LSN โ€” Local Sovereign Network

TI-2026-028D | Published: June 2026 | Series: The Geography of Nowhere | Classification: PUBLIC | Investigation: TI-2026-028

The African Question

AFRINIC, Resource Capture, and the Digital Colonization of Internet Governance

Part 1: What Is AFRINIC?

AFRINIC (African Network Information Centre) is one of five Regional Internet Registries (RIRs) that together manage the global allocation of IP addresses. Founded in 2004, headquartered in Mauritius, AFRINIC is responsible for allocating IPv4 and IPv6 address space to organizations in the African region โ€” 54 countries, 1.4 billion people.

The governance model is simple in principle: AFRINIC allocates IP resources to African organizations for use in Africa. This ensures the continent's growing Internet needs are served by resources reserved for the region. Without this protection, African IP space would be absorbed by richer markets where IPv4 scarcity has driven prices to $50+ per address.

What happens when a single entity acquires 16 million AFRINIC-allocated addresses and uses none of them in Africa?

You get the Cloud Innovation crisis โ€” the largest documented case of RIR allocation abuse, now entering its seventh year. A Seychelles-registered, Hong Kong-operated company holds 45.192.0.0/12 (a /12 โ€” the size of a small country's entire allocation). Our honeypot data shows these addresses routing through Seychelles, serving customers in Hong Kong, China, Russia, Japan, Turkey, Brazil โ€” everywhere except Africa. And when AFRINIC tried to reclaim the allocation, Cloud Innovation took them to court.

Part 2: The Governance Crisis Timeline

2004-2019: Normal Operations
AFRINIC allocates IP resources to African ISPs, universities, governments, and enterprises. Cloud Innovation receives allocations during this period, nominally for African use. LARUS Limited (Hong Kong) is listed as technical manager.
2020: AFRINIC Notices the Problem
AFRINIC staff discover that Cloud Innovation's allocations โ€” the largest single block in their registry โ€” show no evidence of African use. BGP analysis reveals the addresses route through Seychelles and are announced by Asian hosting providers. AFRINIC writes to Cloud Innovation requesting justification.
2020-2021: Cloud Innovation Responds With Lawyers
Rather than demonstrating African use or returning unused space, Cloud Innovation hires legal counsel and challenges AFRINIC's authority to audit or reclaim allocations. The argument: once allocated, IP addresses belong to the recipient. AFRINIC disagrees: allocations are subject to ongoing policy compliance.
2021: AFRINIC Board Crisis
AFRINIC's board experiences internal conflict. CEO Eddy Kayihura is suspended (later cleared). Multiple board members resign. The organization's governance structure becomes unstable โ€” creating an opening for external pressure. (Source: BTW Media)
2021: NRS Emerges
The Number Resource Society appears at LARUS's address in Hong Kong. Its platform: IP addresses should be treated as property, not stewardship allocations. NRS begins contacting AFRINIC members, seeking signed powers of attorney โ€” documents that would allow NRS to vote on their behalf at AFRINIC meetings. (Source: CircleID)
2022: Powers of Attorney Campaign
The CircleID investigation reveals NRS's campaign in detail: approaching AFRINIC members (often small ISPs with limited governance understanding), seeking broad powers of attorney that would allow NRS to act on their behalf. The implications are extraordinary โ€” if enough members sign over voting rights, NRS could control AFRINIC policy votes.
2023: Cloud Innovation Applies for Receiver
Cloud Innovation files with the Mauritius Supreme Court to appoint a Receiver for AFRINIC โ€” effectively placing the registry under court-supervised external management. NRS's statement: "It was Cloud Innovation who applied to the court to appoint a Receiver for AFRINIC in 2023, with the aim of restoring good governance." The entity whose non-compliance triggered the crisis now seeks to control the entity that identified it.
2024: Mauritius Supreme Court Addresses Governance
The court addresses AFRINIC's governance turmoil, allowing elections to proceed. But the fundamental question โ€” can AFRINIC revoke Cloud Innovation's allocation? โ€” remains unresolved. Cloud Innovation continues to hold and commercially exploit 45.192.0.0/12. (Source: Internet Governance Project)
June 2025: AFRINIC Elections
AFRINIC holds board elections. BTW Media profiles "8 men hoping to change AFRINIC." NRS-endorsed candidates participate. The election becomes a proxy battle between those who want stricter enforcement of regional use policies and those who want to liberalize allocations into permanent property. (Source: BTW Media, June 2025)
May 2026: ICANN Intervenes
ICANN โ€” the global Internet governance body that oversees all five RIRs โ€” takes the unprecedented step of intervening directly to defend AFRINIC against Cloud Innovation's legal challenges. The Register characterizes this as "again" intervening โ€” meaning ICANN has acted multiple times. The stakes are now explicitly global: if AFRINIC's authority is broken, all RIRs' authority over allocation compliance is questioned. (Source: The Register, May 2026)
June 2026: Still Ongoing
Cloud Innovation still holds 45.192.0.0/12. The IPs still route through Seychelles. Our honeypot still captures attacks from Yisu Cloud (Cloud Innovation's downstream) deploying the mdrfckr SSH key. The legal battle continues. The governance crisis continues. The exploitation continues.

Part 3: The Digital Colonialism Question

Is "digital colonialism" too strong a term for what's happening to AFRINIC?

Consider the facts: A Hong Kong company used a Seychelles shell to acquire 16 million IP addresses reserved for African development. Those addresses serve Asian and European commercial hosting. The African Internet community receives no benefit. When the African governance body (AFRINIC) tried to enforce compliance, the Hong Kong company used Western legal frameworks (Mauritius court, English common law) to challenge the African institution's authority. The company then attempted to place the African institution under external management via court-appointed Receiver.

This is the pattern of resource extraction: take from Africa, profit elsewhere, use legal frameworks to prevent the source community from reclaiming its resources. The resource happens to be IP addresses rather than minerals. The extraction method is corporate structuring rather than physical removal. But the dynamic is identical.

"AFRINIC exists to serve the African Internet community. Cloud Innovation's allocation serves no African community. The 16 million addresses could serve the entire university system of the continent, or provide public infrastructure to countries where Internet penetration is below 20%. Instead, they host botnets and bulletproof hosting for Asian gambling platforms."

But Cloud Innovation obtained the allocation through AFRINIC's own processes. Doesn't that make it legitimate?

AFRINIC allocations require a "justified need" in the African region. Cloud Innovation's original applications presumably claimed African use cases. The question is whether those claims were genuine or fabricated to obtain allocations that were always intended for non-African commercial exploitation. AFRINIC's 2020 review suggests the latter โ€” no evidence of African use was found. This would make the original allocation fraudulently obtained, not legitimately acquired.

But even granting legitimacy at acquisition โ€” AFRINIC's policies require ongoing compliance. Resources must continue serving the stated purpose. Cloud Innovation's position โ€” that allocation creates permanent property rights โ€” would eliminate all oversight. Any entity could obtain African IP space through fabricated justifications, then use it commercially forever without accountability.

Part 4: The "IP Ownership" Ideology

NRS's core advocacy position is that IP addresses should be treated as property โ€” owned permanently by their holders, not subject to ongoing compliance review. This sounds reasonable in isolation. Property rights are a foundation of economic systems. Why shouldn't IP addresses be property?

Because the Internet governance model is a commons management system, not a property market. IP addresses are a finite, shared resource โ€” like radio spectrum, or fishing rights, or water allocations. They work because users agree to rules: use addresses within your region, don't hoard unused space, respond to abuse reports. These rules make the Internet function.

What happens if IP addresses become "property" with no ongoing obligations?

The same thing that happens to any commons when property rights replace stewardship obligations: enclosure, concentration, and exclusion. Wealthy actors buy up addresses. Developing regions (Africa, Pacific Islands) that were reserved address space find it sold to the highest bidder. Abuse enforcement disappears โ€” "my property, my rules." Regional registries become purely administrative bodies with no authority. The Internet governance model that enabled global interoperability dissolves into a pure market.

This isn't speculation. It's what has already happened with Cloud Innovation: 16 million African addresses, commercially exploited, governance body unable to reclaim them, legal system weaponized to prevent enforcement.

THE COMMONS DESTRUCTION PATTERN: โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” STEP 1: Acquire resource under commons rules โ†’ Cloud Innovation gets AFRINIC allocation (claiming African use) STEP 2: Exploit resource commercially outside commons framework โ†’ Lease IPs to Asian hosting, bulletproof services, botnet operators STEP 3: When commons enforcer objects, claim "property rights" โ†’ Sue AFRINIC in Mauritius court, claim permanent ownership STEP 4: Create governance arm to change the commons rules โ†’ NRS advocates for "IP ownership," seeks board seats, collects PoA STEP 5: If possible, capture the commons governance body itself โ†’ Apply to court for Receiver appointment over AFRINIC STEP 6: Once captured, formalize the extraction as legitimate โ†’ Change policies to eliminate regional use requirements โ†’ Make all allocations permanent and unreviewable โ†’ Commons ceases to exist; market replaces stewardship

Part 5: Who Benefits, Who Loses

BeneficiaryMechanismScale
Cloud Innovation / LARUSCommercial leasing of 16M IPs to hosting providers$50/IP/year ร— 16M = $800M+ annual revenue potential
NRSGovernance influence โ†’ policy changes protecting commercial interestsAll future AFRINIC allocations become tradeable assets
Downstream operators (Yisu Cloud, Antbox, etc.)Access to IP space without regional compliance obligationsBulletproof hosting, botnet infrastructure, gambling platforms
IP marketplace operators (IPXO, etc.)"Ownership" ideology expands pool of tradeable IPsIf AFRINIC space trades freely, global pool increases 30%+
VictimMechanismScale
African ISPs and institutionsIP space reserved for them is commercially exploited elsewhere16M addresses = enough for continent's next decade of growth
AFRINIC as institutionLegal costs, governance instability, credibility damage6+ years of crisis, multiple board collapses
Internet governance systemPrecedent that RIRs cannot enforce allocation policiesIf AFRINIC loses, RIPE/ARIN/APNIC/LACNIC face same challenges
Global Internet security16M IPs with no effective abuse enforcement host botnetsmdrfckr, FatalRAT, gambling C2, credential stuffing farms
Our honeypot (literally)Attacks from Cloud Innovation infrastructure20+ IPs, 243+ sessions, threat scores 51-100

Part 6: The ICANN Factor

ICANN's May 2026 intervention is extraordinary. ICANN typically respects RIR autonomy โ€” the principle of "bottom-up, multistakeholder governance" means each region manages itself. ICANN stepping in signals:

  1. The threat is existential โ€” Cloud Innovation's success would undermine the entire RIR system
  2. AFRINIC cannot defend itself alone โ€” the legal costs and governance instability require external support
  3. The precedent matters globally โ€” whatever the Mauritius court decides affects all five RIRs

Could Cloud Innovation actually win? Could a court rule that IP addresses are property?

Mauritius uses a mixed legal system (French civil law + English common law). Property rights are strong. Cloud Innovation's argument โ€” "we received these addresses through AFRINIC's own processes, they are ours" โ€” has superficial legal coherence. The counter-argument โ€” "allocations are conditional on compliance, like radio spectrum licenses" โ€” requires the court to understand Internet governance (a technical and policy framework unfamiliar to most judges). ICANN's intervention likely includes amicus briefs explaining the technical governance framework. But the outcome is genuinely uncertain.

The Stakes

If Cloud Innovation wins:

  • Every RIR allocation becomes permanent property
  • Policy compliance becomes unenforceable
  • African IP space can be commercially exploited without limit
  • Other entities will replicate the playbook: acquire RIR resources through minimal justifications, exploit commercially, litigate any enforcement
  • The Internet governance model (community-managed commons) transitions to a pure market (whoever can afford lawyers wins)

If AFRINIC wins:

  • RIR authority over allocation compliance is affirmed
  • 16M IPs return to African use
  • The governance capture playbook fails
  • But: the legal battle has already cost AFRINIC years of stability and millions in legal fees

Part 7: What Our Honeypot Sees

While governance battles play out in courts and conferences, the infrastructure operates. Every day. Our honeypot captures it:

CLOUD INNOVATION INFRASTRUCTURE โ€” OPERATIONAL ACTIVITY (JUNE 2026) โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” Total unique IPs from Cloud Innovation AFRINIC space: 20+ Total sessions captured: 243+ Highest individual threat score: 100/100 Malware deployments observed: mdrfckr SSH key (persistence mechanism) Behavioral classification: BOTNET (automated, persistent, systematic) THESE IPs COME FROM: 45.192.0.0/12 โ€” Cloud Innovation's AFRINIC allocation Allocated for: "African Internet development" Actually used for: Botnet infrastructure, SSH brute-force, crypto-mining THE SEYCHELLES PHONE: +248-4-610-795 Appears as abuse contact for ALL Cloud Innovation IPs This single phone number spans: 22 IPs, 15 ASNs, 8 claimed countries (JP, RU, TR, BR, US, HK, SG, IN) Every single one routes through Seychelles (cymru_country=SC) None serves any African purpose whatsoever

The gap between the legal argument and the operational reality could not be wider:

Legal position: "These are our property, allocated through legitimate processes, we have a right to use them as we see fit."

Operational reality: The mdrfckr botnet uses them to deploy cryptocurrency miners on compromised systems. FatalRAT command-and-control uses them to exfiltrate data. Brute-force scanners use them 24/7 to compromise SSH servers worldwide.

This is what "IP ownership without stewardship obligations" looks like in practice. Not a philosophical debate about property rights. A botnet.

Conclusions

1. This Is Resource Capture at Institutional Scale

CONFIDENCE: HIGH

Cloud Innovation's multi-year campaign โ€” legal challenges, NRS governance advocacy, board election interference, powers of attorney collection, court receiver applications โ€” is not a dispute over IP allocation. It is a systematic attempt to capture a continental Internet governance institution to permanently secure commercially-exploited resources. The playbook: acquire, exploit, litigate, capture.

2. The African Internet Community Is the Primary Victim

CONFIDENCE: HIGH

16 million addresses reserved for African development host cybercrime targeting the global Internet. No African institution, ISP, or user benefits. The governance crisis has consumed AFRINIC's resources and credibility for six years. Countries with sub-20% Internet penetration cannot access address space that was allocated for their development โ€” because it's being used for bulletproof hosting operated from Hong Kong.

3. ICANN's Intervention Signals Global Stakes

CONFIDENCE: HIGH

ICANN rarely intervenes in regional matters. Doing so (repeatedly, per The Register) signals that the global governance community recognizes the existential nature of this challenge. If Cloud Innovation's "IP ownership" argument succeeds in Mauritius, it creates precedent that undermines all five RIRs simultaneously.

4. Our Data Proves the Operational Reality

CONFIDENCE: HIGH

Governance debates are abstract. Honeypot sessions are not. Every mdrfckr deployment from Cloud Innovation's address space is a data point: this is what happens when 16 million addresses have no effective governance, no abuse enforcement, and no accountability. The "property rights" argument sounds principled until you see what the "property" is being used for.

Series Navigation

The Geography of Nowhere (TI-2026-028)

๐Ÿ“Ž Related investigations:
โ€ข TI-2026-028B โ€” The LARUS Dossier (LARUS/NRS at same address)
โ€ข TI-2026-020D โ€” The Seychelles Veil (Seychelles as jurisdiction of convenience)
โ€ข TI-2026-025 โ€” The SSH Parasite (mdrfckr on Cloud Innovation infrastructure)
โ€ข The Register, May 2026 โ€” "ICANN again intervenes to defend AFRINIC"
โ€ข CircleID โ€” "Registry Under Siege: Investigating NRS Outreach to AFRINIC Members"

Investigation TI-2026-028 | Data sources: LSN Honeypot, The Register, CircleID, Internet Governance Project, BTW Media, NRS.help, AFRINIC court filings
All data from direct observation or publicly available sources.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Geography of Nowhere โ€” 4 / 8 Next โ†’