Executive Summary
One phone number: +248-4-610-795. Country code +248 is the Seychelles โ 115 islands in the Indian Ocean with 100,000 residents. This number appears in RDAP records across 15+ Autonomous Systems, linking three supposedly independent entities: Cloud Innovation Ltd (Seychelles shell, AS59187), Cloud Innovation Support (abuse contact spanning 10+ ASNs), and Yisu Cloud Ltd (AS138152/AS142403). Together they control 16 million+ IP addresses including the entire 45.192.0.0/12 block โ extracted from AFRINIC, Africa's IP registry, despite routing zero traffic to Africa. This is the mother of all attribution breaks.
The Phone
Our entity graph captured it through shared_abuse_phone relationship mining. The number +248-4-610-795 appears in RDAP contact records for:
- Cloud Innovation Ltd โ Seychelles company, AS59187, Suite 202, Eden Plaza, Eden Island
- Cloud Innovation Support โ abuse/tech contact appearing in IPs across AS138152, AS142403, AS142002 (Scloud), AS135377 (UCloud), AS211577, AS150706, AS138995, AS8796
- Yisu Cloud Ltd โ Hong Kong company, AS138152 and AS142403
One number. Three "independent" entities. Fifteen autonomous systems. Eight countries. The Seychelles has no mandatory beneficial ownership disclosure. There is no registry where you can look up who answers this phone.
The Shell Architecture
Three Layers of Separation
The structure works as follows:
- Layer 1: Cloud Innovation Ltd (Seychelles) โ the legal holding entity. Holds IP allocations from AFRINIC. No physical infrastructure.
- Layer 2: LARUS Limited (Hong Kong) โ the technical management layer. Flat A3, 11/F, TML Tower, Tsuen Wan. Operates LARUS-SERVICE-MNT which manages all Cloud Innovation AFRINIC objects. Phone: +852-2988-8918.
- Layer 3: Yisu Cloud Ltd / Scloud / downstream ASNs โ the customer-facing brands. Sell cloud hosting. Generate the actual attack traffic. RDAP records point back to Cloud Innovation Support (Seychelles phone) for abuse.
Abuse reports go to Layer 3 โ which point to Layer 2 (LARUS, HK) โ which is managed by Layer 1 (Cloud Innovation, Seychelles) โ which exists only as a registration in a jurisdiction with no enforcement. The loop never closes.
The Yisu Cloud Data
| Metric | Value | Note |
|---|---|---|
| Tracked IPs (AS138152 + AS142403) | 30 | In our threat_intel DB |
| AbuseIPDB = 100 | 16 of 16 scored | 100% of enriched IPs at maximum |
| Threat score = 100 | 2 | 103.143.238.100, 154.209.4.195 |
| Countries claimed | 5 | US, HK, JP, SC (Seychelles!), HK |
| Cymru org | "YISUCLOUDLTD-HK" | All route through Yisu HK regardless of claim |
| RDAP orgs on Yisu IPs | 8 different names | See below โ the fragmentation strategy |
The RDAP Fragmentation
Our data reveals that IPs on Yisu Cloud's ASNs are registered under 8 different organization names:
Cloud Innovation Supportโ the Seychelles phone entity (most IPs)YISU CLOUD LIMITEDโ the actual brandYisu Cloud Ltdโ variant spellingHONG KONG LING JIAN ZHUO TECHNOLOGY CO., LIMITEDHongkong Hongdou Technology Co., LimitedIRT-ACEMOB-HKHK KXSY TECHNOLOGY CO.,LIMITEDHK Kwaifong Group Limited
Every one of these routes through YISUCLOUDLTD-HK in BGP. The registrant names are different. The cymru_org is always the same. This is intentional fragmentation โ making it impossible to identify the full scope of a single operator through registration records alone. Only BGP routing analysis reveals the true topology.
The AFRINIC Extraction
Cloud Innovation Ltd (Seychelles) holds 45.192.0.0/12 from AFRINIC โ Africa's Regional Internet Registry. This is 16 million IP addresses. For context:
- Many African countries have fewer IPs allocated to their entire national infrastructure
- The Seychelles has a population of ~100,000
- Zero traffic from this allocation routes to Africa
- The allocation is monetized through LARUS (HK) as bulletproof hosting for Chinese-linked entities
One IP in our DB (156.232.13.161) has rdap_org="African Network Information Center" โ a vestigial artifact of the AFRINIC provenance. The IP claims to be US-located, has threat score 59, abuse score 100, and routes through... Yisu Cloud HK.
The Seychelles: Why There?
Structural Advantages
The Seychelles offers five specific features that make it ideal for this architecture:
- No beneficial ownership disclosure โ company directors/owners are not public
- No CRS/FATCA enforcement on non-financial entities
- Minimal regulatory staff โ the FSA has ~50 employees for all financial/corporate regulation
- English-language legal system โ compatible with APNIC/AFRINIC requirements
- No mutual legal assistance treaties with China โ creating a clean sovereignty break
The phone number is the fingerprint. Everything else is designed to leave no fingerprints at all.
Cross-Reference: The TI-2026-028 Connection
Our earlier investigation (TI-2026-028) established this network as a coordinated shell company operation. Key findings being carried forward:
- Cloud Innovation / LARUS partnership confirmed via cloudinnovation.org website
- LARUS-SERVICE-MNT manages ALL Cloud Innovation AFRINIC objects
- Same corporate beneficial structure despite different registration names
- Connection to FatalRAT gambling campaigns (BreakGlass Intelligence report)
- Dual-use infrastructure: legitimate-appearing cloud services as front for bulletproof hosting
The phone number is not a coincidence. It's a signature โ the single thread that, when pulled, unravels an entire empire of jurisdictional arbitrage.
Scale Comparison
Methodology & Sources
Data from: LSN Honeypot (Cowrie SSH), entity graph (shared_abuse_phone relationship mining), RDAP/APNIC/AFRINIC (registration records), BGP/Cymru (routing verification), AbuseIPDB (confidence scores), PeeringDB, prior investigations TI-2026-028 (Shell Companies/Seychelles), TI-2026-020D (The Seychelles Veil), 019M, BreakGlass Intelligence (FatalRAT/AFRINIC dual-use report). Corporate structure from cloudinnovation.org (archived), LARUS Limited public records.