JMJacob on Intelligence
INFRA Registry · WCD

INFRA-01-RTCS

A Tehran-centred commercial VPS reseller operation administered through a single RIPE maintainer, wcd, across 30 netblocks, fronted by shell registrants and country codes in at least six jurisdictions.

OperatorMohammad Khatibi (self-published in RIPE abuse-contact fields)First mappedOctober 2026Last verifiedOct 16, 2026

Classification

-R Reseller
Leases IP space or sponsorship to third parties.
-T Abuse-tolerant
Sustained malicious activity by customers with no enforcement response.
-C Concealment-forward
Rotating shell registrants, brokered sponsorships or country-attribution mismatches.
-S State-adjacent
Documented credentialled ties to state entities. Not evidence of state tasking.

Also known as

LordVPSAlmasnetAMWAJTawsie TechnologyLexahostingDWCIGAJNET

30 inetnum objects · 16+ ASNs declared in as-wcd · 11+ corporate shells across six fronting jurisdictions

Structural signatures

A RIPE object matching three or more of these is almost certainly a new INFRA-01 asset.

RIPE maintainerwcd
Declared as-setas-wcd
Admin-c / tech-c handleMK17520-RIPE
Admin-c / tech-c handles (Atis Omran Sevin stack)AA40101-RIPE, CA108xx-RIPE, CA109xx-RIPE
Abuse contactmohammad@khatibi.org
Abuse contactabuse@lordvps.net
Abuse contactabuse@almasnet.ir
Repeat registrantAtis Omran Sevin PSJ, ORG-AOSP1-RIPE to ORG-AOSP12-RIPE (one Iranian tax ID)
Netname patternsIR-LORDVPS<N>, IR-<NAME>-<DATE>, AMWAJ-ALKHEYR, IR-KHATIBI<N>
Metadata fingerprint"808 burj khalife businessbay uae" on ORG-MK219-RIPE
Country-attribution patternAE, NL, GB, DE, RO, IQ, AZ and US codes on Iranian-operated allocations

Autonomous systems

AS8604DWCI-CORE-BACKBONE-NL (Pardazeshgaran Almas Pasargad)
AS47554ALMASNET-AS
AS44947AMWAJ (UAE-fronted)
AS52209LORDVPSNLNETWORKNL
AS58192DDOS-PROTECTION-GAJNET
AS213456TT-UAE (Tawsie Technology)
AS215193LI-TX (operator's own LIR)
AS199983Hooshmand Shabake Dez Net (Dezful)
AS215930Cipher Operations DOO Beograd
AS208137Feo Prest SRL (wcd maintains the inetnum partitions)

Sub-labels

INFRA-01/BRAND:LordVPSINFRA-01/BRAND:AlmasnetINFRA-01/BRAND:AMWAJINFRA-01/CUSTOMER:FEOPREST

Assessment

INFRA-01 is a commercial, abuse-tolerant Iranian VPS reseller. The wcd maintainer is invariant across all 30 netblocks in the cluster, and the operator's own as-wcd as-set declares at least sixteen ASNs as one routing family. Public abuse telemetry shows sustained brute-forcing, SSH/RDP scanning and proxy abuse across the space, consistent with honeypot observations.

Evidence for each suffix

  • R (reseller): openly leases IP space and brand identities, such as LordVPS and Almasnet, to third parties.
  • T (abuse-tolerant): hundreds of thousands of abuse reports and sustained honeypot-caught scanning across the prefixes, with no enforcement response.
  • C (concealment-forward): twelve LIR memberships under one Iranian tax ID, country attribution scattered across eight codes, and a Belize-sponsored Romanian pharmacy shell for the Feo Prest leg.
  • S (state-adjacent): the wcd maintainer is co-listed on the RIPE org object of Tehran Regional Electric Company (ORG-TREC1-RIPE), a state-owned utility, a link dating to 2010; the operator is a founder of IRNOG.

Hedges

  • This designation covers the hosting operation, not any tenant's conduct. "The C2 was hosted on INFRA-01 infrastructure" is accurate; "INFRA-01 operated the C2" is not, without further evidence.
  • The S suffix records a structural, credentialled relationship. It is not evidence of state tasking.
  • As of October 2026, the cluster's ranges show no direct or /16-adjacent overlap with published Iranian APT IOC sets (SafeBreach, Hunt.io).

Write-ups

← INFRA Registry