Summary

  • 128Bit Ou is an Estonian private company formed in July 2019. Its website markets colocation, dedicated servers, hosting, backup and disaster recovery across Italy, Malta and Poland, but public routing and financial evidence support a narrower boundary: a small service and Internet-resource holder using larger Italian networks, not a demonstrated owner-operator of a multi-country data-centre estate.
  • The resource footprint is material for a company of this size. RIPE records associate 4,352 IPv4 addresses and an IPv6 /32 with 128Bit. The IPv4 space is routed in three blocks by Seeweb and HAL Service in Italy; 128Bit has no visible autonomous-system number under its RIPE organisation record, and the IPv6 allocation was not publicly announced at review time.
  • The last filed accounts show 2023 revenue of EUR 193,222 and operating profit of EUR 150,443, but they contain no property, plant and equipment, no personnel-cost line and no depreciation charge. Receivables and a EUR 210,000 investment property dominate the balance sheet. Those figures do not substantiate ownership or direct operation of facilities with the power, cooling, support and carrier infrastructure described on the website.
  • Financial visibility has deteriorated. The official register lists the 2024 and 2025 annual reports as not submitted, while the company's Estonian VAT registration ended in January 2024. The website still displays the expired VAT number, includes an older privacy notice naming Infonet DC's registration code, and makes technical claims that closely match Infonet DC's Tallinn facility. These are diligence signals, not proof of misconduct, but they weaken pricing and continuity claims.
  • The address holdings can still create value through portability, customer assignments and reduced dependence on any one host. IPv4 scarcity makes the footprint difficult to replace from the RIPE NCC waiting list. Yet the economic return belongs to 128Bit only if contracts, support, security, routing administration and supplier terms produce recurring gross contribution above the cost of a customer buying directly from a facility, cloud or dedicated-server provider.
  • The judgment is sceptical but not final. It would improve with current audited accounts, active-customer and renewal data, facility and upstream contracts, evidence of the right to resell or operate at named sites, a reconciled service catalogue and tariff, tested recovery records, an IPv6 deployment plan, and proof that customers pay a premium for continuity rather than merely renting commodity compute and addresses.

Relevance is the incentive, not the result

Small infrastructure companies do not get to choose whether cloud scale affects them. They choose where to stand in relation to it. A buyer can rent compute by the second from a hyperscaler, commit for a discount, lease a physical server from a regional provider, colocate its own machine, or buy a managed package from an intermediary. Each alternative shifts hardware risk, engineering effort, contract duration and migration cost. The supplier that sits between a customer and the underlying facility has to remove enough complexity, improve enough continuity or supply enough scarce resources to justify another margin in the chain.

That is 128Bit's economic problem. The company advertises physical-server rental and colocation, both of which can be useful to customers that want predictable hardware, direct device control, stable addresses or help from a human operator. These customers may not want the service sprawl, variable bills or architectural dependence that comes with a large cloud. They may also lack the staff to negotiate rack space, transit, address assignments, remote hands, backups and incident response separately.

The opportunity is real, but so is the trap. A small provider can bundle other companies' assets into a convenient contract and retain a service margin. It can also accept responsibility for uptime without controlling the building, power, fibre or origin network that determines it. Revenue then looks like infrastructure revenue while the supplier captures much of the economics and the intermediary carries the customer complaint. Scale matters because twenty-four-hour support, security, route administration and compliance have minimum costs even when only a few customers pay for them.

The right opening question is therefore who pays for relevance. Customers pay if 128Bit makes infrastructure easier to buy or safer to keep. Upstream providers benefit if the company aggregates demand and handles sales or support. 128Bit benefits only if its contract margin covers technical work, bad debt, abuse handling, resource administration and the downside of supplier failures. If the bundle is not differentiated, the customer can procure the underlying service directly and 128Bit becomes a price-taker with added obligations.

A company formed in 2019 cannot borrow twenty-five years without explanation

The legal identity is straightforward. The Estonian e-Business Register records 128Bit Ou under registration code 14767722 as a private limited company entered on 24 July 2019. It has EUR 2,500 of registered capital, which the register says was established without the contribution being made. Marco Mirra is the sole board member and, since September 2023, the sole shareholder. The principal activity in the latest report is other information technology and computer service activities, not operation of an electronic communications network or a data centre.

That legal age matters because the company's about page says the business has provided data-centre services worldwide for twenty-five years. Experience can predate a company. A founder can bring a career, a team can move from another operator, and a brand can inherit commercial history. None of those possibilities is disclosed in enough detail to convert the statement into a verified corporate track record. The legal company was nearly seven years old at the publication date, and the public record should be read from that base.

There is a visible clue to an earlier operating context. The privacy policy identifies "128bit" as an Estonian company with registration code 12501440 at Suurtuki 8 in Tallinn. That code belongs to Infonet DC Ou, a separate company. Infonet DC's current contact page identifies its data centre at Laevastiku 3r, Tallinn, and its own registration code. The privacy notice also describes 128bit as a processor of customer data, which is commercially relevant, but the legal identity in the notice is not the current 128Bit Ou.

The website has been partly updated. Its about page now gives registration code 14767722 and the company's newer address. Other pages retain older addresses, wording and legal particulars. The site also displays VAT number EE102241327, while the official register says that VAT registration ended on 28 January 2024. A stale footer is not by itself an operating failure. For a supplier selling custody, continuity and compliance, however, control of basic legal disclosures is an observable test of administrative discipline.

The distinction protects both sides of the analysis. It would be wrong to dismiss the business merely because some copy is old. It would be equally wrong to assign 128Bit the assets, history, certifications or customer record of another operator because the website uses similar material. The investment case has to rest on rights that the current company can document: customer contracts, facility agreements, resource registrations, routing authority, cash flow and support capability.

The service catalogue is broad, but the operating boundary is narrow

128Bit's public offer has three layers. The first is physical hosting. Its colocation page offers space from one rack unit to complete racks, aisles and dedicated modules. It describes redundant power, cooling, physical security and support for customers with demanding security requirements.

The second layer is dedicated compute. The dedicated-server page offers physical machines, network access, remote management, backup options, Windows licences and round-the-clock multilingual administration. This is a familiar regional-hosting proposition: the customer gets hardware isolation and a known configuration while the provider handles the physical environment.

The third layer is continuity and service. The about page lists email hosting, cloud backup and disaster recovery. The data-centre page promises remote hands, monitoring and service-level response times. If delivered coherently, this layer is where a small provider can earn more than a commodity hardware spread. A customer with a modest estate may value one accountable contact more than the cheapest rack unit.

The public evidence does not establish where 128Bit's responsibility begins and ends. The data-centre page says the building and land are owned by "128bit DC", describes a four-megawatt substation, two independent power paths to Sõle 14 and Ädala 29, a carrier-neutral environment and a planned capacity of 128 racks. Yet Sõle 14 and Ädala 29 are Tallinn points of presence, even though the same passages substitute Italy, Malta and Poland for the location. Infonet DC's facility specification contains the corresponding Tallinn design, carriers, optical paths and operating features, with a stated capacity of 512 racks.

This overlap has a practical interpretation, not a sensational one. 128Bit may buy capacity from Infonet DC, may have inherited website material, may have had a past commercial arrangement, or may simply not have reconciled its public pages. No public contract resolves which. What cannot be supported is the assumption that 128Bit Ou owns the Tallinn facility or a comparable estate in Italy, Malta and Poland. The legal company's balance sheet makes that assumption still harder to sustain.

The geographic boundary is similarly uneven. RIPE lists the company as serving Switzerland, Germany, Estonia, Italy and Malta. The website talks about Italy, Malta and Poland. The legal company is Estonian, the board contact uses a Maltese telephone number, and all visible IPv4 origins are Italian. These facts support a cross-border service footprint. They do not prove staffed offices, owned halls, local licences or contracted capacity in every named country.

The balance sheet looks like a service layer, not a data-centre owner

The 2023 annual report is the most useful check on the physical claim. Sales were EUR 193,222, up 6.1% from EUR 182,063 in 2022. The company reported EUR 4,322 of goods, materials and services, EUR 29,605 of miscellaneous operating expense and EUR 8,852 of other business expense. That produced operating profit of EUR 150,443, equivalent to 77.9% of sales.

Those margins would be exceptional for a company directly carrying data-centre power, cooling, fibre, hardware, property maintenance and round-the-clock technical labour. The report has no personnel-expense line, no depreciation expense and no property, plant and equipment on the balance sheet. It says management received no remuneration. The result is much more consistent with a small, asset-light service or rights-holding company, although the sparse filing does not reveal the exact contracts behind the revenue.

Total assets at year-end were EUR 471,616. Cash was only EUR 17,054. Receivables and prepayments were EUR 243,062, a little over half of assets, while investment property was EUR 210,000. There was a EUR 1,500 financial investment. Current liabilities were EUR 150,138 and equity was EUR 321,478. There was no data-centre building, power plant, server fleet or network equipment line visible as property, plant and equipment.

Leasing can explain the absence of owned facilities. A reseller does not need to own the building, and a small company can rent servers from a supplier rather than capitalise them. That is a valid model. It changes the valuation question from asset quality to contract quality. The key assets become supplier access, customer retention, address rights, operating procedures and credit control. None receives a disclosed value in the filing.

Receivable intensity raises a separate risk. At EUR 243,062, year-end receivables and prepayments exceeded annual sales. The related-party note lists balances of EUR 118,638 with a parent undertaking and EUR 31,500 with companies controlled or significantly influenced by close family members of management or owners. The report gives too little detail to determine timing, collectability or commercial purpose. A business with low cash and large balances due from counterparties can report strong profit while still depending on collection and related-party settlement for liquidity.

The reported net result also needs reconciliation. Profit before tax was EUR 150,443, but the income statement shows a positive EUR 111,913 income-tax line and net profit of EUR 262,356. That presentation makes net profit larger than pre-tax profit. The figure may have an accounting explanation, but the short report does not provide it. Operating profit is therefore the cleaner measure for analysing the service year, and cash flow remains undisclosed.

The filing gap compounds the uncertainty. The official register lists the reports for both 2024 and 2025 as not submitted, with due dates of 30 June 2025 and 30 June 2026. At publication, both dates had passed. The market cannot see whether sales continued, whether the investment property remained, whether receivables converted into cash, or whether the end of VAT registration coincided with a change in the business. A two-year information gap is material when the last visible cash balance was modest and the website claims capital-intensive operations.

The address resources are real, scarce and only partly controlled

The strongest infrastructure evidence sits in the registry and routing layers rather than on the marketing site. The RIPE NCC member page identifies 128Bit Ou as an Estonian Local Internet Registry. Its RIPE organisation record names the current legal registration code and was created in December 2020. RIPE's resource records associate three allocations with that organisation: 176.56.128.0/20, 185.228.250.0/24 and 2a00:9f80::/32.

The two IPv4 allocations contain 4,352 addresses in total. That is substantial relative to a company with EUR 193,222 of last-reported revenue. It is also difficult to recreate through ordinary registry allocation. RIPE NCC ran out of freely available IPv4 addresses in 2019, and current policy normally limits an eligible new LIR to one /24, or 256 addresses, through a waiting list. Address holdings can therefore give 128Bit a commercial input that a new small host cannot readily obtain from the registry.

Scarcity is not the same as earning power. An address produces no revenue until it supports a paying service or is lawfully transferred or assigned. It also needs clean reputation, accurate registry records, routing authority, reverse DNS, abuse handling and customer administration. Addresses used for low-quality traffic can impose remediation costs and make future customers reluctant to accept them. The economic asset is a usable and governed pool, not a number in a registry.

The route map shows where control is shared. RIPEstat's routing view for 176.56.128.0/20 shows that the aggregate is not announced as one route. Its first half, 176.56.128.0/21, is originated by AS12637, Seeweb. Its second half, 176.56.136.0/21, is originated by AS44092, HAL Service. The separate 185.228.250.0/24 is also originated by Seeweb. These are live Italian networks, not a 128Bit autonomous system.

The RIPE organisation search shows no autonomous-system number under 128Bit's record. That does not prevent the company from operating services. An upstream can originate customer space under an authorisation, and many smaller businesses sensibly buy routing rather than run an independent network. It does mean that 128Bit's public footprint does not demonstrate independent path selection, peering, transit diversity or direct routing policy. The upstreams carry those functions.

Route security is mixed. RIPEstat validation showed the Seeweb-originated /21 and /24 as covered by valid route-origin authorisations at review time. The HAL Service-originated /21 returned an unknown state, meaning no validating or invalidating authorisation was visible in that check. "Unknown" is not the same as hijacked or invalid. It identifies a governance improvement: a complete, current authorisation set would reduce ambiguity and make the resource-control proposition more credible.

The IPv6 allocation is a /32, large enough for extensive customer assignment, but it was not publicly announced in RIPEstat at review time. The contrast matters. 128Bit controls a large future-facing address resource yet shows no public IPv6 route, while its limited IPv4 supply is visibly split across suppliers. A credible technical roadmap would explain whether IPv6 is available to customers, whether it is waiting on upstream or product work, and how migration reduces dependence on scarce IPv4.

Routing through suppliers can be a feature or a ceiling

Seeweb and HAL Service are not marginal origin networks. Seeweb operates Italian cloud and data-centre services, and its PeeringDB profile lists multiple Italian facilities and exchange points. HAL Service's PeeringDB profile describes a regional Italian access network present at exchanges and facilities across the country. Both have broader network footprints than 128Bit can demonstrate publicly.

That arrangement can work well. 128Bit can concentrate on customer acquisition, account design, support and resource assignment while experienced carriers handle route propagation and upstream interconnection. Splitting the /20 across two origins provides some supplier diversification at the portfolio level. The company can also place customers nearer their target markets without building a backbone.

The ceiling appears when a customer needs seamless failover, independent route policy or a single service-level promise across both halves. The two /21s are originated by different networks, and the /24 sits with Seeweb. A fault in one upstream does not automatically move the affected addresses to the other. Migration requires commercial permission, routing changes, route-origin authorisation, filtering acceptance, configuration and testing. Address ownership creates the option to move; it does not make the move instantaneous.

Supplier pricing is equally important. If 128Bit buys dedicated servers, rack space and transit at ordinary market rates, it must either mark them up or earn a management fee. A large customer may discover the underlying provider from routing data and ask why it should not contract directly. To defend the margin, 128Bit needs something the origin network does not provide as efficiently: a consolidated contract across sites, specialised administration, multilingual support, tailored address capacity, migration work or a trusted customer relationship.

The website's facility claims complicate this defence. It lists Cogent, RETN, CITIC, Telia Estonia and Elisa as carriers and describes Tallinn optical paths, while presenting the estate as being in Italy, Malta and Poland. The visible routing points instead to Seeweb and HAL Service in Italy. A customer can accept either model, but it needs to know which one it is buying. Facility owner, colocation operator, server supplier, route origin, transit provider and contracting party should be named separately in a serious service schedule.

Concentration may also exist above the company. Seeweb originates 2,304 of the 4,352 IPv4 addresses, while HAL Service originates 2,048. A commercial dispute or policy change with either can affect a large share of the usable pool. The allocation dates deepen the diligence question: the /20 and IPv6 /32 date to 2011, eight years before the current company was formed, while the /24 dates to 2020. The current RIPE organisation record establishes present registration, but a buyer would still want the transfer history and contractual chain that brought the older resources under this legal entity.

A EUR 350 offer cannot carry the analysis without a billing term

Pricing disclosure is the weakest part of the public offer. The price page repeats one dedicated-server configuration: an HPE BL460 Gen10 with Intel Xeon Gold 6126 processors, a wide memory range, up to four terabytes of solid-state storage, one-to-ten-gigabit connectivity, remote management and "up to" 256 IPv4 addresses plus an IPv6 /48. The displayed price starts at EUR 350.

The page does not state whether EUR 350 is monthly, a setup charge or another period. It does not say which memory or storage level the base price buys, how much traffic is included, where the server sits, what support is included, whether tax applies, how long the commitment lasts, or how many IPv4 addresses are included before a surcharge. Without those terms, the figure is a lead-generation device, not an analysable tariff.

The address promise illustrates the problem. A maximum of 256 IPv4 addresses equals a full /24. 128Bit's total visible pool could support only seventeen such maximum assignments, with no addresses left for its own equipment or smaller customers. Most buyers presumably receive far fewer, or the maximum applies only by negotiation. The unit economics depend on the distribution: a server with one address is a hardware sale; a server with a scarce /24 transfers a much more valuable operating input for the contract period.

At the company level, 2023 sales averaged about EUR 16,102 a month. If EUR 350 were a monthly recurring price, forty-six continuously billed base units would roughly equal annual reported revenue. That is an illustration, not an estimate of customer count, because the billing term and sales mix are unknown. It shows the likely scale: dozens rather than thousands of base-price equivalents. At that volume, the loss of a handful of contracts can materially change revenue.

The attractive version of the model has high recurring contribution. Customers prepay, standard configurations limit support effort, hardware and rack capacity are bought at wholesale rates, and address assignments raise retention. The unattractive version has superficially high accounting margins because supplier costs sit elsewhere, related parties carry balances, work is not paid through payroll, or necessary replacement spending is deferred. Current cash receipts and supplier invoices would distinguish the two.

Contract durability is central. Physical hosting can be sticky because moving servers takes planning, downtime and hands-on labour. Stable IPv4 addresses can make migration harder where customers use allow-lists, reputation history or DNS configurations. Disaster-recovery and backup relationships can also last if tests work and data grows. These are legitimate retention advantages.

They become value-destructive if lock-in substitutes for service quality. The EU Data Act requires clearer switching conditions for data-processing services and phases out switching charges from 12 January 2027. Scope depends on the service, but the direction of policy is clear: providers should compete on performance and support, not opaque exit friction. 128Bit needs contracts that make portability a reason to stay, not a threat to leave.

Revenue growth is not yet evidence of value creation

The revenue trend through 2023 was positive. Sales rose from EUR 11,120 in the short 2019 period to EUR 72,440 in 2020, EUR 158,299 in 2021, EUR 182,063 in 2022 and EUR 193,222 in 2023. The business moved beyond a dormant shell and established a recurring commercial base.

Growth slowed markedly. Revenue more than doubled in 2021, rose 15.0% in 2022 and then only 6.1% in 2023. Inflation can account for part of nominal growth, especially in an infrastructure supply chain exposed to energy and equipment costs. Without customer count, service mix or constant-currency data, the series cannot show whether demand expanded or prices merely rose.

Value creation requires a return after all economic costs. The filed operating margin looks very high, but there is no wage bill for twenty-four-hour support, no depreciation for server replacement, no visible power expense consistent with operating a facility, and no cash-flow statement. If suppliers deliver the physical service, their invoices should appear somewhere in the cost base. The low EUR 4,322 line for goods, materials and services makes the relationship between reported sales and advertised infrastructure unusually opaque.

One explanation is that 128Bit earns administrative, referral, resource or management revenue rather than booking the full customer infrastructure bill. That could produce high margin on low revenue with minimal assets. Another is that costs are borne by related parties or classified in ways the abbreviated accounts do not reveal. A third is that the 2023 period contained non-recurring arrangements. The filing does not let an outside reader choose among them.

The tax line and related-party balances make cash conversion the decisive metric. A contract can recognise revenue before cash arrives. Profit can rise while receivables absorb liquidity. A related company can fund operations or carry supplier obligations, making the legal company's standalone margin look stronger than the whole arrangement. The evidence needed is simple: customer collections, supplier payments, operating cash, capital spending, related-party settlements and aged receivables.

The investment property adds another separation. EUR 210,000 of property can support equity value or rental income, but the report does not identify it as a data-centre operating asset. It should not be credited to network strategy without location, use, valuation and cash-flow evidence. Nor should gains or tax effects around that property be confused with return from customer hosting.

The cost base starts where the filing stops

For a provider at this scale, direct infrastructure is only one cost bucket. Upstream compute or colocation is first. Transit and cross-connects follow. Hardware fails and must be replaced. Address administration requires registry work, reverse DNS, abuse response and route coordination. Backup consumes storage and bandwidth. Support needs people who can diagnose both the customer's system and the supplier boundary.

RIPE membership itself is modest but fixed. The 2026 charging scheme sets an annual contribution of EUR 1,800 per LIR account, with separate fees for certain independent resources and autonomous-system assignments. EUR 1,800 is less than 1% of 2023 revenue, so the registry fee does not decide the case. The skilled time required to govern the resources can matter more than the invoice.

Energy costs sit mainly with the facility supplier if 128Bit is asset-light, but they still reach the customer price. Eurostat reported an average of EUR 18.37 per 100 kWh for medium non-household EU consumers in the second half of 2025, with wide country variation. Italian firms face relatively high power costs. A reseller may avoid direct utility volatility but not the supplier's repricing or power surcharge.

Equipment economics create a second pressure. Dedicated-server revenue can remain stable while the hardware ages, producing attractive near-term cash. Eventually processors, memory, drives, controllers and power supplies need renewal. Customers compare performance per euro with newer bare metal and cloud instances. Deferring refresh protects margin until churn arrives; replacing too early consumes capital before demand is secured.

Support is the hardest fixed cost. The website promises multilingual, round-the-clock assistance. A legal employer with no personnel-cost line cannot itself demonstrate a staffed rota. Contractors, a related company or the facility operator may provide it. That is acceptable if the contract specifies response, escalation, access and liability. It is risky if the public promise depends on informal availability from one person or an upstream help desk that has no duty to the end customer.

Security and compliance add minimum work regardless of revenue. Customer identification, sanctions screening, log retention, vulnerability response, data-processing terms, incident notification and supplier review all take time. Hosting businesses also attract abuse complaints and payment fraud. A small provider cannot remove those costs by automating the order form; it can only allocate them across a sufficiently profitable customer base.

Customers have more substitutes than the address pool suggests

128Bit competes in several markets at once. A customer that only needs compute can use a large public cloud. Amazon EC2 offers on-demand billing without a long commitment, discounted commitments and spare-capacity pricing. The service model is more complex and can be expensive for steady workloads, but its elasticity, tooling and geographic reach are difficult for a small host to match.

A customer that wants physical control can rent directly from a dedicated-server specialist or from the same regional operators visible in 128Bit's routes. Seeweb sells cloud and data-centre services from Italian facilities. Other European providers combine bare metal, virtual machines, storage and network protection at published prices. A buyer can also contract with a colocation facility and bring its own transit or managed-service partner.

A customer that wants Estonian hosting can approach Infonet DC or another Baltic operator directly. A customer that wants Italy can compare Seeweb, HAL Service's ecosystem and numerous Milan or Rome facilities. Malta and Poland have their own local and international suppliers. 128Bit's cross-border packaging can save procurement effort, but a list of countries is not a moat.

The company has three possible defences. The first is address capacity. New LIRs cannot simply obtain a comparable IPv4 pool from RIPE NCC, and some customers need more than one or two addresses. The second is service intimacy. A small buyer may value direct access to someone who understands its estate and can coordinate suppliers. The third is contract composition: one agreement for hardware, addresses, backup, remote hands and migration can be easier to manage than five.

Each defence is conditional. Address-heavy customers bring abuse and reputation risk. Personal service does not scale unless procedures and staffing exist. Bundling creates accountability but also leaves 128Bit exposed to failures it cannot directly repair. The margin belongs to the company only where it is cheaper or better at managing these conditions than the customer or upstream.

Customer concentration is undisclosed. With revenue equivalent to a small number of dedicated-server contracts, one large address user, reseller or managed-service buyer could be material. The receivable balance suggests counterparty exposure deserves attention. A buyer should ask for revenue by customer, gross contribution by contract, renewal dates, prepayment terms, bad-debt history, address count per customer and the largest customer's dependence on each upstream.

Market dependence is also geographic. The route origins point strongly to Italy, while the legal and administrative base is Estonia and the board contact has a Maltese number. That can be an efficient European structure. It also means disputes, tax treatment, data location, physical access and customer law may cross borders. Standard contracts must make the responsible entity and jurisdiction explicit.

Continuity cannot be inferred from a Tier label

The website uses "Tier-III compatible" and "built in accordance with Tier III requirements" language. Those phrases describe a claimed design standard. They are not the same as a named facility holding a current independent award. Uptime Institute distinguishes certification of design documents, certification of the constructed facility and operational-sustainability assessment. Each verifies a different layer.

For a customer, the contractual facts matter more than the adjective. Which building holds the server? Who owns and operates it? Which room and power train are covered? Are both rack feeds on genuinely separate paths? How often are generators load-tested? What is the fuel commitment? Which carriers enter by physically diverse routes? What service credit applies? When was failover last demonstrated?

128Bit's website supplies generic answers but not site-specific evidence for Italy, Malta and Poland. Its most detailed power and cooling descriptions align with Infonet DC's Tallinn material, while its public routes originate in Italian networks. A reliable proposal should name the exact facility and attach the operator's evidence. Customers should not have to reverse-engineer the service from routing records and old page copy.

Disaster recovery needs the same precision. A backup in another logical account at the same facility may not survive a site incident. A second facility on the same carrier or power dependency may not provide the expected diversity. A second IPv4 block originated by a different network improves the option set but does not prove that customer data, configurations and staff access fail over together.

Operational continuity also includes company continuity. Missing annual reports, low last-reported cash and dependence on one board member raise key-person and counterparty questions. A supplier can run technically sound servers while its legal entity struggles to invoice, renew contracts or pay upstreams. Customers need escrow or export procedures, current contacts, documented access rights and the ability to retrieve data and addresses if the contracting company cannot perform.

Regulation can raise trust or overwhelm a thin margin

128Bit's precise obligations depend on what it actually supplies. The Estonian regulator says providers of publicly available electronic communications services must file a notice of economic activity. The official company page showed zero such notices and zero activity licences at review time. This does not establish a breach: hosting, resource administration and private business connectivity do not automatically make every seller a public communications provider. It reinforces the need to define the service boundary accurately.

The EU's NIS2 Directive expressly covers categories including data-centre, cloud, managed-service and public communications providers, subject to scope and national implementation. The directive distinguishes a data-centre service as the accommodation, interconnection and operation of equipment together with power and environmental infrastructure. If 128Bit is only an intermediary, duties may sit differently across the company and facility operator. Customers still need a clear incident and supplier chain.

Energy transparency is becoming more formal for actual facility operators. The European Commission says data centres above the relevant power threshold face energy-performance reporting covering consumption and environmental indicators. A 128-rack or four-megawatt claim should eventually connect to site-specific energy and operator evidence. An asset-light intermediary should instead disclose the performance information it receives from its suppliers.

Data protection is immediate. The privacy policy positions 128bit as processor and the customer as controller, but names the wrong legal registration code and refers to the former EU-US Privacy Shield framework. The policy should identify the current contracting processor, subprocessors, processing locations, transfer mechanism, retention, security and deletion process. For a company selling secure storage and disaster recovery, this is part of the product, not legal decoration.

Geopolitical screening matters because the website promotes connectivity for Europe, Russia and the Commonwealth of Independent States. That wording may be old and is not evidence of current Russian customers. The current EU Russia sanctions regulation contains restrictions on specified technology, technical assistance and services, with exceptions and authorisation routes. A cross-border host needs customer, beneficial-owner, end-use, payment and export-control checks proportionate to the service.

Regulation can help a disciplined small provider. Clear data location, documented recovery, good screening and current processor terms can win customers that do not get enough attention from a mass-market platform. It can also erase margin if every contract requires bespoke diligence and the provider lacks shared procedures. Strategy here is resource allocation: either fund a repeatable compliance capability or narrow the offer to customers and services the company can support well.

Public signals show activity, but also unresolved housekeeping

The positive signals are concrete. The legal company remains entered in the Estonian register. The RIPE organisation record was updated in May 2026. The IPv4 blocks were publicly routed at review time. The website remained reachable, published a live published contact points and displayed a server offer. The business filed accounts through 2023 and reported growing sales through that year.

Third-party routing data also show that the footprint is not dormant. The /20 is divided between two Italian origins, and the later /24 is active through Seeweb. The routes have persisted long enough to indicate an operating arrangement rather than a momentary announcement. Two of the three visible IPv4 routes had valid route-origin authorisation in the review.

The cautionary signals are administrative and commercial. Two annual reports are missing. VAT registration ended while the old number remains on the site. The privacy notice names another company. Facility language mixes Estonia with Italy, Malta and Poland. The price lacks a billing period. No 128Bit autonomous system or PeeringDB network profile was found, and IPv6 was unannounced.

Abuse databases contain reports against some addresses in the wider range. Such reports are common for hosting and access networks and are self-selected; they do not prove company misconduct or current customer quality. They identify a diligence question. Address reputation, complaint volumes, response times, blocklist incidence and customer termination practices affect whether scarce IPv4 remains a saleable asset.

There is almost no public customer evidence. The website does not name reference clients, publish case studies, provide service-status history or show independent testimonials with contract context. Silence is not evidence of an empty book, especially in business hosting. It leaves management unable to demonstrate differentiated demand from outside the accounts.

The combined signal is a living but thinly documented business. The routing evidence is stronger than the marketing evidence. The 2023 accounts establish activity but not the whole economic chain. The website establishes an intended offer but not ownership. That pattern supports a conditional valuation, not a narrative of either fraud or hidden scale.

Management has three realistic allocations of capital

The first option is to remain an asset-light resource and service manager. 128Bit would keep LIR membership and address control, buy infrastructure from established operators, standardise support and sell a clear bundle to small European businesses. This option requires little physical capital. It can earn good returns if customer acquisition is inexpensive, contracts recur and upstream discounts leave room for service.

To make it credible, management should strip the website down to verified rights. Name the actual facilities, suppliers and origin networks. Publish a tariff with billing period, included addresses, bandwidth, support and exit terms. Update legal and privacy disclosures. File current accounts. The commercial message would become narrower but more valuable: one accountable European provider for dedicated infrastructure and address continuity.

The second option is to build more independent network capability. 128Bit could obtain an autonomous-system number, deploy IPv6, establish multiple upstreams under its own routing policy and make customer prefixes portable between facilities. This would strengthen technical control and make the resource pool more defensible. It would also require engineering, routing security, monitoring, peering or transit contracts and an incident rota. The current revenue base may be too small to absorb those fixed costs unless a larger customer cohort is already committed.

The third option is to reduce infrastructure exposure. Management could monetise or transfer surplus resources where policy allows, refer customers directly to upstream providers, and focus on higher-margin consulting or administration. This sacrifices some control but avoids pretending to be a scaled operator. It is rational if customers buy mainly on price and do not pay for the address and service layer.

The worst allocation is a half-built combination: marketing owned data centres, carrying twenty-four-hour promises, keeping a large resource pool and adding jurisdictions without funding the people and systems required. That model collects the fixed costs of an operator and the bargaining weakness of a reseller. The last reported sales base is not large enough to tolerate many such obligations.

Management should compare the options contract by contract. For each customer, calculate revenue less facility, hardware, transit, licences, payment fees, support time, abuse handling and expected replacement cost. Then allocate shared engineering, compliance, RIPE and administration. A high accounting margin is irrelevant if the contract depends on unpaid founder labour or an upstream concession that can be withdrawn.

The facts that would change the judgment

The present judgment is that 128Bit holds useful infrastructure rights but has not shown enough differentiated demand or operating control to escape price-taker risk. It looks capable of earning an attractive margin as a small service layer. It does not look, on public evidence, like the owner of the multi-country data-centre platform its website describes.

Current financials could improve that view quickly. Filed 2024 and 2025 accounts should show sales, operating cash, supplier costs, aged receivables, related-party settlements, staff or contractor expense, capital spending and the treatment of the investment property. Recurring revenue growth with cash collection and a fully loaded margin above commodity resale would demonstrate value creation. Falling revenue, growing receivables or continued low cash would point the other way.

Customer data are the second test. Management should disclose the number of active customers, average contract value, top-five share, renewal rate, churn, prepayment mix, address utilisation and gross contribution by service. Multi-year renewals from customers that use backup, migration support and stable addressing would show that service, not scarcity alone, drives retention.

Supplier evidence is the third. Contracts or attestations should identify every facility used, the asset owner, the colocation or server provider, route origin, transit arrangement, remote-hands duty, insurance, recovery commitment and right to move the address space. A tested ability to shift a customer between Seeweb and HAL Service, or to a third provider, would turn registry control into operating leverage.

Technical evidence is the fourth. 128Bit should publish an accurate network and service map, current route-origin authorisations, an IPv6 launch plan, address-reputation metrics, incident history, recovery objectives and status reporting. Obtaining an autonomous-system number is not automatically necessary. Demonstrating controlled, documented portability is.

Commercial clarity is the fifth. The EUR 350 offer needs a billing period and full configuration. Colocation needs rack-unit, power, bandwidth, cross-connect, address and support pricing. Contracts need explicit indexation, service credits, data-export and termination terms. If customers knowingly pay more than direct upstream alternatives for measurable support and continuity, the margin is defensible.

Negative facts would also settle the question. A single customer providing most revenue, a supplier able to reclaim customer access on short notice, uncollectible related-party receivables, no tested recovery, material address abuse, or inability to document facility rights would make the resource footprint look like inventory without a franchise. Continued failure to file accounts would increase counterparty risk even if the routes stay live.

128Bit does not need cloud scale to create value. It needs a precise reason for existing below it. Stable addresses, supplier coordination and hands-on service can be that reason, especially for small companies that are poorly served by either raw colocation or a hyperscale console. The public evidence shows the ingredients but not the return. Until current cash flow, customer durability and supplier rights are visible, 128Bit remains a small resource-holder with strategic options, not a proven infrastructure platform.