031H — The Convergence Map

287 Cross-Provider Links Prove These Are Not Independent Companies — They Are One System

The Link Types

The Provider Web: Who Connects to Whom

The RDAP Crossovers: Registration Reveals Structure

When we examine RDAP registrant data, the wrapper structure becomes explicit:

The Malware Clusters: Same Tools, Different Faces

Two malware hashes span the entire ecosystem:

When the same malware binary is deployed by IPs across nominally different providers, one of two things is true:

1. The same threat actor has purchased infrastructure across all providers (consumer coordination)
2. The providers share backend infrastructure where the same toolkit is pre-deployed (supplier coordination)

The shared abuse contacts and shared RDAP registrations eliminate option 1 as the sole explanation. This is supply-side coordination.

The Architecture Diagram

                    ┌─────────────────────────────────┐
                    │   CLOUD INNOVATION LTD (SC)     │
                    │   45.192.0.0/12 · 16M IPs      │
                    │   AFRINIC allocation            │
                    └───────────────┬─────────────────┘
                                    │ LARUS-SERVICE-MNT (HK)
                    ┌───────────────┴─────────────────┐
                    │         LARUS LIMITED (HK)       │
                    │    Technical IP Management       │
                    └─┬───────┬───────┬───────┬───────┘
                      │       │       │       │
          ┌───────────┴┐  ┌──┴────┐  │  ┌────┴──────┐
          │ YISU CLOUD │  │UCLOUD │  │  │COGNETCLOUD│
          │ AS138152   │  │AS13537│  │  │ AS401696  │
          │ AS142403   │  │  7    │  │  │ AS401701  │
          └────────────┘  └───────┘  │  └───────────┘
                                     │
              ┌──────────────────────┼──────────────────┐
              │                      │                  │
     ┌────────┴──────┐   ┌─────────┴────────┐  ┌─────┴──────┐
     │TENCENT/ACEVILLE│   │  BYTEPLUS (SG)   │  │ CDS GLOBAL │
     │  AS132203      │   │   AS150436       │  │  AS63199   │
     │  (independent) │   │   (independent)  │  │(connected) │
     └───────────────┘   └──────────────────┘  └────────────┘
              │                      │
              └──────────┬───────────┘
                         │
              shared_malware (29 links)
              shared_credential (21 links)
              shared_otx_pulse (113 links)
              shares_commands (15 links)
  

What Convergence Means

Six providers. Nominally independent. Registered in 4 countries (China, Singapore, Hong Kong, United States). But:

• They share threat intelligence feed appearances (113 links) — the global security community already treats them as related
• They share malware toolkits (29 links) — the same binaries deploy across all of them
• They share credential dictionaries (21 links) — the same brute-force lists attack from all of them
• They share post-exploitation playbooks (15 links) — after compromise, the same commands execute
• They share abuse contacts (43 links) — the same people manage their registrations
• They share IP registrant entities (20 links) — "Cloud Innovation Support" appears on IPs routed by different ASNs

This is one ecosystem wearing six faces. The legal separation is jurisdictional engineering. The operational reality is convergence.

The Implication

If these are independent companies competing in a market, they should have:

• Different abuse contact infrastructure
• Different customer bases (no shared malware)
• Different operational tooling (no shared commands)
• Different threat feed profiles (no shared OTX pulses)

They have none of these. What they have is: different registration jurisdictions, different company names, different ASN numbers, and different legal liability surfaces. Everything that matters for enforcement evasion is separated. Everything that matters for operations is shared.

This is not coincidence. This is design.