Summary

The distinction this article establishes is simple but load-bearing: a registry entry can prove contactability, and a validation pass can prove deliverability, but neither proves function. For anyone who routes abuse reports through the contact surface of this block, the evidence assembled here shows a chain of custody that ends in a mailbox of unclear staffing, inherited from a telecom lineage the current resource holder does not operate.

The registry record

Two parallel registry objects describe the Svea surface. AS211899 (as-name "SVEA") is registered to ORG-SBA155-RIPE, Svea Bank AB (reg-nr 556158-7634, Evenemangsgatan 31, SE-169 79 Solna), with abuse-c SEAR1-RIPE, admin-c and tech-c JE4899-RIPE — Jorgen Edstrom, whose person object address still names "Svea Ekonomi AB" — sponsored by ORG-TA44-RIPE (Tele2) and maintained under SWIPNET-LIR-MNT ([http://whois.ipip.net/AS211899], [https://apps.db.ripe.net/db-web-ui/query?searchtext=AS211899]). The legacy inetnum 193.105.138.0-193.105.138.255, with netname SVEA-EKONOMI-SE and descr "Svea Ekonomi AB", is instead registered to ORG-SBSA5-RIPE, Svea Billing Services AB, with abuse-c AR23510-RIPE and admin-c/tech-c JP661-RIPE (Johan Palmqvist); it was created 2010-02-18 and last modified 2021-02-02 ([http://whois.ipip.net/AS211899/193.105.138.0/24]).

Two organisations, two abuse handles, and a person object naming a company that no longer exists in that form — Svea Ekonomi AB merged into Svea Bank AB on 3 January 2022. Mirror timestamps conflict across sources for the same organisation object, so no change history is asserted here; mirror data is treated as indicative, never authoritative ([https://www.bigdatacloud.com/network-lookup/193.105.138.0/24]).

The mailbox that is not Svea's

The operative problem is what the rendered contact actually is. Across independent mirrors — IPIP.NET, IPinfo, BigDataCloud, sitezilla and ip.cc — the abuse contact displayed for 193.105.138.0/24 is a shared mailbox on the se.verizon.com domain ([http://whois.ipip.net/AS211899/193.105.138.0/24], [https://ipinfo.io/AS211899/193.105.138.0/24], [https://www.bigdatacloud.com/network-lookup/193.105.138.0/24], [https://sitezilla.org/asn/211899], [https://ip.cc/topic/asn/AS211899/]). The se.verizon.com domain resolves on legacy Verizon Business/UUNET nameservers, including ns.emea.verizonbusiness.com and auth200/auth210.ns.uu.net ([http://whois.ipip.net/AS211899]).

The same Verizon-domain mailbox is displayed on blocks with no evident relationship to Svea: Moore Europe Capital Management's 195.95.143.0/24, IP-Only Networks AB's 193.43.151.0/24 and Rackspace Ltd's 193.142.244.0/24 ([https://ipinfo.io/AS211899/193.105.138.0/24], [https://ipinfo.io/AS211899], [https://sitezilla.org/asn/211899]). That pattern points to a carrier-era inherited contact value, applied broadly along the UUNET/MCI-to-Verizon Business lineage, rather than a Svea-operated channel. A report sent to the rendered address would land in a mailbox belonging to a telecoms group, tied by historical allocation practice rather than by current operational control.

What validation does and does not prove

RIPE's answer to unreliable abuse contacts was policy proposal 2017-02, "Regular abuse-c Validation", which reached consensus on 1 June 2018 and became ripe-705, "Abuse Contact Management in the RIPE Database", fully implemented on 10 October 2019 ([https://www.ripe.net/community/policies/proposals/2017-02/], [https://www.ripe.net/ripe/mail/archives/policy-announce/2018-June/000517.html], [https://www.ripe.net/publications/docs/ripe-705/], [https://www.ripe.net/manage-ips-and-asns/resource-management/policy-implementation-status/policy-implementation-archive/2017-02-regular-abuse-c-validation/]). The regime requires the abuse-c attribute on organisation objects and an abuse-mailbox attribute in the referenced role objects, validated at least annually ([https://www.ripe.net/publications/docs/ripe-705/]).

The scope of that validation is the point. Implementation documents describe an automated check of "technical parameters such as syntax, domain and mail server configuration", which may be performed without sending email ([https://www.ripe.net/manage-ips-and-asns/resource-management/policy-implementation-status/policy-implementation-archive/2017-02-regular-abuse-c-validation/], [https://www.ripe.net/community/policies/proposals/2017-02/]). At RIPE 79, the NCC reported roughly 77,200 abuse-mailbox attributes initially validated, about 93% passing and about 7% failing, with roughly 8,000 attributes updated in 2019 and 20-25% of tickets requiring manual follow-up during initial validation ([https://ripe79.ripe.net/wp-content/uploads/presentations/102-2017-02-Implementation-Summary_final.pdf]).

None of this measures responsiveness. The RIPE NCC's own guidance states its role is to keep abuse contacts valid and up-to-date in the database, and that handling an abuse report is the operator's responsibility — the registry cannot compel a reply ([https://www.ripe.net/manage-ips-and-asns/resource-management/abuse-c-information/]). The rendered "% Abuse contact" comment a query returns is derived from the organisation and role-object chain, which is exactly the mechanism that can surface a sponsor-era or inherited mailbox on a resource holder's block ([https://docs.db.ripe.net/Types-of-Queries/Abuse-Contacts]).

The absence in the record

This research searched for any public documentation that a Svea or Verizon abuse mailbox processed a report for 193.105.138.0/24: a response record, an escalation, a takedown, a remediation note. Nothing was located. Prior BTW briefings on the same subject report the same retrieval failure for the mailbox value behind SEAR1-RIPE ([https://btw.media/en/svea-ekonomi-abuse-contact-role], [https://btw.media/en/svea-eknonomi-abuse-role-sanction-spotlight]).

The finding must be stated with its evidence boundary intact: absence of public evidence of processing is not evidence of no processing. Mailbox operations are private. But the asymmetry matters for the person sending a report: the only verifiable facts on the contact surface are that the displayed mailbox is not the registered handle's value, that it is shared across unrelated blocks, and that the registry's validation guarantee covers deliverability only.

The accountability lane that worked

Where actual accountability against Svea Bank AB is demonstrable, it did not run through the registry contact surface. On 17 December 2025, Sweden's financial supervisor Finansinspektionen announced that Svea Bank AB received a remark and an administrative fine of SEK 170 million under anti-money-laundering rules ([https://www.fi.se/en/published/sanctions/financial-firms/2025/svea-bank-receives-a-remark-and-administrative-fine/], [https://fi.se/contentassets/d388bf1d1d1c47a1ac5dff513567510c/sanktionsbeslut-svea-bank-ab.pdf], [https://www.fi.se/contentassets/d388bf1d1d1c47a1ac5dff513567510c/beslut-svea.pdf], [https://www.fi.se/sv/publicerat/granskningar/undersokningar/undersokningar-lista/2025/fi-avslutar-undersokning-av-svea-bank/], [https://fi.se/sv/forsakring/penningtvatt/sanktioner-mot-foretag-under-fis-tillsyn/], [https://news.cision.com/se/finansinspektionen/r/svea-bank-far-en-anmarkning-och-en-sanktionsavgift,c4282874], [https://www.di.se/live/fi-utfardar-sanktionsavgift-pa-170-miljoner-mot-svea-bank/]). The sanction decision documents were published on the supervisor's own record pages ([https://fi.se/contentassets/d388bf1d1d1c47a1ac5dff513567510c/sanktionsbeslut-svea-bank-ab.pdf], [https://www.fi.se/contentassets/d388bf1d1d1c47a1ac5dff513567510c/beslut-svea.pdf], [https://fi.se/sv/forsakring/penningtvatt/sanktioner-mot-foretag-under-fis-tillsyn/]).

The lesson generalises: for this group, the effective remediation channel was a regulator with statutory powers, not a mailbox that a registry had validated as reachable. Money-laundering supervision and network abuse reporting are different problem classes, but the contrast illustrates the split this article keeps separate throughout — registry validation is a data-quality instrument, while remedy requires an actor with authority and a record.

What a reader can check

Four checks reproduce this analysis without privileged access. First, compare the displayed abuse contact across the four named blocks in public WHOIS mirrors and note that the same Verizon-domain value appears on unrelated resources. Second, check the se.verizon.com nameservers against the legacy Verizon Business/UUNET infrastructure. Third, read the deliverability-only scope of ripe-705 and proposal 2017-02 in the sources cited above. Fourth, search for any documented response, escalation or remedy record tied to these contacts for this block — the search this article ran and did not complete.

The Svea surface's directory record is maintained at [https://btw.media/en/directory/svea-eknonomi-abuse-role]. Nothing in this article asserts bad faith by Svea Bank AB, Svea Billing Services AB, Verizon Business or the RIPE NCC. It establishes what the public record shows: an inherited, shared, deliverability-validated contact surface with no documented processing record, and a demonstrated accountability event that arrived through a different system entirely.