Summary

  • The RIPE record for legacy netblock 193.105.138.0/24 (netname SVEA-EKONOMI-SE) carries the names of three separate legal parties at once: a sponsoring LIR under Tele2 Sverige AB (ORG-TA44-RIPE; organisation record), a registered organisation named Svea Billing Services AB (ORG-SBSA5-RIPE, abuse-c AR23510-RIPE), and the operator now routing the block, Svea Bank AB (AS211899; ASN record, ORG-SBA155-RIPE).
  • The legal entity named in the block's description — Svea Ekonomi AB (org. no. 556489-2924) — was dissolved into Svea Bank AB (org. no. 556158-7634) on 3 January 2022 in a merger approved by Finansinspektionen (merger notice; fusion page), so the name in the registry no longer corresponds to any live legal person.
  • The abuse mailbox displayed for the block resolves to a mailbox on the se.verizon.com carrier domain, not to either the registered Svea organisation or the bank that routes the space; the record's own abuse-c handle and the displayed contact point in two different directions.
  • Svea's own network migration document (migration one-pager) describes 193.105.138.0/24 as actively used for staging, demo and production services and multihomed through AS211899, confirming the block is live infrastructure of the bank even though its registry description still names the dissolved predecessor.
  • Nothing in the surviving public record shows the duty over this abuse contact being explicitly re-attached to the current operator after the merger; the record simply persisted.

The block was created on 18 February 2010 as an ASSIGNED PI allocation, assigned from Tele2's SWIPNET legacy space under maintainer SWIPNET-LIR-MNT, and registered against the organisation Svea Billing Services AB with a named individual contact (handle JP661-RIPE, Johan Palmqvist, at the Svea Ekonomi / Svea Billing Systems address in Solna). Third-party mirrors of the RIPE Database (IPIP.NET; DCXV) reproduce this record consistently, although the authoritative RIPE web query interface could not be inspected directly in this run — a limitation stated rather than papered over. The mirror data is internally coherent: one block, one sponsoring LIR, one registered organisation, one named person, and one abuse-c handle that resolves under the registered organisation.

What the same record displays for the abuse contact, however, is a mailbox on the se.verizon.com domain (mirror record) — a carrier-era address inherited along a lineage the bank did not choose, and a point of contact that conflicts with the org object's own abuse-c handle. Two 'who is accountable' signals therefore coexist on one record: the structured handle pointing into the registered Svea organisation, and the free-text mailbox pointing at a carrier. Neither signal has ever been documented in any public source as having received, answered, escalated or remediated a single report for this block.

The corporate succession that should have untangled this did not. On 3 January 2022, Svea Ekonomi AB (556489-2924) transferred into its subsidiary Svea Bank AB (556158-7634) in a downstream merger with Finansinspektionen approval; Svea Ekonomi ceased to operate, and Svea's own 2022 annual report (annual report) confirms Svea Billing Services AB continues as a separate group company providing administrative services. The group thus ended the merger with three relevant legal entities intact or surviving: the bank, the billing-services company, and the dissolved predecessor whose name still lives in the netname and description fields. The registry record was last modified in February 2021 — before the merger — and its org object was touched as recently as 31 October 2023 without, per the mirrors, re-pointing the displayed mailbox or the description to the current operator.

The outcome is a custody chain that reads like a relay in which the baton was never visibly handed over. Tele2/SWIPNET sponsored the assignment; Svea Billing Services AB holds the registered organisation; Svea Bank AB routes the block and uses it for production services; and a Verizon-domain mailbox sits in the middle as the displayed first responder. Each link is independently verifiable in the public record.

What is not verifiable is any act of re-attachment: no visible registry change transferring the abuse-c duty to the bank's own org object (ORG-SBA155-RIPE, abuse-c SEAR1-RIPE), no document obliging the bank to fix the record, and no published commitment by Svea to reconcile it.

This is a different question from the one earlier BTW coverage answered. Prior articles on this target (prior BTW coverage; operation test) established that RIPE's annual abuse-contact validation tests only technical deliverability, and that Finansinspektionen's 17 December 2025 sanction against Svea Bank (SEK 170 million, FI dnr 23-13249) contained no remediation order. The lineage angle adds a third finding: even the ordinary hygiene step of making the record point at the current operator after a merger never demonstrably happened. Accountability literature usually asks whether a control fired. Here the record shows a control surface that outlived the entity it was written for, and no evidence anyone was ever made responsible for updating it.

The evidentiary limits deserve their own paragraph. The authoritative RIPE db-web-ui query could not be opened directly in this run; the record's fields come from multiple third-party mirrors that agree with one another but carry known caching artefacts (one mirror even shows anomalous created dates elsewhere on the same site). The corporate facts come from Svea's own merger pages, its 2022 annual report, and a Nasdaq bond-issuer notice dated 13 January 2022. All are primary or near-primary sources, but the registry record itself should be re-verified against the live RIPE Database before any enforcement-relevant use.

Sources cited: RIPE mirror; ORG-TA44-RIPE; AS9045; AS211899; merger notice; fusion page; annual report 2022; migration one-pager; RIPE-705; anti-abuse WG archive; prior BTW coverage; operation test.

Where does that leave the duty? Under RIPE policy (ripe-705 and its surrounding proposals), the organisation holding the resource is responsible for keeping its registered data current, and the sponsoring LIR has validation duties over abuse contacts. On the record as it stands, those duties attach to Svea Billing Services AB and Tele2 as the registered and sponsoring parties respectively — while the party actually operating the block, the bank, is attached only through the routing object. The dissolution of Svea Ekonomi AB transferred its agreements and commitments to Svea Bank AB automatically under merger rules; whether that automatic transfer reached the duty to keep a registry record current is exactly what the surviving record cannot prove. What it can prove is that, more than four years after the merger, no visible change re-attached that duty in the registry.