A new RIPEstat-driven audit of AS9002 (RETN) catalogs all 78 IPv4 prefixes the ASN originates and flags 53 of them as jurisdiction-laundering candidates: blocks registered to non-RU countries (overwhelmingly Latvia) but carrying Russian-operator signals in their netname, mnt-by, org, or descr fields. Only three of the 78 prefixes carry an RU country flag, while 46 are flagged LV and the remainder spread across EU, NL, US, DE, GB, and PL.
For compliance and sanctions analysts, the gap between registered country and operator control is the operative finding. A large share of the laundering candidates trace back to BEGET-MNT and ORG-BL131-RIPE, with netnames like RU-BEGET-* and LV-BEGET sitting under non-RU country flags. Any screening process that filters infrastructure by RIPE country code alone will miss this footprint entirely, and any domain or service resolving into these /24s warrants placement in a sanctions review queue rather than a clean-pass.
The full brief is at /intel/retn-as9002-russian-operator-prefix-audit-beget-bgp.html. It includes the per-prefix tables (prefix, country, netname, org, mnt-by, and the specific signals matched), the breakdown of RU-flagged prefixes, the list of non-RU prefixes with no Russian-operator signal for completeness, and recommended follow-up steps for cross-referencing these blocks against pipeline scorecards.