INFRASTRUCTURE ACTOR REGISTRY

INFRA Registry

Tracked hosting operators whose infrastructure is used, at material scale, for malicious activity. Each entry carries an INFRA-NN designation and the structural signatures needed to confirm new sightings in registry data.

Entries1SchemaIntroducing Infrastructure ActorsMachine-readableregistry.json

Search by ASN, maintainer, as-set, admin-c handle, abuse contact, netname, brand or designation

1 tracked entry

INFRA-01-RTCSWCDA Tehran-centred commercial VPS reseller operation administered through a single RIPE maintainer, wcd, across 30 netblocks, fronted by shell registrants and country codes in at least six jurisdictions.

Reading a designation

Suffixes stack in this order, with U always last.

-R Reseller: Leases IP space or sponsorship to third parties.
-T Abuse-tolerant: Sustained malicious activity by customers with no enforcement response.
-C Concealment-forward: Rotating shell registrants, brokered sponsorships or country-attribution mismatches.
-S State-adjacent: Documented credentialled ties to state entities. Not evidence of state tasking.
-U Under investigation: Structural map incomplete; attribution set still pending.

A designation covers the hosting operation, not any tenant's conduct. It is a research tracking label, not a sanctions designation or an accusation of state tasking.

Submit an entry

To propose a cluster for the next INFRA-NN number, email me@jacobonintelligence.com with the proposed entry and its full structural signature set. Entries are reviewed against the inclusion criteria in the schema post before publication. Corrections to existing entries are welcome the same way.