{
  "registry": "INFRA Registry (Infrastructure Actor Registry)",
  "maintainer": "Jacob Miller",
  "schema": "https://jacobonintelligence.com/research/infrastructure-actors",
  "submissions": "me@jacobonintelligence.com",
  "generated": "2026-10-17",
  "entries": [
    {
      "id": "INFRA-01",
      "designation": "INFRA-01-RTCS",
      "suffixes": [
        "R",
        "T",
        "C",
        "S"
      ],
      "label": "WCD",
      "operator": "Mohammad Khatibi (self-published in RIPE abuse-contact fields)",
      "summary": "A Tehran-centred commercial VPS reseller operation administered through a single RIPE maintainer, wcd, across 30 netblocks, fronted by shell registrants and country codes in at least six jurisdictions.",
      "aka": [
        "LordVPS",
        "Almasnet",
        "AMWAJ",
        "Tawsie Technology",
        "Lexahosting",
        "DWCI",
        "GAJNET"
      ],
      "firstMapped": "2026-10",
      "lastVerified": "2026-10-16",
      "scale": "30 inetnum objects · 16+ ASNs declared in as-wcd · 11+ corporate shells across six fronting jurisdictions",
      "writeups": [
        {
          "title": "One Maintainer, Thirty Netblocks: Mapping an Iranian VPS Resale Cluster",
          "href": "/research/wcd-cluster"
        },
        {
          "title": "Introducing Infrastructure Actors",
          "href": "/research/infrastructure-actors"
        }
      ],
      "signatures": [
        {
          "type": "RIPE maintainer",
          "value": "wcd"
        },
        {
          "type": "Declared as-set",
          "value": "as-wcd"
        },
        {
          "type": "Admin-c / tech-c handle",
          "value": "MK17520-RIPE"
        },
        {
          "type": "Admin-c / tech-c handles (Atis Omran Sevin stack)",
          "value": "AA40101-RIPE, CA108xx-RIPE, CA109xx-RIPE"
        },
        {
          "type": "Abuse contact",
          "value": "mohammad@khatibi.org"
        },
        {
          "type": "Abuse contact",
          "value": "abuse@lordvps.net"
        },
        {
          "type": "Abuse contact",
          "value": "abuse@almasnet.ir"
        },
        {
          "type": "Repeat registrant",
          "value": "Atis Omran Sevin PSJ, ORG-AOSP1-RIPE to ORG-AOSP12-RIPE (one Iranian tax ID)"
        },
        {
          "type": "Netname patterns",
          "value": "IR-LORDVPS<N>, IR-<NAME>-<DATE>, AMWAJ-ALKHEYR, IR-KHATIBI<N>"
        },
        {
          "type": "Metadata fingerprint",
          "value": "\"808 burj khalife businessbay uae\" on ORG-MK219-RIPE"
        },
        {
          "type": "Country-attribution pattern",
          "value": "AE, NL, GB, DE, RO, IQ, AZ and US codes on Iranian-operated allocations"
        }
      ],
      "asns": [
        {
          "asn": 8604,
          "name": "DWCI-CORE-BACKBONE-NL (Pardazeshgaran Almas Pasargad)"
        },
        {
          "asn": 47554,
          "name": "ALMASNET-AS"
        },
        {
          "asn": 44947,
          "name": "AMWAJ (UAE-fronted)"
        },
        {
          "asn": 52209,
          "name": "LORDVPSNLNETWORKNL"
        },
        {
          "asn": 58192,
          "name": "DDOS-PROTECTION-GAJNET"
        },
        {
          "asn": 213456,
          "name": "TT-UAE (Tawsie Technology)"
        },
        {
          "asn": 215193,
          "name": "LI-TX (operator's own LIR)"
        },
        {
          "asn": 199983,
          "name": "Hooshmand Shabake Dez Net (Dezful)"
        },
        {
          "asn": 215930,
          "name": "Cipher Operations DOO Beograd"
        },
        {
          "asn": 208137,
          "name": "Feo Prest SRL (wcd maintains the inetnum partitions)"
        }
      ],
      "sublabels": [
        "INFRA-01/BRAND:LordVPS",
        "INFRA-01/BRAND:Almasnet",
        "INFRA-01/BRAND:AMWAJ",
        "INFRA-01/CUSTOMER:FEOPREST"
      ],
      "url": "https://jacobonintelligence.com/infra/infra-01"
    }
  ]
}