TI-2026-028D | Published: June 2026 | Series: The Geography of Nowhere | Classification: PUBLIC | Investigation: TI-2026-028
The African Question
AFRINIC, Resource Capture, and the Digital Colonization of Internet Governance
Part 1: What Is AFRINIC?
AFRINIC (African Network Information Centre) is one of five Regional Internet Registries (RIRs) that together manage the global allocation of IP addresses. Founded in 2004, headquartered in Mauritius, AFRINIC is responsible for allocating IPv4 and IPv6 address space to organizations in the African region โ 54 countries, 1.4 billion people.
The governance model is simple in principle: AFRINIC allocates IP resources to African organizations for use in Africa. This ensures the continent's growing Internet needs are served by resources reserved for the region. Without this protection, African IP space would be absorbed by richer markets where IPv4 scarcity has driven prices to $50+ per address.
What happens when a single entity acquires 16 million AFRINIC-allocated addresses and uses none of them in Africa?
You get the Cloud Innovation crisis โ the largest documented case of RIR allocation abuse, now entering its seventh year. A Seychelles-registered, Hong Kong-operated company holds 45.192.0.0/12 (a /12 โ the size of a small country's entire allocation). Our honeypot data shows these addresses routing through Seychelles, serving customers in Hong Kong, China, Russia, Japan, Turkey, Brazil โ everywhere except Africa. And when AFRINIC tried to reclaim the allocation, Cloud Innovation took them to court.
Part 2: The Governance Crisis Timeline
AFRINIC allocates IP resources to African ISPs, universities, governments, and enterprises. Cloud Innovation receives allocations during this period, nominally for African use. LARUS Limited (Hong Kong) is listed as technical manager.
AFRINIC staff discover that Cloud Innovation's allocations โ the largest single block in their registry โ show no evidence of African use. BGP analysis reveals the addresses route through Seychelles and are announced by Asian hosting providers. AFRINIC writes to Cloud Innovation requesting justification.
Rather than demonstrating African use or returning unused space, Cloud Innovation hires legal counsel and challenges AFRINIC's authority to audit or reclaim allocations. The argument: once allocated, IP addresses belong to the recipient. AFRINIC disagrees: allocations are subject to ongoing policy compliance.
AFRINIC's board experiences internal conflict. CEO Eddy Kayihura is suspended (later cleared). Multiple board members resign. The organization's governance structure becomes unstable โ creating an opening for external pressure. (Source: BTW Media)
The Number Resource Society appears at LARUS's address in Hong Kong. Its platform: IP addresses should be treated as property, not stewardship allocations. NRS begins contacting AFRINIC members, seeking signed powers of attorney โ documents that would allow NRS to vote on their behalf at AFRINIC meetings. (Source: CircleID)
The CircleID investigation reveals NRS's campaign in detail: approaching AFRINIC members (often small ISPs with limited governance understanding), seeking broad powers of attorney that would allow NRS to act on their behalf. The implications are extraordinary โ if enough members sign over voting rights, NRS could control AFRINIC policy votes.
Cloud Innovation files with the Mauritius Supreme Court to appoint a Receiver for AFRINIC โ effectively placing the registry under court-supervised external management. NRS's statement: "It was Cloud Innovation who applied to the court to appoint a Receiver for AFRINIC in 2023, with the aim of restoring good governance." The entity whose non-compliance triggered the crisis now seeks to control the entity that identified it.
The court addresses AFRINIC's governance turmoil, allowing elections to proceed. But the fundamental question โ can AFRINIC revoke Cloud Innovation's allocation? โ remains unresolved. Cloud Innovation continues to hold and commercially exploit 45.192.0.0/12. (Source: Internet Governance Project)
AFRINIC holds board elections. BTW Media profiles "8 men hoping to change AFRINIC." NRS-endorsed candidates participate. The election becomes a proxy battle between those who want stricter enforcement of regional use policies and those who want to liberalize allocations into permanent property. (Source: BTW Media, June 2025)
ICANN โ the global Internet governance body that oversees all five RIRs โ takes the unprecedented step of intervening directly to defend AFRINIC against Cloud Innovation's legal challenges. The Register characterizes this as "again" intervening โ meaning ICANN has acted multiple times. The stakes are now explicitly global: if AFRINIC's authority is broken, all RIRs' authority over allocation compliance is questioned. (Source: The Register, May 2026)
Cloud Innovation still holds 45.192.0.0/12. The IPs still route through Seychelles. Our honeypot still captures attacks from Yisu Cloud (Cloud Innovation's downstream) deploying the mdrfckr SSH key. The legal battle continues. The governance crisis continues. The exploitation continues.
Part 3: The Digital Colonialism Question
Is "digital colonialism" too strong a term for what's happening to AFRINIC?
Consider the facts: A Hong Kong company used a Seychelles shell to acquire 16 million IP addresses reserved for African development. Those addresses serve Asian and European commercial hosting. The African Internet community receives no benefit. When the African governance body (AFRINIC) tried to enforce compliance, the Hong Kong company used Western legal frameworks (Mauritius court, English common law) to challenge the African institution's authority. The company then attempted to place the African institution under external management via court-appointed Receiver.
This is the pattern of resource extraction: take from Africa, profit elsewhere, use legal frameworks to prevent the source community from reclaiming its resources. The resource happens to be IP addresses rather than minerals. The extraction method is corporate structuring rather than physical removal. But the dynamic is identical.
"AFRINIC exists to serve the African Internet community. Cloud Innovation's allocation serves no African community. The 16 million addresses could serve the entire university system of the continent, or provide public infrastructure to countries where Internet penetration is below 20%. Instead, they host botnets and bulletproof hosting for Asian gambling platforms."
But Cloud Innovation obtained the allocation through AFRINIC's own processes. Doesn't that make it legitimate?
AFRINIC allocations require a "justified need" in the African region. Cloud Innovation's original applications presumably claimed African use cases. The question is whether those claims were genuine or fabricated to obtain allocations that were always intended for non-African commercial exploitation. AFRINIC's 2020 review suggests the latter โ no evidence of African use was found. This would make the original allocation fraudulently obtained, not legitimately acquired.
But even granting legitimacy at acquisition โ AFRINIC's policies require ongoing compliance. Resources must continue serving the stated purpose. Cloud Innovation's position โ that allocation creates permanent property rights โ would eliminate all oversight. Any entity could obtain African IP space through fabricated justifications, then use it commercially forever without accountability.
Part 4: The "IP Ownership" Ideology
NRS's core advocacy position is that IP addresses should be treated as property โ owned permanently by their holders, not subject to ongoing compliance review. This sounds reasonable in isolation. Property rights are a foundation of economic systems. Why shouldn't IP addresses be property?
Because the Internet governance model is a commons management system, not a property market. IP addresses are a finite, shared resource โ like radio spectrum, or fishing rights, or water allocations. They work because users agree to rules: use addresses within your region, don't hoard unused space, respond to abuse reports. These rules make the Internet function.
What happens if IP addresses become "property" with no ongoing obligations?
The same thing that happens to any commons when property rights replace stewardship obligations: enclosure, concentration, and exclusion. Wealthy actors buy up addresses. Developing regions (Africa, Pacific Islands) that were reserved address space find it sold to the highest bidder. Abuse enforcement disappears โ "my property, my rules." Regional registries become purely administrative bodies with no authority. The Internet governance model that enabled global interoperability dissolves into a pure market.
This isn't speculation. It's what has already happened with Cloud Innovation: 16 million African addresses, commercially exploited, governance body unable to reclaim them, legal system weaponized to prevent enforcement.
Part 5: Who Benefits, Who Loses
| Beneficiary | Mechanism | Scale |
|---|---|---|
| Cloud Innovation / LARUS | Commercial leasing of 16M IPs to hosting providers | $50/IP/year ร 16M = $800M+ annual revenue potential |
| NRS | Governance influence โ policy changes protecting commercial interests | All future AFRINIC allocations become tradeable assets |
| Downstream operators (Yisu Cloud, Antbox, etc.) | Access to IP space without regional compliance obligations | Bulletproof hosting, botnet infrastructure, gambling platforms |
| IP marketplace operators (IPXO, etc.) | "Ownership" ideology expands pool of tradeable IPs | If AFRINIC space trades freely, global pool increases 30%+ |
| Victim | Mechanism | Scale |
|---|---|---|
| African ISPs and institutions | IP space reserved for them is commercially exploited elsewhere | 16M addresses = enough for continent's next decade of growth |
| AFRINIC as institution | Legal costs, governance instability, credibility damage | 6+ years of crisis, multiple board collapses |
| Internet governance system | Precedent that RIRs cannot enforce allocation policies | If AFRINIC loses, RIPE/ARIN/APNIC/LACNIC face same challenges |
| Global Internet security | 16M IPs with no effective abuse enforcement host botnets | mdrfckr, FatalRAT, gambling C2, credential stuffing farms |
| Our honeypot (literally) | Attacks from Cloud Innovation infrastructure | 20+ IPs, 243+ sessions, threat scores 51-100 |
Part 6: The ICANN Factor
ICANN's May 2026 intervention is extraordinary. ICANN typically respects RIR autonomy โ the principle of "bottom-up, multistakeholder governance" means each region manages itself. ICANN stepping in signals:
- The threat is existential โ Cloud Innovation's success would undermine the entire RIR system
- AFRINIC cannot defend itself alone โ the legal costs and governance instability require external support
- The precedent matters globally โ whatever the Mauritius court decides affects all five RIRs
Could Cloud Innovation actually win? Could a court rule that IP addresses are property?
Mauritius uses a mixed legal system (French civil law + English common law). Property rights are strong. Cloud Innovation's argument โ "we received these addresses through AFRINIC's own processes, they are ours" โ has superficial legal coherence. The counter-argument โ "allocations are conditional on compliance, like radio spectrum licenses" โ requires the court to understand Internet governance (a technical and policy framework unfamiliar to most judges). ICANN's intervention likely includes amicus briefs explaining the technical governance framework. But the outcome is genuinely uncertain.
The Stakes
If Cloud Innovation wins:
- Every RIR allocation becomes permanent property
- Policy compliance becomes unenforceable
- African IP space can be commercially exploited without limit
- Other entities will replicate the playbook: acquire RIR resources through minimal justifications, exploit commercially, litigate any enforcement
- The Internet governance model (community-managed commons) transitions to a pure market (whoever can afford lawyers wins)
If AFRINIC wins:
- RIR authority over allocation compliance is affirmed
- 16M IPs return to African use
- The governance capture playbook fails
- But: the legal battle has already cost AFRINIC years of stability and millions in legal fees
Part 7: What Our Honeypot Sees
While governance battles play out in courts and conferences, the infrastructure operates. Every day. Our honeypot captures it:
The gap between the legal argument and the operational reality could not be wider:
Legal position: "These are our property, allocated through legitimate processes, we have a right to use them as we see fit."
Operational reality: The mdrfckr botnet uses them to deploy cryptocurrency miners on compromised systems. FatalRAT command-and-control uses them to exfiltrate data. Brute-force scanners use them 24/7 to compromise SSH servers worldwide.
This is what "IP ownership without stewardship obligations" looks like in practice. Not a philosophical debate about property rights. A botnet.
Conclusions
1. This Is Resource Capture at Institutional Scale
CONFIDENCE: HIGH
Cloud Innovation's multi-year campaign โ legal challenges, NRS governance advocacy, board election interference, powers of attorney collection, court receiver applications โ is not a dispute over IP allocation. It is a systematic attempt to capture a continental Internet governance institution to permanently secure commercially-exploited resources. The playbook: acquire, exploit, litigate, capture.
2. The African Internet Community Is the Primary Victim
CONFIDENCE: HIGH
16 million addresses reserved for African development host cybercrime targeting the global Internet. No African institution, ISP, or user benefits. The governance crisis has consumed AFRINIC's resources and credibility for six years. Countries with sub-20% Internet penetration cannot access address space that was allocated for their development โ because it's being used for bulletproof hosting operated from Hong Kong.
3. ICANN's Intervention Signals Global Stakes
CONFIDENCE: HIGH
ICANN rarely intervenes in regional matters. Doing so (repeatedly, per The Register) signals that the global governance community recognizes the existential nature of this challenge. If Cloud Innovation's "IP ownership" argument succeeds in Mauritius, it creates precedent that undermines all five RIRs simultaneously.
4. Our Data Proves the Operational Reality
CONFIDENCE: HIGH
Governance debates are abstract. Honeypot sessions are not. Every mdrfckr deployment from Cloud Innovation's address space is a data point: this is what happens when 16 million addresses have no effective governance, no abuse enforcement, and no accountability. The "property rights" argument sounds principled until you see what the "property" is being used for.
Series Navigation
The Geography of Nowhere (TI-2026-028)
- 028A โ The Geography of Nowhere (Overview)
- 028B โ The LARUS Dossier
- 028C โ The Marketplace Economy
- 028D โ The African Question (You are here)
- 028E โ The Norwich Connection: WHG, HBING, and the British Gray Zone (Next)
โข TI-2026-028B โ The LARUS Dossier (LARUS/NRS at same address)
โข TI-2026-020D โ The Seychelles Veil (Seychelles as jurisdiction of convenience)
โข TI-2026-025 โ The SSH Parasite (mdrfckr on Cloud Innovation infrastructure)
โข The Register, May 2026 โ "ICANN again intervenes to defend AFRINIC"
โข CircleID โ "Registry Under Siege: Investigating NRS Outreach to AFRINIC Members"
Investigation TI-2026-028 | Data sources: LSN Honeypot, The Register, CircleID, Internet Governance Project, BTW Media, NRS.help, AFRINIC court filings
All data from direct observation or publicly available sources.