An audit of all 78 IPv4 prefixes originated by RETN (AS9002) on 2026-05-13 found that only 3 are registered under the RU country flag in RIPE, while 53 are registered to non-RU jurisdictions yet carry netname, mnt-by, organization, or descr fields that identify Russian operators as the actual controllers. Twenty-two prefixes appear genuinely Western. The headline number is the gap between the 3 RU-flagged prefixes and the 53 prefixes whose paperwork points at Russian operators behind a Latvian, British, German, Dutch, Polish, or generic EU country code.
The country-flag distribution makes the pattern visible without any inference. Latvia accounts for 46 of the 78 prefixes — nearly 59 percent — followed by EU (9), Netherlands (5), United States (5), Germany (5), United Kingdom (4), Russia (3), and Poland (1). The Latvian concentration is not a reflection of Latvian customer demand. Of the 46 LV-flagged prefixes, the overwhelming majority carry the netname LV-BEGET or RU-BEGET-<date> and the maintainer object BEGET-MNT, tied to organization ORG-BL131-RIPE. Beget is a Russian hosting provider; its address space is registered through Latvia and announced by RETN, with the RU origin written into the netname itself in most cases.
The second cluster is RETN's own legacy and customer space. Prefixes like 87.245.208.0/21 and 87.245.224.0/19 carry the netname UK-RETN-20050824 with organization ORG-RL19-RIPE and maintainer MNT-RETN, but are flagged GB, NL, DE, PL, or EU. RETN was incorporated in the UK and reorganized through Cyprus, yet remains a Russian-founded carrier with deep operational ties to Russian networks. The audit treats any MNT-RETN or ORG-RL19-RIPE reference on a non-RU prefix as a laundering signal on the same basis as Beget: the registration jurisdiction diverges from the operator of record. Twenty-two prefixes — IPXO leases, ARIN-managed NET104/NET23 blocks, a UK customer at WOAF, and a DE customer at ORG-IL687-RIPE — show no Russian-operator markers and represent RETN's genuine Western customer book.
For sanctions and compliance analysts the operational consequence is direct. Country-of-registration alone is unreliable as a sanctions-risk filter for AS9002 announcements. A screen that flags only RU-flagged prefixes catches 3 of 56 Russian-operator-controlled prefixes and misses 53. Any KYC or infrastructure-due-diligence workflow that resolves a counterparty to an IP inside 185.77.231.0/24, 45.130.212.0/22, 139.45.192.0/19, or any of the other 50 candidates will see Latvia, the UK, Germany, the Netherlands, or Poland in a GeoIP lookup while the actual operator is Beget or RETN. Cross-reference the 53 laundering candidates against your normalized organization tables and target scorecards, and treat any domain, mail server, or customer endpoint resolving into these /24s as belonging in a manual sanctions review queue rather than auto-cleared on jurisdiction.
The graph-side recommendation in the brief is to model each prefix as a (:Prefix)-[:HELD_BY]->(:NetHolder) relationship in Neo4j, with RETN added explicitly as a transit operator node so that secondary-scope queries can traverse via infrastructure rather than only via corporate ownership. This is the layer where ASN concentration analysis becomes useful: once Beget's 40-plus prefixes and RETN's legacy blocks are nodes, downstream customer ASNs reselling RETN transit become visible as one hop away from a known Russian-operator cluster.
Full tables for all 78 prefixes, the complete laundering-candidate list with netname, organization, and maintainer fields, the three RU-flagged prefixes, and the 22 apparently clean Western customer prefixes are in the brief at /intel/retn-as9002-russian-operator-prefix-audit-beget-bgp.html, along with the RIPEstat data source and the audit methodology.