Paper Companies

One corporation with a paper trail, two addresses that sell themselves by the department, and four handles that appear nowhere

TI-2026-103G · Series: The Loud Hour · Letter G of 15 Operates under the rules of evidence in Letter O — The Instrument. This is the series' institutional-anchor pass: for every entity, what official structure does it rest on — RIR, registrar, regulator, financier, sanctions body, court? Per the series methodology, a documented absence of an anchor is itself a finding.

1. What this letter is for

Letter C established the registration layer: four of five beacon operators are natural persons or bare forenames, one prefix is registered to one individual and announced by another, and not one of the addresses has an agreed country. It could not establish whether those registrations were false, real-but-hollow, or simply unremarkable.

That question cannot be answered from inside a honeypot. It requires the documentary record — company registries, leak databases, regulatory filings, sanctions lists, and the published work of other researchers.

This letter goes there, and the results separate sharply. One of these operators has a substantial public paper trail, including a filing by a national government. Two of the addresses turn out to be commercial mass-registration facilities that sell themselves by the numbered department. And the four RIPE maintainer handles on which the series' only hard operator link depends appear in no public reporting whatsoever — which makes them the most valuable and least corroborated pivots in the entire investigation.

2. Private Layer INC: the one with a record

[DOCUMENTED] AS51852, operator of 179.43.139.58 — the largest single beacon in the corpus — is not an obscure entity. It appears in three independent institutional records.

RIPE's own anti-abuse working group

[DOCUMENTED] A presentation to the RIPE 77 Anti-Abuse Working Group, titled Criminal Abuse in RIPE IP space, lists AS51852 Private Layer, CH alongside AS9002 RETN, UA, under the observation that the IP space in question is "split between hosting companies operating from Panama, Switzerland, Belize, Russia, Iran." Source: https://ripe77.ripe.net/presentations/134-RIPE77_Anti_Abuse_WG.pdf

Two things follow. First, the regional internet registry's own abuse forum has named this autonomous system in a presentation about criminal abuse. Second — and this resolves an open question from Letter C — RIPE's presentation records the country as CH, not PA.

[DOCUMENTED] Letter C found a Panamanian corporation, at a Panamanian address, with a Panamanian administrative contact, publishing +41 43 508 2295 as its only voice contact, while AbuseIPDB geolocated its traffic to Switzerland and Cymru and BGP placed the ASN in Panama. Letter C declined to choose. The RIPE record, an independent third source, sides with Switzerland.

[INFERRED — confidence MEDIUM-HIGH] The Panamanian registration is the corporate wrapper; the operation is Swiss. This is now supported by the telephone number, the traffic geolocation, and a registry working-group document, against a registrant address and a BGP country code. Per R7 the disagreement remains the finding — but it is no longer a symmetric one.

A national government's filing

[DOCUMENTED] A submission in the United States Trade Representative docket USTR-2023-0009-0012, concerning pirate IPTV services, states:

*"Private Layer (AS 51852). The corporate structure of Private Layer is typical of a hosting provider claiming to be 'offshore' (also known as 'bullet-proof')."*

Source: https://downloads.regulations.gov/USTR-2023-0009-0012/attachment_1.pdf

[DOCUMENTED] This is the institutional anchor the series has been looking for, and it is unusually explicit: a filing in a US government rulemaking docket characterising this specific ASN's corporate structure as the typical form of a bulletproof host. It is a submission rather than a government finding, which bounds its weight — but it is on a public docket, and it names the AS number.

Contemporary research

[DOCUMENTED] A GreyNoise Labs report dated 2026-02-13 records AS51852 Private Layer INC with the assessment that "the bulletproof hosting label combined with exclusive CVE-2026-1281 exploitation suggests this is purpose-built attack infrastructure," noting minimal exposed attack surface. Source: https://www.labs.greynoise.io/grimoire/2026-02-13-weekly-oast-report/

[DOCUMENTED] Exclusive exploitation of a single CVE from one ASN is a strong attribution signal. CVE-2026-1281 is carried forward to Letter I, which takes the CVE dimension; it is noted here because it is the only CVE in the series so far tied to a specific beacon operator.

[DOCUMENTED] Routing scale, per bgp.he.net: 97 prefixes originated (95 IPv4, 2 IPv6), one internet exchange. This is a real network of meaningful size, not a single rented box.

Institutional anchor: PRESENT. Private Layer INC is a registered Panamanian corporation with a LACNIC allocation, a named administrative contact, 97 announced prefixes, and a documentary footprint spanning a RIR working group, a US trade docket, and current threat research. It is the only entity in this series of which that can be said.

3. 306 Victoria House: an address in the Paradise Papers

[DOCUMENTED] TechTies Inc. (AS197170), operator of the 105-node fleet, is registered at 306 Victoria House, Victoria, Mahé, Seychelles. That address is documented.

[DOCUMENTED] It appears in the ICIJ Offshore Leaks Database at two separate nodes:

Sources: https://offshoreleaks.icij.org/nodes/81024185, https://offshoreleaks.icij.org/nodes/235008

[DOCUMENTED] The same address carries, in UK Companies House records:

• TELECEL GLOBAL LIMITED (FC037185) — director's correspondence address
• York Global Limited (OE008053) — a registered overseas entity
• five UK-registered companies in total, per a Companies House-derived index

[DOCUMENTED] And it is used by at least one other hosting business: HOSTCAY publishes "Business Address: 306 Victoria House, Victoria, Mahé, Seychelles. Company Registration Number: 245535."

[INFERRED — confidence HIGH] 306 Victoria House is a registered-agent facility — a single Seychelles address serving as the registered office for many unrelated entities across at least sixteen years, including entities captured in the Appleby leak.

[DOCUMENTED] What this does not establish: any relationship between TechTies and any other entity at the address. Sharing a registered agent is not sharing an operator. Thousands of lawful companies use such facilities, and the Paradise Papers entities are from 2014 and earlier. The finding is about the form of TechTies' registration, not about its associates.

Institutional anchor: ABSENT in substance. A RIPE allocation exists, and a NOC handle (TIN51-RIPE, "TechTies Inc. 24x7 NOC") and a published geofeed at cdn.tech-ties.net present the appearance of an operating company. But the registered office is a mass-registration address, no corporate filing, LIR sponsor, regulator or financial record has been located, and the entity that announces 105 addresses of scanning infrastructure rests, on paper, on a numbered room in Victoria.

4. 43 Owston Road: a company factory that sells departments

[DOCUMENTED] Letter C inferred that w1n ltd's registered address — Dept 302, 43 Owston Road, Carcroft, Doncaster DN6 8DA — was "a mail-forwarding or virtual-office provider, not a datacentre," and marked it [INFERRED — confidence HIGH]. The documentary record confirms it.

[DOCUMENTED] UK Companies House and derived registries show the address subdivided into numbered departments across many unrelated entities:

[DOCUMENTED] Also registered at the address: CFS FORMATIONS LLP (OC351346) — a company formation agent. And a named individual, Bryan Anthony Thornton, appears as a resigned director at the address.

[INFERRED — confidence HIGH] 43 Owston Road is a commercial company-formation and registered-office facility. The "Dept NNNN" prefix is the provider's internal mailbox scheme, and the presence of a formation LLP at the same address identifies who operates it.

[DOCUMENTED] A coincidence requiring care: Blockchain Support Centre Ltd occupies the same Dept 302 that w1n ltd's RIPE object cites. This does not establish a relationship. A formation agent may reuse department numbers across time as clients come and go; a RIPE record may be stale; and two customers of one mailbox provider have no more connection than two customers of one post office. The coincidence is recorded because it will otherwise be discovered and over-read.

Institutional anchor: ABSENT. AS42237's RIPE registrant is a bare forename at a rented mailbox in a Doncaster suburb. PeeringDB lists the ASN as Cable/DSL/ISP with an Open peering policy — a self-description. No UK corporate registration for a "w1n ltd" matching the RIPE organisation has been located, and the abuse domain is Dutch while the ASN is British and the geolocation Swedish. This is a network with 461,966 recorded DShield attacks and no verifiable corporate existence.

[DOCUMENTED] A parallel worth noting: searching for the maintainer handles surfaced GLOBAL CONNECTIVITY SOLUTIONS LLP (ORG-GCSL7-RIPE, AS215540, UK registration OC450701) at Suite 310, 21 Hill Street, Haverfordwest, Pembrokeshire — announcing space adjacent to the Isaev prefix, and appearing in Letter E's admin/admin ASN list with four addresses. A UK LLP at a suite number in a Welsh market town is the same archetype as a forename at a Doncaster department. The pattern recurs; it is not particular to w1n.

5. Proton66: named, repeatedly, by everyone

[DOCUMENTED] Letter E identified 37.77.150.119 — 197 successful admin/admin authentications — as a beacon on AS198953, Proton66 OOO. Of all the entities in this series, this one has the densest research literature:

[DOCUMENTED] Institutional anchor: PRESENT as an adversary, ABSENT as a business. Proton66 is one of the most thoroughly documented bulletproof hosts in current reporting, and none of that reporting identifies a legitimate corporate structure behind it.

[DOCUMENTED] The relevant observation for this series is narrower and stranger. A provider documented for ransomware staging, mass exploitation and credential brute-forcing contributed, to this sensor, 197 successful logins on one credential and nothing else at all — no commands, no downloads. Letter F's division of labour holds even here: an address on notorious infrastructure behaved exactly like every other beacon, which is to say it did nothing.

6. The four handles that appear nowhere

[DOCUMENTED] The series' single hard operator link — Letter C's finding that 87.251.64.176 and 80.66.66.10 share the hand-authored RIPE maintainer ru-avm-1-mnt — rests on an artefact that returns no results in public reporting. The same is true of TechTies' mnt-bg-eurocrypt-1, and of the personal maintainers ISAEV-MNT and soldatov-av-mnt.

[DOCUMENTED] Targeted searches for these handles return only unrelated WHOIS mirror pages. No security vendor report, no CERT advisory, no academic paper, no journalism names them.

[INFERRED — confidence MEDIUM] Two readings, and they point opposite ways:

1. The handles are genuinely unexamined. Maintainer objects are low-salience metadata that most reporting ignores in favour of ASNs and prefixes. If so, ru-avm-1-mnt is a live, unworked pivot — and it is the most valuable object in this series, because it is operator-authored, it is not derived from any index, and it links two entities that every other source treats as unrelated.
2. The handles are unremarkable. A shared maintainer can indicate a shared LIR, a shared consultant, or one person who set up both allocations years ago and moved on. Absence from the literature would then reflect that there is nothing to report.

[DOCUMENTED] This letter cannot distinguish them, and the distinction matters more than any other open question in the series. What can be said is that the link itself is not in doubt — it is written in the registry — only its meaning.

### ⚠ RESOLVED — 2026-07-30. Reading 2 was correct. ru-avm-1-mnt is the maintainer object of a shared LIR — ORG-PMAV1-RIPE, org-name Aleksandr Valerevich Mokhonko, org-type: LIR, reg-nr recorded as "Not Applicable", Omsk — holding allocations in both 87.251.x and 80.66.x. 87.251.64.176 and 80.66.66.10 are customers of the same registry. Letter C's operator link is withdrawn. This letter named the correct answer and did not test it. Distinguishing the two readings required one RDAP entity lookup on the handle and one REST inverse lookup on the organisation — neither was run. The public-literature search that was run returned a true and irrelevant result: no reporting names the handle, but the registry does. **R16 — run a saturation control before reporting any absence — was written for enrichment linkages and applies to literature searches identically.** New rule R20: resolve every maintainer handle to its organisation before inferring operator identity, and run an inverse lookup to size what it controls. If it maintains an LIR organisation object or unrelated ranges, it is a sponsor — shared maintainer means shared sponsor until an LIR relationship is excluded. Full resolution: TI-2026-103P — The Sponsor.

[DOCUMENTED] One structural observation supports reading 1. The handle is labelled ru, for the Russian Federation. Neither registrant it controls is Russian by registered address; both are Kazakh. A Russian-labelled maintainer holding modification rights over two Kazakh-registered networks is a specific, checkable claim about who administers what, and it is the kind of claim that a shared-LIR explanation would have to account for rather than dissolve.

7. The sanctions pass

[DOCUMENTED] The OSINT library holds the OFAC Specially Designated Nationals list (PDF and consolidated XML, dated 2026-06-18), the EU Consolidated Sanctions List, and the UN Panel of Experts reports.

[DOCUMENTED] Searching those holdings for Soldatov, Isaev, Shesternin, Dyachenko, Private Layer, Omegatech and TechTies returns no name matches. The highest-scoring results are unrelated documents at keyword relevance 1.0–1.8 — Iranian and Russian entities with no connection to this investigation.

Finding: no sanctions exposure located for any entity in this series.

[DOCUMENTED] The method's limits must be stated with the result. A keyword search across large PDF and XML holdings is not a rigorous sanctions screen: it can miss transliteration variants, alternate spellings, entities listed under a parent, and any designation postdating the library's 2026-06-18 snapshot. A defensible screen queries the authoritative registers by exact name and date. This is a negative indication, not a clearance, and it is reported as such.

[INFERRED — confidence MEDIUM] Taken at its stated weight, the absence is still meaningful. Seven entities, several documented by name in threat research and one characterised as bulletproof in a US trade filing, carry no designation on any major sanctions instrument. The enforcement gap between "named in a government docket as bulletproof" and "designated" is where this entire business model lives, and Letter H pursues who could close it.

8. D12 — the library's sanctions folder contains mislabelled papers

Status: RESOLVED. Affects any conclusion drawn from library subcategory filters.

[DOCUMENTED] Two documents filed under Sanctions & Enforcement are not sanctions documents:

• Sanctions_Compliance_Cryptocurrency_2022.pdf is a machine-learning paper, Mask and Reason: Pre-Training Knowledge Graph Transformers for Complex Logical Queries.
• Crypto_Sanctions_Evasion_Techniques_2023.pdf contains a neural-network network-traffic state-prediction algorithm.

[DOCUMENTED] Both were returned as top-ranked hits for a sanctions query about named individuals, purely on filename and incidental keyword overlap.

[DOCUMENTED] A second, separate defect was found in the same operation. An initial search carrying the subcategory filter Sanctions & Enforcement — with the ampersand HTML-escaped — returned zero results. The identical query with a literal & returned six. The escaped ampersand silently produced an empty result set that could easily have been published as a negative finding.

Rule R15. Library subcategory filters are verified by confirming a non-empty control result before any absence is reported, and documents returned from a subcategory are checked to be of that category before being cited. A filter that returns nothing is assumed broken until shown otherwise.

This is the second silent-parameter defect in the series, after Letter O's D4 clamping. Both produced a plausible wrong answer with no error.

9. Three archetypes

[DOCUMENTED] Setting the documentary results against Letter C's registrations, the seven entities fall into three forms:

[INFERRED — confidence HIGH] The three forms are descending rungs of accountability, and the descent is the point. A Panamanian corporation with Swiss operations can at least be written to, served, or named in a trade filing — and has been. A Seychelles registered-agent address absorbs correspondence and forwards nothing. A private individual at a village house in North Kazakhstan is where a subpoena stops.

[DOCUMENTED] And the correlation with behaviour runs the other way from what one would expect. The entity with the most accountability, Private Layer, operates the largest beacon in the corpus (8,463 sessions). The entities with the least — two named individuals sharing a Russian-labelled maintainer — run the smallest and quietest. Accountability structure does not predict volume here, and Letter K takes what that implies about cost.

10. What this letter establishes

1. [DOCUMENTED] AS51852 Private Layer INC is named in a RIPE Anti-Abuse WG presentation on criminal abuse, in USTR docket USTR-2023-0009-0012 as structurally typical of bulletproof hosting, and in 2026 GreyNoise research as exclusively exploiting CVE-2026-1281.
2. [DOCUMENTED] RIPE's record gives Private Layer's country as CH, corroborating the Swiss telephone number and traffic geolocation against the Panamanian registration.
3. [DOCUMENTED] 306 Victoria House, Mahé appears in the ICIJ Offshore Leaks Database at two nodes, one from the Paradise Papers (Appleby), and hosts UK-registered overseas entities, a telecoms company and a second hosting business.
4. [DOCUMENTED] 43 Owston Road, Carcroft is a commercial formation facility subdividing into numbered departments, with formation agent CFS FORMATIONS LLP at the same address — confirming Letter C's inference from documentary sources.
5. [DOCUMENTED] Proton66 (AS198953) is documented as a Russian bulletproof host by five independent research organisations — and contributed 197 successful logins and nothing else.
6. [DOCUMENTED] ru-avm-1-mnt, mnt-bg-eurocrypt-1, ISAEV-MNT and soldatov-av-mnt appear in no public reporting. The series' only hard operator link is entirely uncorroborated externally. ⚠ CORRECTED 2026-07-30: the absence from reporting is real; the conclusion drawn beside it is not. There is no operator link. ru-avm-1-mnt belongs to a sponsoring LIR, and the series' count of demonstrated hard operator links is zero. See TI-2026-103P.
7. [DOCUMENTED] No sanctions designation located for any of the seven entities, with the method's limits stated.
8. [DOCUMENTED] D12 — two documents in the library's sanctions subcategory are mislabelled ML papers, and an HTML-escaped ampersand in a subcategory filter silently returns zero results.

11. What this letter could not establish

• Whether ru-avm-1-mnt is an operator, an LIR, or a decade-old administrative artefact. The most consequential open question in the series. §6 sets out both readings and cannot choose. Resolving it requires RIPE database history — which objects the handle has held over time — and that has not been retrieved. ⚠ RESOLVED 2026-07-30: it is an LIR. And it did not require database history — two live queries answered it. This item overestimated the cost of its own open question, which is why the question stayed open across seven further letters. See TI-2026-103P — The Sponsor.
• Any relationship between TechTies and the other entities at 306 Victoria House. Sharing a registered agent is not sharing an operator, and this letter asserts nothing further.
• Whether a "w1n ltd" corporate registration exists. Not located; absence of a search result is not absence of a company.
• A rigorous sanctions screen. §7's negative is a keyword result against a 2026-06-18 snapshot, not a clearance.
• Whether Private Layer's Swiss operation is the company's or a customer's. The RIPE, phone and geolocation evidence establishes Swiss presence, not who is in Switzerland. A bulletproof host's defining property is that its customers' activity is indistinguishable from its own.
• CVE-2026-1281's relationship to the beacon behaviour. GreyNoise ties the CVE to the ASN; nothing ties it to 179.43.139.58 specifically or to any beacon session in this corpus. Letter I tests it.

The last point deserves emphasis, because it is the most tempting bridge in this letter. An ASN documented as exclusively exploiting a CVE, and an address on that ASN beaconing at this sensor for four months, are two facts about the same autonomous system — not two facts about the same machine. The beacon has issued zero commands and exploited nothing here. Joining those findings would be the same error the series has already corrected twice.

Next: Letter H — The Ledger. Who sponsors these allocations, who could revoke them, and what happens when nobody does.