Amsterdam's BGP Router for Iskanders and Rostec: How RIPE NCC (KvK 40539632) Dismisses 90.12% of Sanctions Alerts and Signs RPKI ROAs for Russian VPK and Occupied Melitopol Telecom
On 22 October 2026, the Amsterdam-based Regional Internet Registry RIPE NCC (Stationsplein 11, KvK 40539632) published its Q4 2026 Quarterly Sanctions Transparency Report (RIPE-868): out of 2,339 EU/OFAC sanctions alerts since April 2022, 2,108 (90.12%) were dismissed, and the Russian Federation accounts for a microscopic 0.32% (15,616 out of 4,850,688) of frozen IPv4 addresses. Using primary records from rest.db.ripe.net and live BGP/RPKI telemetry, we demonstrate how IT and telecom subsidiaries of EU-sanctioned Russian defense holdings (Rostec, Rosatom, Almaz-Antey, KTRV, UAC, USC, VGTRK, ANO Dialog, Zvezda, TsNIIMash) and occupied Melitopol telecom hold 35 ASNs and 117,024 unfrozen IPv4 addresses in Amsterdam valued at $2.22 million.
1. The Myth of the 'Sovereign Runet' and the Building at Stationsplein 11 in Amsterdam
Whenever Russian generals and Ministry of Digital Development officials boast on television about a 'sovereign, import-independent Runet', observers outside network engineering often imagine a master switch in Moscow. In reality, global packet routing between Russian defense conglomerates, missile design bureaus, state corporation data centers, and the outside world rests on the legal foundation of a single association incorporated under Dutch law (*Vereniging*) across from Amsterdam Central Station: Réseaux IP Européens Network Coordination Centre (RIPE NCC), Stationsplein 11, 1012 AB Amsterdam, Netherlands, Dutch Chamber of Commerce registration KvK 40539632 (RSIN 801699036; Managing Director: Hans Petter Holen; Chief Legal Officer: Athina Fragkouli).
Operating under the jurisdiction of the Kingdom of the Netherlands, RIPE NCC exercises a regional monopoly over:
- allocating, registering, and maintaining public
IPv4(inetnum),IPv6(inet6num), and Autonomous System Number (aut-num/ASN) blocks across Europe, the Russian Federation, and Central Asia; - maintaining the registry of Local Internet Registries (
LIRs) and organisation objects (**ORG-***); - signing cryptographic Route Origin Authorizations (
RPKI ROAs) under its root certificate authority (TA: RIPE NCC RPKI Root), without which European and North American Tier-1 transit providers drop BGP announcements as invalid; - approving or freezing transfers of scarce
IPv4blocks on the European secondary market, where public IPv4 blocks constitute liquid intangible assets (as formally confirmed toRIPE NCCby the Dutch Ministry of Foreign Affairs under the definition of "economic resources" in Article 1(d) and Article 2 of Council Regulation(EU) No 269/2014).
As a Dutch legal entity, RIPE NCC is strictly bound by the Dutch Sanctions Act (Sanctiewet 1977), Article 2 of Council Regulation (EU) No 269/2014 (freezing all funds and economic resources belonging to, owned, held, or controlled by designated entities and their 50%+ subsidiaries), and Article 5n of Council Regulation (EU) No 833/2014 (prohibiting IT consultancy, cloud, and technical services to legal persons established in Russia).
2. Mathematical Verdict from RIPE NCC's Own Disclosure: Inside Document RIPE-868 (Q4 2026)
On 22 October 2026, RIPE NCC published its latest quarterly disclosure — RIPE-868: Quarterly Sanctions Transparency Report (Q4 2026) (URL: https://www.ripe.net/documents/4651/ripe-868.pdf, SHA-256: 0878f45e835fcc5d0a83be7fc503c6bbebbb60fd24ae5882e18738b35c84135e; preceding Q3 2026 edition published 23 July 2026: RIPE-864, SHA-256: 6ad502852539e7939abd27387365842262851a66690eec5c0e0fd2f0246b08b8).
The official figures in Table 1 and Table 2 of RIPE-868 (status as of 1 October 2026) expose a systemic compliance failure:
- A 90.12% Dismissal Rate: Out of
2,339sanctions alerts generated since April 2022,RIPE NCCfroze only53cases (2.27%), placed20cases (0.85%)On hold, and dismissed2,108cases (90.12%) under the label *"Confirmed false positive, EU sanctioned not applicable, exempted, or OFAC"*. - Russia Accounts for 0.32% of Frozen IPv4 Space: Across all countries in Table 2 of
RIPE-868,RIPE NCChas frozen or placed on hold4,850,688IPv4 addresses. However,4,631,552addresses (95.48%) belong to Iran (IR) and216,064addresses (4.45%) belong to Syria (SY), whereas the entire Russian Federation (RU) in the fifth year of full-scale war accounts for just15,616IPv4 addresses (0.32%) and34ASNs (5Frozen LIR Members holding9,472IPs,24Frozen End Users holding5,376IPs, and3On-Hold End Users holding768IPs).
Why does Amsterdam's screening pipeline dismiss 90.12% of alerts? Because RIPE NCC screens Latin-transliterated organisation names largely for literal string matches against Annex I of Regulation (EU) No 269/2014, systematically failing to trace 50%+ ownership and control (EU Best Practices for the effective implementation of restrictive measures, paras. 62–68) across wholly-owned IT integrators, telecom subsidiaries, and dedicated LIR shields of sanctioned Russian defense holdings.
3. How Table 2 of RIPE-868 Mathematically Proves that Rostec, Rosatom, UAC, and VGTRK Pools Remain Unfrozen
Because Table 2 of RIPE-868 itemizes every single one of the 32 frozen or on-hold Russian entries by exact type (Member vs. End User), IPv4 count, IPv6 count, and ASN count, cross-referencing RIPE-868 against live queries to rest.db.ripe.net and stat.ripe.net as of 5 November 2026 yields mathematical proof of non-freezing:
- Zero Russian LIR Members (
Member | RU) holding more than3,072IPv4 addresses are frozen. Table 2 ofRIPE-868lists only five frozen Russian LIR Members: three with1,024IPs, one with2,048IPs (and0IPv6), and one with3,072IPs. This proves with 100% mathematical certainty that: ORG-ASTa1-RIPE(FGUP VGTRK / All-Russia State Television and Radio Broadcasting Company, INN7714072839, OGRN1027700310076) — an activeLIRholdingAS25292,4,096IPv4 addresses (80.247.32.0/20), and2a05:f0c0::/29IPv6 — is 100% UNFROZEN, despite FGUP VGTRK being directly designated under EU Regulation(EU) No 269/2014since December 2022;ORG-AJ134-RIPE(JSC Atomdata, INN9725031147, OGRN1207700111277) — the data-center and cloud LIR subsidiary of JSC Concern Rosenergoatom (INN7721632827, OGRN5087746119951) and State Corporation Rosatom (INN7706413348, OGRN1077799032926), holdingAS199860 / AS214817,2a01:6520::/32IPv6, and7,424IPv4 addresses (with193.43.41.0/24modified in RIPE DB on2026-10-09) — is 100% UNFROZEN;ORG-DL236-RIPE(LLC DDoS-Guard, INN9204005780, OGRN1149204010988) — an active LIR holding8,192IPv4 addresses (45.10.240.0/22,91.215.40.0/22,95.129.232.0/21,185.178.208.0/22et al., withAS57724modified2026-10-20), routing EU-sanctionedrt.com(ANO TV-Novosti, INN7704552473, OGRN1057746595367) andtvzvezda.ru— is 100% UNFROZEN;ORG-IZL1-RIPE(LLC BI.ZONE, INN9701036178, OGRN1167746317210) — the 100% cybersecurity subsidiary of EU-sanctioned PJSC Sberbank (INN7707083893, OGRN1027700132195), holding2,048IPv4 addresses (185.163.156.0/22,185.191.32.0/22) plus2a0a:400::/32IPv6 (the sole frozen 2,048-IP Russian LIR in Table 2 has0IPv6) and routing the official web portal of State Corporation Rostec (rostec.ru->185.163.159.23, INN7704274402, OGRN1077799030847) viaAS207104— is 100% UNFROZEN.- All 27 frozen or on-hold Russian
End Userentries in Table 2 ofRIPE-868have0IPv6 blocks, at most1,024IPv4 addresses, and at most2ASNs. This proves thatRIPE NCChas left completely unfrozen: ORG-LR156-RIPE(LLC RT-Inform, INN7704810710, OGRN1127746501190) — the 100% central IT and cybersecurity integrator of State Corporation Rostec (INN7704274402), holdingAS48723(modified2026-07-17),512IPv4 (194.190.191.0/24,195.208.193.0/24), and2001:67c:1c0::/48IPv6;ORG-KI11-RIPE(PJSC KAMAZ, INN1650032058, OGRN1021602013971, directly sanctioned by EU, US, and UK) — holdingAS50342and2,048IPv4 addresses (109.95.104.0/21), double the maximum of any frozen Russian End User inRIPE-868;ORG-SPC9-RIPE(PJSC Yakovlev, formerly PJSC Irkut Corporation, INN3807002509, OGRN1023801428111, Su-30SM2 fighter manufacturer under PJSC UAC INN7708619320, OGRN1067759884598) — holding 3 ASNs (AS39252,AS48035,AS62389), withAS48035modified on2026-01-14;ORG-TFSU1-RIPE(FGUP MIA Rossiya Segodnya, INN7704853840, OGRN5137746242937,AS44479,AS57352),ORG-ISE2-RIPE(FGUP ITAR-TASS, INN7703082786, OGRN1037700049606,AS51186,AS62344,1,536IPv4 +2001:678:124::/48IPv6), andORG-JG70-RIPE(JSC Goznak, INN7813252159, OGRN1167847225281, EU-sanctioned since October 2022, withAS209520modified in RIPE DB on2026-04-18).
4. Cryptographic RPKI ROAs Signed by RIPE NCC Root: TsNIIMash Missile Institute, Russian MoD Broadcaster Zvezda, and Occupied Melitopol Telecom
Querying stat.ripe.net/data/rpki-validation reveals that RIPE NCC's own cryptographic root authority (TA: RIPE NCC RPKI Root) actively signs valid RPKI ROA certificates for sanctioned Russian military and occupation infrastructure:
JSC TsNIIMash(INN5018200994, OGRN1195081054310) — Roscosmos head rocket and spacecraft research institute (ORG-JA462-RIPE): holdsAS212732and46.61.181.0/24, backed by 3 activeRPKI ROA VALID (TA: RIPE NCC RPKI Root)certificates (46.61.181.0/24 -> AS212732).JSC Russian Armed Forces Broadcasting Company ZVEZDA(INN7717653542, OGRN1097746338403) — official broadcaster of the Ministry of Defence of the Russian Federation (ORG-FA303-RIPE): directly designated under EU Regulations(EU) No 269/2014and833/2014, yet holds activeAS48552and89.208.99.0/24with a liveRPKI ROA VALID (TA: RIPE NCC RPKI Root)for89.208.99.0/24 -> AS48552.MUE "Sea Telecom" / GUP ZO "More Telecom"(Russian occupation INN9001000730, OGRN1229000000910) — Russian military-civilian administration telecom operator in occupied Melitopol, Zaporizhzhia Region, Ukraine (ORG-MA2129-RIPE):RIPE NCCin Amsterdam maintains recordMUE "SEA TELECOM" VGA MELITOPOL ZAPORIZHIE REGIONat *Zaporozhye region, Melitopol, Bogdan Khmelnitsky Ave. 28*, explicitly tagged withcountry: RU, assignedAS215503(modified2026-02-03) and185.178.244.0/24, and signed with a liveRPKI ROA VALID (TA: RIPE NCC RPKI Root)— in direct breach of Ukraine's territorial integrity and Council Regulations(EU) No 269/2014and(EU) 2022/1903.
The complete bilingual compliance matrix of all 18 Russian VPK and Z-infrastructure clusters (32 RIPE org-ids, 35 ASNs, 117,024 IPv4 addresses valued at $2,219,956) and competent Dutch/EU enforcement channels (FIOD fiod.infodesk@belastingdienst.nl, Dutch Ministry of Finance sancties@minfin.nl, Ministry of Economic Affairs meldpuntsancties@minezk.nl, RDI info@rdi.nl, and European Commission DG FISMA) is published in /en/sanctions-gap#ripe-ipv4-matrix.