I. The Corporate Autopsy

The timeline tells the entire story:

Between February 2018 (SingleHop acquisition) and January 2024 (HorizonIQ rebrand), Internap went through: one $132M acquisition, two Chapter 11 bankruptcies, one ransomware attack with data loss, one cover-up attempt, the sale of assets in Houston, Canada, Japan, and nine additional colocation sites, and a complete rebrand. At no point in this six-year corporate death spiral was "abuse monitoring" a strategic priority.

II. The Ransomware Cover-Up

III. The Infrastructure Numbers

The registrant split reveals the corporate archaeology — two entities coexisting on the same ASN:

SingleHop BV — a Dutch company (Besloten Vennootschap) — still holds 11 IP registrations on AS32475 despite Internap acquiring SingleHop in 2018. This means either the RDAP records were never updated after the acquisition (administrative neglect) or the Dutch entity still technically operates these allocations for regulatory/tax reasons.

The Internap-direct registrations carry higher threat (72.0 vs 63.6) — the US parent's IPs are more dangerous than the Dutch subsidiary's. This is the inverse of what we might expect if the acquired company's infrastructure was the problem.

IV. The Perfect Botnet Score

Here is the most damning statistic in the entire TI-2026-032 series:

Note the 184.154.x.x block: four IPs in this /16, three at threat=95 (the highest in the entire 032 series). This prefix — 184.154.0.0/16 — is a legacy Internap allocation and contains the most dangerous cluster we've documented on any US provider.

V. The PE Acquisition Playbook

Internap's trajectory follows a pattern familiar in US infrastructure: the private equity roll-up followed by financial extraction.

1. Acquire aggressively — SingleHop for $132M, CO Space for $271M, iWeb, VitalStream, Voxel
2. Lever up — take on debt to fund acquisitions
3. Strip assets — sell off pieces when debt service overwhelms revenue
4. Bankruptcy — restructure under Chapter 11, shed obligations
5. Repeat — emerge, strip more assets, bankrupt again
6. Rebrand — when the name is too toxic, change it

Each bankruptcy strips away operational capacity — including abuse response teams, security monitoring staff, and compliance functions. What remains is infrastructure on autopilot: IP allocations that continue routing traffic, AS numbers that continue appearing in BGP tables, and servers that continue running whatever customers put on them.

After Internap's second bankruptcy in 2023, the company was restructured under creditor control. The creditors — primarily banks and bondholders — care about recovering their capital. They do not care about abuse reports on AS32475.

VI. The Running Total

Three letters into TI-2026-032, the aggregate picture:

132 botnet nodes across three US provider groups, all in the same hassh-14b2ddda386a4d10 campaign. That's 21% of the 628-IP global botnet operating from four American companies — a company in bankruptcy, a company acquired by a Canadian domain registrar, and two LA-based hosting providers. The infrastructure that attacks the world does so from American soil, through American companies, protected by American incorporation law.

VII. The Conspiratorial Reading

VIII. Conclusions

SingleHop/Internap/HorizonIQ is what happens when infrastructure becomes a financial instrument rather than a service. Two bankruptcies, a ransomware cover-up, and systematic asset stripping have produced the most dangerous US ASN in our database — not because the company is malicious, but because it has ceased to function as a responsible network operator.

The botnet operator behind hassh-14b2ddda386a4d10 has deployed 39 nodes on AS32475 — the third-highest concentration after OVH (45) and Psychz (34). The operator knows that a company cycling through bankruptcy proceedings won't investigate suspicious SSH scanning from its IP space. Institutional failure creates operational opportunity.

Next: the largest US presence in our database — DigitalOcean, a NYSE-listed public company with 350 tracked IPs.