The Borrowed Vault: VPSVAULT and the Seychelles Address Empire

TI-2026-082B · The Tripwire Ledger, Part B — The Finale Confidence: HIGH — infrastructure and behaviour documented across multiple independent sources; the address-empire linkage is stated at MEDIUM Classification: TLP:WHITE

Same tripwire, second ghost

Part A opened the router's ledger — the mikrotik-attack list, the one sensor on this estate with a zero false-positive rate, because nobody with an honest reason ever knocks on a router's management port. Reading that ledger as a detector rather than a block-list surfaced 761 actors that no other instrument had ever seen: not the honeypot, not the web pipeline, not 600-plus dossiers. Part A dissected the strangest of them — an autonomous system wearing a Ukrainian bank's name over a scanner fleet.

This finale dissects its sibling. Where Part A's disguise was a bank, Part B's is a tidy British hosting company. And where Part A ended on a single load-bearing fact — that both draw their IPv6 from one address broker — Part B is where that fact detonates. Because when you pull on VPSVAULT's thread, it does not lead to Britain. It leads to the Seychelles, to a stale Turkish route object, and to the abuse desk of one of the most litigated shell entities in the history of internet number resources. The bank borrowed a name. The vault borrowed an entire address empire.

AS215925, or: the company that is nowhere it claims

The subject is Autonomous System 215925, holder "VPSVAULTHOST — VPSVAULT.HOST LTD." Its RIR listing appends a country: GB, the United Kingdom. A budget virtual-private-server host with a .host domain and a British registration is an utterly ordinary thing. That ordinariness is the point.

Pull the registration apart and the United Kingdom evaporates:

• The ASN's RDAP country code is SC — the Seychelles, not the UK.
• The RIPE inetnum for its 45.194.67.0/24 gives netname VPSVAULTHOST_LTD, country SC — Seychelles again.
• AbuseIPDB geolocates the live IP 45.194.67.26 to the US.
• The vpsvault.host domain was registered 2023-11-14, behind Cloudflare nameservers — a young operation, barely eighteen months old at the time of writing.

So the "British" host is registered in the Seychelles, routes in the United States, and is younger than most CVEs it probably scans for. As in Part A, no single one of these is damning; jurisdictions are chosen for tax and privacy, geolocation is imperfect, hosts are young. But the pattern — a clean Western brand name laid over an offshore registration and a foreign operational footprint — is the same accountability-diffusion structure we found on the bank. Different word on the van; same rented van.

The abuse contact that gives it away

The disguise slips at the abuse desk, and here it slips catastrophically.

The RDAP abuse contact for VPSVAULT's 45.194.67.0/24 is tech@cloudinnovation.org.

Cloud Innovation Ltd is not a neutral upstream. It is the Seychelles-registered entity — publicly associated with the businessman Lu Heng and the Larus group — that sits at the centre of the multi-year AFRINIC dispute, one of the defining scandals in the governance of internet number resources: a fight over the control of very large blocks of African IPv4 space that critics allege were accumulated and monetised far from the communities they were allocated to serve. Whatever one's view of the legal merits, the factual point for us is narrow and firm: Cloud Innovation is a Seychelles address-holding vehicle, and its abuse contact appears on the netblock VPSVAULT is scanning us from. VPSVAULT's address space is not free-standing British infrastructure. It sits inside, or is administered through, that contested Seychelles address empire.

That reframes the whole entity. VPSVAULT is not a plucky UK startup that happens to have some bad tenants. It is a thin retail brand — a .host storefront — layered on top of number resources that trace to one of the internet's most notorious address-accumulation structures. The storefront is new; the address empire behind it is old, large, and litigated.

A prefix with a past

Address space that has been laundered through brokers carries fingerprints, and 45.194.67.0/24 carries a clear one.

The live origin of the prefix is AS215925 (VPSVAULT). But the RADB route database still holds an older route object for the same /24 with origin AS205054, described "Aaroppe Internet Services Ltd Sti." Chase AS205054 and it resolves to something stranger still: its RIR holder is a personal name — "GURHAN-TEMIZ GURHAN TEMIZ" — a Turkish individual, and the ASN is currently not announcing anything at all. A dead, personally-registered Turkish autonomous system left its name on the route object of a prefix that a Seychelles-administered "British" VPS host now scans us from.

That is the archaeology of second-hand address space: a prefix that has passed through a dormant personal ASN before landing at a retail reseller, its provenance visible only as a stale record nobody cleaned up. It is exactly what you expect to find under a brand that was assembled, not grown — and exactly what you never find under infrastructure a company built and has held from the start.

Globally listed, locally invisible — again

The through-line of this series repeats, precisely, on VPSVAULT.

By external measure, 45.194.67.26 is a known-bad host: AbuseIPDB 100/100, 3,098 reports from 262 distinct organisations, categories Hacking (15) and Port Scan (14), with sample reports citing the Emerging Threats CINS Active Threat Intelligence feed and probes to unusual ports. GreyNoise confirms it as internet noise, last seen the day of analysis. Two hundred and sixty-two independent defenders have flagged it.

And on this estate, again, it engaged nothing the sensors watch. Zero honeypot sessions. Near-zero Traefik footprint. Two rows, total, in the entire dossier corpus — buried in a masked-200 disambiguation file, never once profiled. Like the bank, VPSVAULT was a globally-catalogued attacker that our application-layer instruments were structurally blind to, visible here only because it brushed the router's management ports and the tripwire wrote it down.

The repetition is the argument. One globally-infamous-yet-locally-invisible actor is an anomaly. Two of them, provisioned from the same broker, is a class — a whole category of adversary that a conventionally-instrumented network simply does not see, and that only a perimeter tripwire can surface.

A fleet, not a stray: twelve IPs, one hand

Where the bank ran four IPs, VPSVAULT ran twelve — and their structure betrays coordination that scattered infections never show:

Two features mark this as one operation, not a coincidence of compromised boxes. First, the consecutive-IP block 45.194.67.26–30: five sequential addresses, provisioned and fired together — the signature of a host carving out a range specifically to scan from, not of malware landing on whatever it infected. Second, the synchronised 15-day dwell: seven of the twelve IPs appeared on 2026-06-26 and were still active on 2026-07-11, with reinforcements (45.194.92.62, 45.198.224.53) rotated in on 2026-07-09 as the campaign was extended across a third prefix. This is a managed fleet on a schedule — one hand, three address arms, a fortnight of patient probing — and it is running the identical low-and-slow profile as the bank in Part A. Same tempo, same target, same evasion of volumetric alarms.

The spine of the series: one broker, two masks

Now the fact Part A planted, paid off.

VPSVAULT (a "UK VPS company") and VASH KREDIT (a "Ukrainian bank") share no name, no jurisdiction, no obvious tie. No tool that keys on holder names would ever file them together. But look at their IPv6:

VASH KREDIT (AS209630):  2604:be0:ffe0::/48
VPSVAULT    (AS215925):  2604:be0:fff0::/44
                         └── both carved from ──┐
                              2604:be0::/32  =  EMBNEX, LLC  (AS401661, US ARIN)

Both draw their IPv6 from the same 2604:be0::/32 parent, held by the address broker EMBNEX, LLC. This is not a shared upstream transit or a common data centre — those are weak, incidental links. This is a shared allocation from the same number-resource broker: the two operators walked into the same shop and were handed adjacent slices of one block. Combine that with everything else they share — the identity-laundering structure, the brokered second-hand prefixes, the low-and-slow router-scan playbook, the same fortnight, the same target, and the fact that nothing but the tripwire saw either of them — and the conclusion is difficult to avoid.

At MEDIUM-to-HIGH confidence, VASH KREDIT and VPSVAULT are not two independent coincidences on one ban-list. They are two masks on the same operation, or at minimum two customers of a single provisioning shop running one shared doctrine. The bank name and the VPS brand are interchangeable costumes drawn from the same wardrobe. The honest limit: we cannot prove a single human hand from routing data alone — a shared broker can serve unrelated customers. But the convergence of independent signals — broker, method, tempo, target, and invisibility — is far past what coincidence explains. The costumes were meant to keep these two apart in every catalogue that matters. The router's ledger, and one IPv6 parent, put them back together.

Judgement, and the limit of it

State it plainly and no further than the evidence allows. VPSVAULT.HOST is not, in any meaningful operational sense, a British hosting company. It is, with HIGH confidence, a thin retail brand over Seychelles-administered, brokered address space — tied by its abuse contact to the Cloud Innovation address empire, by a stale route object to a dead Turkish ASN, and by its IPv6 to the same EMBNEX broker as the bank of Part A — running a coordinated twelve-IP, fifteen-day router-reconnaissance fleet that every sensor but the tripwire missed.

We name no individual. The entire structure — offshore registration, brokered space, privacy-fronted contacts, interchangeable brand identities — exists to make sure no individual can be named from the outside. To invent one would be to abandon the method that got us this far. What we can say, and do, is that the operation is legible even when the operator is not: its trade is patient perimeter reconnaissance, its supply chain is an address broker, and its camouflage is a clean name in a friendly jurisdiction it has never actually touched.

What to actually do about it

As with Part A, the addresses themselves are already handled — the tripwire banned all twelve on contact. The recommendations are about turning a block-list into a sensor:

1. Enrich on ban. Both operators sat unenriched in our own data purely because the enrichment pipeline never fires on a router ban. A hook that resolves ASN, abuse score and routing for every mikrotik-attack addition would have flagged the EMBNEX linkage — and thereby tied these two together — on day one instead of at day fifteen by hand.
2. Cluster the quiet by broker and by IPv6 parent, not by name. The tie that unmasked this pair was an IPv6 allocation, not a holder string. Any future analysis of the tripwire population should group entries by number-resource provenance — shared /32 parents, shared brokers like EMBNEX — because that is the axis on which laundered identities collapse back into single operations.
3. Keep reading the ledger. Two operators fell out of the first serious read of mikrotik-attack. It is the only window this estate has onto perimeter-only adversaries, and it is worth a standing review.

The translation, for everybody

In Part A, a burglar with BANK painted on his van kept trying your back service-panel — the one spot you'd wisely alarmed — for two weeks, while your other cameras saw nothing. This is the man in the next van.

His van says "VPS VAULT — London." But the registration papers are from an island in the Indian Ocean, the plates trace to a dead man's company in Turkey, and the phone number for complaints rings through to a firm famous for hoarding address-plates that were supposed to go to someone else entirely. He, too, only ever touched your alarmed back panel; every other camera you own saw nothing; and hundreds of your neighbours have already reported him.

Here is the part that matters. When you finally read the back-panel log and looked up both vans — the BANK one and the VPS VAULT one — you found they were rented from the same yard, on the same day, with adjacent lot numbers. Two different words painted on the sides. One garage behind them. They were counting on you filing "a bank" and "a London hosting company" in two different folders and never noticing they were the same crew. The only reason you noticed is that you stopped reading the paint and started reading the rental slips.

You didn't need to catch either man in the act — your alarm locked them both out weeks ago. What you needed was to read the log, look past the paint, and check where the vans came from. When you did, two strangers turned out to be one problem.

The Tripwire Ledger — complete

Two operators, two costumes, one broker, one method, one target — and one sensor, the router's silent tripwire, that saw them when nothing else could. The lesson outlasts the two IPs: the most dangerous adversary is not the loud one your dashboards are built to catch, but the patient one aimed at the layer they don't watch — and the cheapest way to see him is to start reading the one log that never lies.

The Tripwire Ledger — complete. Read the quiet list; look past the name; follow the address, not the brand.

The series

Cross-references

• TI-2026-082A — The Bank That Wasn't — VASH KREDIT / AS209630; the sibling operator sharing the EMBNEX 2604:be0::/32 IPv6 parent.
• TI-2026-078 / 079 — The Cloud Offensive / The Harvest — the loud, disposable-VM doctrine this low-and-slow perimeter reconnaissance deliberately avoids.
• TI-2026-066E — The Bulletproof Midtier — the broker-and-neighbourhood method of reading laundered hosting by its routing company rather than its registration.

This dossier documents abuse infrastructure for defensive purposes. Attribution is stated at the level the evidence supports and no further; no individual is named. References to Cloud Innovation Ltd and the AFRINIC dispute reflect matters of public record and are included to characterise the address space's administrative lineage, not to assert that any specific party directed the scanning observed here. "VPSVAULT.HOST LTD" is treated as a network identity. TLP:WHITE.