TI-2026-100A — The Quiet Transit: AS41745, One Moscow Flat, and Five Names

Classification: TLP:WHITE · Confidence: MEDIUM · Series: The Quiet Transit, Part A Investigation window: 2026-05-21 → 2026-07-26 · Subject: AS41745 (FORTIS-AS), RIPE NCC

CORRECTION — 2026-07-26. This dossier originally described AS41745 as "allocated by RIPE NCC on 2021-02-05" and used the fact that fortis.host was registered sixteen days earlier as evidence, in §6, of "an ordinary business-setup sequence, not a retrofitted cover story." A subsequent corpus-wide sweep (Part F follow-up, measured across 383 examined ASNs) established that AS41745 was first seen in the global routing table on 2006-11-07 — a 14.2-year gap before that registration. The 2021 date is therefore a re-registration of aged address space, not a fresh allocation. §2, §6 and §10 below are corrected accordingly. The MEDIUM verdict is unchanged, but one of the counter-narrative points supporting it is materially weaker than originally published, and that is stated rather than quietly amended.

1. The row nobody read

Somewhere in the eighth chapter of TI-2026-030A — The SHA1 Mask there is a table. It lists the eleven upstream transit providers of AS210558, the ASN belonging to 1337 Services GmbH. Most rows carry a name — OVH SAS, GTT Communications, Comcast, Neterra. Four do not. One of those four reads, in full:

An em-dash. That is the entire published record of AS41745 across 773 dossier pages. It sat inside an investigation of somebody else's supply chain, unnamed, for as long as that page has been live.

This dossier is what was behind the em-dash.

It is worth saying at the outset what this is not. It is not the exposure of a criminal enterprise. The evidence does not support that and this investigation does not claim it. What it documents is narrower and, for defenders, more useful: a registration architecture that makes a small hosting business substantially harder to hold accountable than its size warrants — and the fact that every automated novelty check we run was blind to it, because it had a number but never a name.

2. Anatomy of a registration

AS41745 was re-registered at RIPE NCC on 2021-02-05 — a date that looks like an allocation and is not one. The address space has been announced in the global routing table since 2006-11-07, fourteen years earlier. What happened in 2021 was a change of hands, not a birth.

The RDAP record returns five entities.

Two entities share an address: 115088, Moscow, Ugreshskaya st, 2c147. One shares a phone: +79000116969.

Read the kind column again.

ORG-HIP1-RIPE carries the name of a natural person — Baykov Ilya Sergeevich — and is registered kind="org". FRTS1-RIPE carries the name of a company — Fortis Host — and is registered kind="individual". The person is filed as an organisation. The organisation is filed as a person.

We cannot establish from the record whether this is deliberate or clerical, and we do not assert intent. But the consequence is the same either way: any tooling that resolves responsibility by RDAP kind — which is most tooling — classifies this estate exactly backwards. Ask it for the responsible organisation and it hands you a man's name. Ask it for the responsible person and it hands you a brand.

The presence of RIPE-NCC-END-MNT as a registrant marks this an end-user assignment, sponsored by a Local Internet Registry rather than allocated to one. AS41745 is a customer of the registry system, not a member of it.

3. Five names, one anchor

The single Moscow address and the single mobile number are load-bearing. Everything hangs off them.

Maintainer handles observed on these resources:

Trading names resolving to the same anchor:

Local telemetry confirms the binding from the opposite direction, which matters because it is an independent method: abuse@fortis.host resolves across 13 IPs carrying four different organisation strings, and +79000116969 across 12 IPs carrying three. Five apparent operators collapse to one accountable point.

This is the same shared-contact resolution that identified Telco power Ltd through a reused telephone number in the bulletproof-reseller work. The technique keeps working because contact details are the one field an operator cannot fully abstract — somebody has to answer the abuse mail.

Note which handle holds the actual address space. Not HIP-MNT, not FORTIS-H-MNT. MNT-DGTL — the one handle in the cluster carrying no Fortis and no HIP branding. Because the netblocks are ASSIGNED PA, sub-assignments out of a larger provider-aggregatable block, MNT-DGTL is the seam where this estate attaches to whichever LIR actually holds the parent space. Anyone continuing this work should start there.

4. Registered in Russia, resident in Germany

The autnum is delegated RU. The platform records as_registration_country=RU at 0.95 confidence from RIR delegation data. The address space tells a different story.

One of twelve observed nodes is actually in Russia. RIPE itself marks the netblocks country DE (45.144.233.0/24, netname IBCS) and FI (109.107.155.0/25, netname IBCS-FI). The platform raises registration_vs_geo_mismatch=true. VirusTotal disagrees with the RIR outright and reports NL.

That disagreement is not noise to be resolved by picking a winner. The registry is authoritative for who registered the number; geolocation is authoritative for where the packets leave. Both are correct, and the gap between them is the substance: an abuse complaint routed by registry country lands in the wrong jurisdiction eleven times out of twelve.

The shape of the footprint

Thirteen announced /24s. Every one contributes exactly one observed node, except 45.144.233.0/24 which contributes two.

45.144.233.0/24 · 83.219.248.0/24 · 83.219.249.0/24 · 109.206.241.0/24 · 138.124.20.0/24 · 138.124.30.0/24 · 138.124.73.0/24 · 185.65.202.0/24 · 185.113.139.0/24 · 193.168.196.0/24 · 194.190.153.0/24 · 195.93.244.0/24 · 212.87.220.0/24

A hosting business serving ordinary customers fills its blocks. This estate spreads a single visible node per block across a dozen non-contiguous ranges in seven countries. Whatever the reason, the effect is to defeat /24-level blocking — the standard perimeter response — because no individual range ever carries enough of the activity to be worth banning wholesale.

5. What the machines actually did

Here the investigation turns against its own most dramatic reading.

Six hundred and seventy-eight attempts. Three successes. And then nothing — no command, no payload, no persistence, no exfiltration.

Nodes that authenticate successfully and then do nothing are not intruders. They are validators. Something is checking whether credentials work, or whether a route is live, and recording the answer elsewhere.

The credential material says the same thing:

admin:admin · fastuser:fastuser123 · root:Cloud@2024 · sally:123456 · test:777777

Undifferentiated default spray. Nothing operator-specific, nothing victim-specific, nothing that suggests anyone knew or cared what they were knocking on.

The tooling closes the argument. Four HASSH fingerprints appear on this ASN, and all four belong to enormous global fleets:

No bespoke toolkit. No custom implant. No operator-unique fingerprint anywhere in the estate. AS41745 contributes between two and ten nodes to clusters numbering in the hundreds and thousands.

And yet

Every scored IP on this ASN sits in the critical bucket. Local threat scores average 74.7, max 100. Three nodes score a full hundred: 45.144.233.139 (DE), 109.206.241.199 (EE), 194.190.153.226 (RU).

Low volume and total abuse concentration are both true at once. An honest reading holds them together rather than choosing the convenient one.

6. The counter-narrative, steelmanned

The strongest case against this dossier's framing deserves stating at full strength, because it substantially wins.

1. Spamhaus does not list AS41745. No ASN-DROP entry. The external reputation authority has not condemned it, and our own is_bulletproof=true flag is an internal assessment derived largely from observed threat scores — not independent corroboration. We say so plainly.
2. The abuse contacts are real. Two registered role objects, a working address, a published mailbox. Genuinely bulletproof operators typically publish an unreachable contact or none.
3. A PeeringDB record exists (net 42521), even if it is an empty shell with no website, IRR, policy or prefix limits.
4. WITHDRAWN 2026-07-26 — this point no longer stands. It originally read: "The domain predates the ASN by 16 days. fortis.host registered 2021-01-20; ASN allocated 2021-02-05. That is an ordinary business-setup sequence, not a retrofitted cover story." The ASN was not allocated in 2021 — it had been routed since 2006-11-07. The real sequence is register a domain, then acquire a fourteen-year-old ASN sixteen days later, which is not the neutral fact the point claimed. Aged address space carries inherited reputation that a fresh allocation does not, and acquiring it is a documented technique. Withdrawn from the benign reading.
5. 678 attempts in 66 days is trivial. A bulletproof host fronting real criminal capacity generates orders of magnitude more.
6. Zero commands, zero downloads. No observed operational payload anywhere.
7. ASSIGNED PA sub-assignments are exactly what reselling looks like in the registry.
8. Commodity tooling used by thousands of unrelated hosts worldwide.

Taken together these support a reading in which a man in Moscow sells cheap virtual servers, some of his customers run scanners, and abuse handling is slow or indifferent. This investigation accepts that reading as the better-supported one.

What survives it

Two things the benign account does not dissolve.

First, the structural facts stand on their own. Five maintainer handles. Five trading names. A person filed as an organisation and a company filed as an individual. One street address, one mobile number. Registration in one jurisdiction, operation in six others. Those are documented registry facts, and they produce attribution friction whether or not anyone designed them to.

Second, a 100% critical-abuse population across an entire visible estate is not a normal reseller profile, even by permissive standards. Twelve of twelve.

The defensible conclusion is therefore bounded and deliberately unexciting:

AS41745 is an abuse-tolerant reseller whose registration architecture — legal, published, and registry-sanctioned at every step — makes it materially harder to hold to account than its size warrants.

Not a criminal operation. Not established as one. Not claimed as one.

7. Weak signals, labelled as weak

The entity graph records 51 ASN peers for AS41745 via shared_bgp_upstream, several flagged bulletproof: AS201119 ICEWOOD (RU, risk 100), AS262287 Latitude.sh (BR, 98.8), AS202423 MGNHost — Tyurin Viktor Mihaylovich (RU, 96.7), AS24875 NovoServe (NL, 93.4), AS212477 RoyaleHosting (NL, 92.0).

Every one of these edges carries confidence 0.4. Sharing a BGP upstream is a weak, high-fan-out signal that routinely co-occurs between wholly unrelated customers of the same transit provider. They are recorded here as leads, not associations. No claim of shared operation is made.

One parallel is worth noting without overreaching: AS202423 is, like AS41745, registered to a named Russian natural person. Whether that shape recurs across this neighbourhood is a question for separate work, not an answer offered here.

8. Still moving

This is not a historical estate being catalogued after the fact.

• Inetnum 109.107.155.0/25 (IBCS-FI, country FI, MNT-DGTL) was created 2026-06-18 — five weeks before publication.
• Prefix 83.219.248.0/24 was still generating honeypot traffic at 2026-07-26 07:45:08 UTC, the morning this was compiled.

The IBCS netname family is the label to watch. It has already crossed from DE into FI.

9. Defence response

For operators, three concrete actions:

1. Do not route abuse by registry country. For this ASN it is wrong eleven times in twelve. Route by observed geolocation and send to the published role object — abuse@fortis.host is real and reachable, which makes non-response evidentially meaningful in a way that a bounced mail is not.
2. Block at ASN, not at /24. A footprint of one node per range across thirteen non-contiguous blocks is specifically resistant to range bans. AS41745 is the correct granularity.
3. Pivot on contact fields, not names. The five brands here are separable; the phone number and abuse mailbox are not. Reused contact details remain the highest-yield join in registry data.

10. Metadata

Sources

• RIPE NCC RDAP — autnum 41745, 45.144.233.139
• RIPE NCC REST DB — inverse org=ORG-HIP1-RIPE
• ICANN WHOIS — fortis.host (Tucows Registry), quadronet.net (VeriSign)
• PeeringDB — net 42521
• LSN honeypot telemetry, threat_intel — 2026-05-21 → 2026-07-26
• TI-2026-030A — The SHA1 Mask

All registry data cited is public. This dossier names an individual solely in his documented capacity as the RIPE registrant of AS41745, and makes no allegation of criminal conduct against him.