The Compliance Theater

Every IP allocation requires an abuse contact. Every abuse contact receives reports. The system assumes these reports create accountability. But when 11,324 shared abuse phone relationships and 3,873 shared email clusters point to contacts that collectively receive hundreds of thousands of reports without meaningful action, the system is performing a ritual rather than a function.

The Per-IP Champions

Reports-per-IP reveals the truly unresponsive:

PROSPERO OOO: 102,008 reports for a single IP address. One hundred thousand abuse reports. For one server. Still online. This isn't negligence — it's a business model. The reports are the product's proof-of-concept: "host with us, and no amount of complaints will take you down."

ISAEV Igor: 264,349 reports across 8 IPs (33,044 per IP). An individual person named in RDAP as the responsible contact for infrastructure generating a quarter-million abuse reports. Either this person doesn't exist, doesn't care, or considers abuse reports as a metric of customer satisfaction.

TECHOFF SRV LIMITED: 165,706 reports across 8 IPs (20,713 per IP). Previously documented in TI-2026-057F as part of the Seychelles registration fraud cluster. Their abuse score (96.8%) means virtually all traffic from their IPs is malicious. Eight IPs. Twenty thousand reports each. Zero action.

NL MODAT: 147,040 reports, abuse score 100%. A perfect score. Every single report confirmed malicious. 23 IPs generating zero legitimate traffic. This is infrastructure that exists solely to attack.

The Email Clusters

tech@cloudinnovation.org — the Seychelles entity again. One email address, 15 autonomous systems. This email is the only point of contact for attacks originating from fifteen different network providers. If this email doesn't respond (and with 21 IPs at near-100% abuse scores, it clearly doesn't), there is no escalation path.

hm-changed@vnnic.vn — "hm-changed" is a placeholder indicating the contact was modified and not updated. 29 malicious IPs list this as their abuse contact. Reports to this address go nowhere by design — the field was changed to indicate change itself, not to receive communication.

fdias@frantech.ca — Francisco Dias, founder of FranTech Solutions/BuyVM. One person, 29 IPs. Unlike the corporate catch-alls, this is a real human. FranTech's abuse policy is documented: they respond, but slowly, and they give customers significant benefit of doubt. The result: persistent low-to-medium threat infrastructure that stays online weeks after first reports.

The Phone Clusters

11,324 shared abuse phone links. The largest clusters:

Consider calling +248-4-610-795. It's a Seychelles landline. The timezone is UTC+4. If you're in the US reporting abuse at 2 PM, it's 10 PM in Victoria, Seychelles. If you reach someone, they represent an entity spanning 17 autonomous systems across multiple countries. What enforcement action can a Seychelles office take against infrastructure in Hong Kong, Japan, and Germany?

The phone number exists because a phone number is required. Its purpose is regulatory compliance, not communication.

The Responsive vs. Unresponsive

Not all abuse contacts are theater. The data reveals a spectrum:

DigitalOcean's 552 reports per IP reflects turnover — IPs get reported, accounts get terminated, new accounts appear. The system works, just slowly. FranTech's higher accumulation reflects their permissive hosting stance. Korea Telecom's 2,742/IP reflects institutional inability to process volume across 57 IPs.

Then there's the gap: NL MODAT at 6,393 and PROSPERO at 102,008. This isn't failure — it's service delivery. The abuse contact exists as a valve to absorb complaints without transmitting pressure to the customer. Each unactioned report is proof: "we protect our customers from accountability."