPE may belong to a person who sold their identity, lent it, or never knew it was used. It is evidence that the accountability chain terminates at a person who cannot bear it, which is precisely what the arrangement is for.

Letter H runs the institutional-anchor pass properly: who the LIR is, who sponsored each allocation, and whether any regulator, registrar or law-enforcement record attaches. Per the series methodology, a documented absence of an anchor is itself a finding.

4. The hard link ⚠ withdrawn

This section's conclusion is withdrawn — see the correction notice above. The registry observation is accurate; the inference drawn from it is not. Text retained as published.

Everything to this point is pattern. This is evidence.

[DOCUMENTED] 87.251.64.176 and 80.66.66.10 list the same RIPE maintainer object:

87.251.64.176   maintainers:  ISAEV-MNT        +  ru-avm-1-mnt
80.66.66.10     maintainers:  soldatov-av-mnt  +  ru-avm-1-mnt

Each carries a personal maintainer matching its own registrant — and both carry ru-avm-1-mnt, which matches neither.

A RIPE maintainer object is not enrichment, not inference, and not a third party's opinion. It is an access-control object created and named by an operator, and its presence on two networks means one party holds modification rights over both. Nothing in the derived intelligence graph produced this link; it is written in the registry by the people who run these networks.

[DOCUMENTED] The two addresses are corroborated as related by two further, independent signals: both carry campaign hassh-eff4c24daffc8532, and both carry actor_cluster_014.

Three independent signals — a hand-written registry object, an SSH client fingerprint, and a behavioural cluster — agree that Isaev and Soldatov are not separate operations. [DOCUMENTED], confidence HIGH.

⚠ CORRECTED. The signals are not three but two. ru-avm-1-mnt is a sponsoring LIR's maintainer object, and an LIR maintains the registry objects of every resource it sponsors as routine administration — so its presence on two networks means one party holds modification rights over both records, not over both machines. The corrected reading: Isaev and Soldatov are customers of the same Russian LIR. That explains why their registry objects look alike and why their allocations sit where they do. The fingerprint and the cluster are behavioural, remain untouched, and are now the only evidence linking the pair. Confidence on "not separate operations" drops from HIGH to MEDIUM.

[INFERRED — confidence MEDIUM] The handle ru-avm-1-mnt follows the RIPE convention of a country prefix and an operator token: ru for the Russian Federation, avm as initials or a brand. Neither named registrant is Russian by registered address; both are Kazakh. The maintainer that controls both is labelled Russian. Letter G pursues the token; this letter records only that the shared object is labelled for a third jurisdiction neither registrant sits in.

⚠ RESOLVED, and the inference was right. The token does decode as initials: avm = Aleksandr Valerevich Mokhonko, the org-name on ORG-PMAV1-RIPE, whose allocations use the matching netname convention RU-AVM-<date>. The Russian label on a maintainer above two Kazakh registrants is explained by the sponsor being a Russian LIR — which is also why it links them without either of them operating the other.

What the link does and does not establish

It establishes that two of the five beacons share an operator or an administrator.

⚠ CORRECTED to: it establishes that two of the five beacons share a sponsoring registry. The irony is that this section then warns, correctly, that a shared HASSH is a shared toolchain and "nothing more, until an operator-authored artefact corroborates it" — while treating a maintainer handle as the operator-authored artefact. A maintainer object is hand-authored; it is simply authored by the sponsor, not by the tenant.

It does not establish that all five do. 179.43.139.58, 185.246.128.133 and 94.154.35.215 carry no shared maintainer with each other or with the pair. Their observed association is behavioural — 179.43.139.58 and 94.154.35.215 share campaign hassh-a7a87fbe86774c2e — and a shared HASSH identifies the SSH client library, not the operator. That distinction has already caused one published error in this corpus and is treated as settled: a shared fingerprint is a shared toolchain, and nothing more, until an operator-authored artefact corroborates it.

So the corrected picture from Letter B is:

Letter B's five independent machines are at most four operations, and possibly fewer. But only one merger is presently evidenced.

5. Four rebrands

[DOCUMENTED] The enrichment pipeline's entity-resolution stage returns a verdict of rebrand for four of the five autonomous systems examined here: TechTies (197170, the Species II fleet), Soldatov (209702), w1n (42237) and Shesternin (212835).

Per R8, this is reported with its provenance attached: rebrand is a derived verdict from a resolver, not an observation. It means the resolver matched the current AS name against a prior identity for the same number. It is evidence about naming continuity, and it is worth exactly as much as the resolver's inputs — which this letter has not audited.

[INFERRED — confidence LOW, pending Letter G] If the verdicts hold, then the ASNs behind this record have a history of changing what they are called while retaining their number and their routes. That is the documented signature of the bulletproof-hosting business model, in which the number is the durable asset and the name is disposable. It is also the ordinary signature of a hosting company being acquired. Letter G tests these against the OSINT library and historical records; nothing is concluded here.

6. Old addresses beacon, new addresses burst

[DOCUMENTED] The RDAP event records give each prefix an allocation date and a last-modified date. Set against the behavioural classes from Letters A and B, they separate cleanly:

[DOCUMENTED] The three beacon prefixes were allocated between 2021 and 2023 and were three to four and a half years old when this record first observed them. The Species II burst fleet's prefix was allocated 2025-07-17 — eleven months before its first appearance in the corpus on 2026-06-15.

[INFERRED — confidence MEDIUM] Aged IPv4 space is a scarce, transferable asset with accumulated reputation; freshly allocated space is cheap, plentiful and disposable. The division here maps onto function rather than onto operator: the machines that must keep working for months sit on old, reputable space, and the machines that fire off 762 attempts and rotate sit on new space. That is what an operator does when the two jobs have different tolerance for being blocked.

The alternative reading is that this is coincidence across a sample of four prefixes, which is entirely possible at n=4. What makes it worth recording is the direction: the correlation runs the way an economic argument predicts, and Letter K tests whether cost structure explains more of this record than intent does.

[DOCUMENTED] All four prefixes were modified recently — between 2025-12-09 and 2026-06-20. None is an abandoned allocation drifting unmaintained. Somebody is keeping the paperwork current on every one of them, including the village house in North Kazakhstan.

7. The disagreement is the finding

[DOCUMENTED] Every one of the five addresses produces a different country depending on which source is asked:

[DOCUMENTED] Not one of the five has a single agreed country. The best case disagrees two ways; the worst, 80.66.66.10, disagrees four.

These are not competing errors to be adjudicated. They measure different things: Cymru reports the AS registration's country, AbuseIPDB reports where reporters observed traffic, BGP reports the routing origin's registration, and the RIPE object reports what the registrant typed. A four-way disagreement means the registration, the routing, the observation and the paperwork have been deliberately decoupled — which is the point of the arrangement.

Any single-country attribution of this infrastructure — in a blocklist, a report, or a map — is choosing one of four answers and discarding the finding. This series does not do that, and the table above is published in preference to a conclusion.

7. What this letter establishes

1. [DOCUMENTED] Four of five registrants are natural persons or bare forenames; a sixth named individual appears in the announcement layer.
2. [DOCUMENTED] Registered premises include a village house, a residential street, and a numbered mail department.
3. [DOCUMENTED] ru-avm-1-mnt is a shared, hand-authored RIPE maintainer linking 87.251.64.176 and 80.66.66.10, corroborated by HASSH and cluster membership. ⚠ CORRECTED 2026-07-30: the maintainer belongs to a sponsoring LIR (ORG-PMAV1-RIPE, org-type: LIR) holding space in both 87.251.x and 80.66.x. It links the two addresses as customers of one registry. The HASSH and cluster corroboration stands on its own; the registry component of this finding does not. See TI-2026-103P.
4. [DOCUMENTED] 87.251.64.0/24 is registered to Isaev and announced by Shesternin.
5. [DOCUMENTED] No address in the set has an agreed country; one disagrees four ways.
6. [DOCUMENTED] The lowest-reputation member (80.66.66.10, threat 59.4, six abuse reports) behaves identically to the highest. Reputation does not discriminate this class.
7. [DOCUMENTED] 185.246.128.133 presents Windows ports 135/445 where the rest present SSH.

8. What this letter could not establish

• Whether the named registrants are participants, sellers of identity, or victims of it. Nothing here distinguishes them, and this series will not imply criminality of a named private individual on registration data alone. The finding is about the structure, not the person.
• Who or what ru-avm-1-mnt is. The link is solid; the identity behind it is not established. It is the highest-value open pivot in the series. ⚠ RESOLVED 2026-07-30 — and resolving it broke the link. The maintainer is the object of RIPE LIR ORG-PMAV1-RIPE, org-name Aleksandr Valerevich Mokhonko, reg-nr recorded as the literal string "Not Applicable", admin/tech contact Aleksei Balalaev of Novosibirsk. Two queries — an RDAP entity lookup and a REST inverse lookup — were enough. This letter called the link solid and the identity open; the identity is what determined that the link was not solid. See TI-2026-103P — The Sponsor.
• Whether Private Layer, w1n and Omegatech share an operator with each other or with the linked pair. Presently: no evidence either way. HASSH association is toolchain-level and is not treated as attribution.
• Whether the four rebrand verdicts reflect bulletproof-hosting churn or ordinary corporate succession. Letter G.
• Whether any of these registrations is simply false. RDAP records what a registrant typed. A village address may be a real village address, or a plausible string. Verifying either requires sources outside this corpus, and Letter H attempts it.

The temptation this letter refuses is the composite portrait: five offshore registrations, four named individuals, a mail drop, a shell in the Seychelles and a Panamanian company answering a Swiss phone assemble very readily into a single criminal enterprise. One merger is evidenced. The rest is a pattern in how this kind of infrastructure is registered — which is a finding about an industry, not about a conspiracy.

Next: Letter D — The Recipe. Seven hundred and sixty-two attempts, twenty doors, one question asked of each.