The Norwich Connection

Part 1: The Company in Norwich

World Host Group Ltd is registered at Companies House (UK Company #07099729). Its registered office: a business address in Norwich, Norfolk, England. WHG operates multiple hosting brands: Mochahost (US-marketed shared hosting), Doteasy (Canadian domain registration), HostforWeb (US dedicated servers). This is the public face — a legitimate hosting company with support desks, review sites, marketing campaigns.

But WHG also operates a global ASN network spanning four continents:

Why does a UK hosting company's "US East" ASN route through the UAE and South Africa?

Because "US East" is not a geographic description — it's a marketing label. AS14670 (WHG-USE1) handles IPs that claim to be in the US (abuse contacts point to US, WHOIS says US) but route through UAE and South Africa based on BGP announcements. The "location" in the ASN name has no relationship to where the traffic actually goes. This isn't unusual in hosting — but it's a specific enabler for geographic obfuscation.

Part 2: The "Private Customer" Pattern

Our database contains a distinctive signature for a subset of WHG IPs: the RDAP organization field reads simply "Private Customer".

The pattern is clear: WHG operates two tiers of service. The "named" tier (RDAP shows "WHG Hosting Services Ltd") routes through the UK. The "private" tier (RDAP shows "Private Customer") routes through UAE. Same ASN, different anonymity levels. The "private" tier consistently has higher threat scores.

Is "Private Customer" a legitimate hosting product, or a bulletproof anonymity service?

Legitimate hosting providers sometimes anonymize customer WHOIS data (GDPR compliance, for example). But when EVERY "Private Customer" IP has a threat score above 80, routes through a jurisdiction known for opaque business practices (UAE), and is actively attacking our infrastructure — "legitimate privacy service" becomes an insufficient explanation. At minimum, WHG's "Private Customer" tier appears to attract exclusively malicious operators. At maximum, it's marketed specifically to actors who need untraceable infrastructure.

Part 3: Enter HBING LIMITED

HBING LIMITED (UK Company #14936024) was incorporated on November 10, 2023. Its registered office uses a formation agent address. Its sole director is listed with a BVI (British Virgin Islands) service address. It operates AS208949.

On paper, HBING is independent of WHG — different company number, different ASN, different director. In practice:

Five independent signals. Any one alone might be coincidence. Together, they are dispositive: WHG and HBING share operators, share tools, share transit, and share marketplace sources. The two company numbers provide legal separation — if HBING's ASN gets null-routed for abuse, WHG's ASNs continue operating. If WHG faces regulatory action in the UK, HBING's BVI-directed structure provides jurisdictional escape.

Part 4: The UK Company Ecosystem

Companies House (the UK's corporate registry) makes it trivially easy to register companies. £12 fee, no identity verification beyond a name and address, formation agents handle everything. This has made the UK a global leader in corporate shell creation — including for cybercrime infrastructure.

The WHG/HBING pattern exploits this:

Why maintain two companies when one operator runs both?

Resilience and reputation laundering. If HBING's ASN gets blacklisted (it has — lir-vg-itweb-1-MNT objects have abuse complaints), traffic moves to WHG. If WHG's "Private Customer" tier gets scrutiny, it can point to its legitimate Mochahost/Doteasy brands as evidence of good-faith operations. Neither entity is the "real" one — they're both fronts for the same infrastructure, providing legal and reputational separation between the clean (shared hosting) and dirty (anonymous high-threat) tiers.

Part 5: The Routing Architecture

Our 24 WHG/HBING IPs route through a distinctive geographic pattern:

The pattern: the highest-threat IPs route through UAE and South Africa. The lower-threat IPs route through the UK. This suggests the UAE/ZA routing is specifically chosen for the most malicious operations — jurisdictions where abuse enforcement is weaker or slower than the UK.

Does the UAE or South African routing represent physical infrastructure in those countries?

Not necessarily. BGP announcements can be made from anywhere — you just need a transit provider in that country to accept and propagate the route. WHG may have physical servers in UAE/ZA data centers, or may simply have upstream transit agreements that allow announcing routes through those countries. Either way, the effect is the same: abuse reports go to UAE/ZA NOCs rather than UK ones, and enforcement timelines stretch from days to months.

Part 6: The Threat Score Gradient

Our data reveals an implicit service tier structure based on anonymity and threat level:

WHG doesn't need to advertise "bulletproof hosting." They just need to offer differentiated service tiers where the most anonymous tier happens to route through the least enforceable jurisdictions. Customers self-select: legitimate businesses choose the named UK-routed tier (TIER 3). Actors who need anonymity choose "Private Customer" with UAE routing (TIER 1). The infrastructure is the same. The operator is the same. Only the jurisdictional exposure differs.

Part 7: The British Gray Zone

WHG and HBING exist in a regulatory gray zone specific to UK hosting:

• UK Companies House requires minimal verification. HBING was registered in November 2023 with a BVI director — no questions asked.
• RIPE NCC (the European RIR) allocates IP resources to UK entities. WHG holds multiple RIPE allocations. HBING holds RIPE resources. Neither requires proof of how IPs are used.
• UK law enforcement can investigate UK companies. But WHG routes through UAE. HBING's director is in BVI. The actual servers may be in ZA data centers. Which police force investigates?
• Ofcom (UK telecoms regulator) has no jurisdiction over hosting company routing decisions or customer anonymity practices.

Is WHG breaking any UK law?

Probably not directly. Providing hosting infrastructure isn't illegal even if customers use it for attacks. The "Private Customer" anonymization may comply with GDPR (ironic — privacy regulation enabling attacker anonymity). UAE routing is a business decision, not a crime. The legal structure (multiple companies, multiple ASNs, BVI director) is entirely permissible under UK company law. WHG's defense would be: "We're a hosting company. We offer privacy-respecting services. We respond to valid legal process. What our customers do is their responsibility."

And technically, that defense holds. This is the gray zone: everything is legal, nothing is accountable, and our honeypot captures 243+ attack sessions from their infrastructure.

Part 8: Connecting Everything

The Geography of Nowhere series reveals a complete infrastructure stack for accountability-free Internet operations:

Conclusions

Series Complete

The Geography of Nowhere (TI-2026-028) — Five-part investigation complete.

• 028A — The Geography of Nowhere (Overview: geographic discrepancy as systemic feature)
• 028B — The LARUS Dossier (Hong Kong: LARUS/NRS governance capture)
• 028C — The Marketplace Economy (IPXO and the death of IP attribution)
• 028D — The African Question (AFRINIC resource capture as digital colonialism)
• 028E — The Norwich Connection (You are here — WHG/HBING UK gray zone)

Series Thesis

Geographic discrepancy is not a bug in Internet governance — it is the primary product of a mature infrastructure industry built to sever the connection between IP addresses and accountability. From AFRINIC governance capture (16M African IPs serving Asian cybercrime) through IP marketplaces (attribution structurally impossible) to UK hosting shells (legal everywhere, accountable nowhere), the Geography of Nowhere is the default architecture of modern malicious infrastructure.

Our honeypot observes the operational layer that governance debates, court proceedings, and policy papers cannot see: the mdrfckr deployments, the brute-force campaigns, the shared SSH keys that prove same-operator across supposedly independent companies. The gap between the legal fiction and the operational reality is the finding.