I. Psychz Networks (AS40676): The Content Provider

Psychz Networks, founded in Los Angeles, is classified as a "Content" network type on PeeringDB — meaning it operates primarily as a content delivery and hosting provider. It runs 2,000 IPv4 prefixes with an open peering policy. The PeeringDB listing shows a professional operation with its own IRR record (AS-40676).

The registrant breakdown is remarkably clean — almost everything is registered directly to Psychz:

Unlike ColoCrossing, which hides behind the RackNerd reseller layer, Psychz owns its abuse directly. 33 of 36 IPs are registered to Psychz Networks itself — no reseller intermediary, no third-party to blame. The abuse runs through their own customer portal.

II. MULTACOM Corporation (AS35916): The NSP with a Reseller Problem

MULTACOM Corporation, also Los Angeles-based, carries the Network Service Provider (NSP) classification on PeeringDB — a step up from Psychz's "Content" type. Founded in 2005 (ARIN allocation date), it operates 1,000 IPv4 prefixes with transit service designation (AS-35916-TRANSIT). Its website at multacom.com presents standard dedicated server and colocation services.

The registrant breakdown reveals MULTACOM's own version of the reseller problem:

Brander Group Inc. appears as MULTACOM's primary reseller — 8 IPs at an average threat of 63.3, actually higher than MULTACOM's direct registrations. Like RackNerd on ColoCrossing, the reseller layer is more dangerous than the parent. This is the same structural pattern we documented in 032A, replicated on a different LA-based ASN.

III. One Botnet, Three Cities, Five Providers

The most powerful finding of TI-2026-032 so far: the hassh-14b2ddda386a4d10 campaign — 628 IPs using libssh2_1.11.0 across 48 countries — is not a loose correlation. It is a single coordinated scanning operation that purchases infrastructure from multiple US providers simultaneously.

Three US providers — ColoCrossing, Psychz, MULTACOM — together supply 93 nodes (14.8%) of a 628-IP global botnet. The operator buys infrastructure across all three simultaneously, using the same SSH client library (libssh2_1.11.0) with the same HASSH fingerprint. This is procurement diversification — the botnet operator distributes nodes across providers to ensure resilience if one provider suspends accounts.

IV. The LA Hosting Strip

Los Angeles has become America's secondary data center corridor (after Northern Virginia). The city's position on the Pacific Rim, its submarine cable landings, and its proximity to Asian markets make it a natural hub. But it also creates a concentration of hosting providers operating with minimal oversight.

Within LA County alone, our threat intelligence database tracks abuse from:

• Psychz Networks (AS40676) — 36 IPs, avg threat 59.7
• MULTACOM Corporation (AS35916) — 31 IPs, avg threat 57.0
• QuadraNet/DMIT (AS54600) — additional LA-based provider in our data
• RackNerd LLC — headquartered in LA, reselling on ColoCrossing from Buffalo

RackNerd is the connection point: headquartered in Los Angeles, reselling infrastructure from ColoCrossing in Buffalo. The LA hosting strip doesn't just generate local abuse — it exports operational management to data centers across the country.

V. The Top Attacker Profiles

Note IP 108.181.2.243 from Psychz — it belongs to two campaigns simultaneously: hassh-14b2ddda386a4d10 AND hassh-3ccd1778a7604972. This IP is either multi-tenant (shared hosting with multiple malicious customers) or the operator runs different tools from the same server. Either way, it represents a node at the intersection of two distinct attack campaigns.

VI. The Brander Group Connection

On MULTACOM's AS35916, Brander Group Inc. registers 8 IPs — all at threat ≥ 60, all in the same botnet campaign. This mirrors the RackNerd pattern from 032A: a reseller operating on the parent's infrastructure, with the reseller's IPs being more dangerous than the parent's direct registrations.

The pattern is now established across two distinct providers:

The reseller layer always carries higher threat than the parent. This is structural: resellers compete on price, not security. The cheaper the hosting, the fewer questions asked at sign-up.

VII. The 100% Problem

Across both Psychz Networks and MULTACOM, every single tracked IP with threat ≥ 50 has an AbuseIPDB score of 100. This is the maximum possible abuse score — meaning every single IP has been reported by multiple independent parties as actively malicious.

An abuse score of 100 is not a false positive. It requires multiple independent reports from different observers, verified through AbuseIPDB's validation pipeline. When an entire ASN's high-threat population carries 100% abuse scores, it means:

1. The abuse is real and widely observed
2. Multiple parties have reported it
3. The provider has either not received or not acted on the reports
4. The infrastructure remains operational despite universal abuse flagging

VIII. The Conspiratorial Reading

IX. Conclusions

Psychz Networks and MULTACOM Corporation demonstrate that ColoCrossing is not an outlier — it is a pattern. Los Angeles hosting providers participate in the same 628-IP botnet as the Buffalo server farm, using the same SSH client fingerprint, targeting the same honeypot infrastructure. The difference is geographic: Buffalo is a rust belt city trying to become a tech hub; LA is already one.

After two letters of TI-2026-032, we have documented 141 IPs across three US providers, all feeding the same global attack campaign. The botnet operator treats American hosting like a utility — commodity infrastructure purchased in bulk from multiple vendors. The providers, in turn, treat abuse reports like administrative overhead.

Next: the provider with the highest average threat score of any US company in our database — SingleHop/Internap Holding at 70.5.