The Sole Proprietor of AS53667

FranTech Solutions operates under AS53667 (PONYNET — yes, that's the real ASN name). Every ARIN WHOIS record for FranTech IP space lists the same contact:

The Cheyenne, Wyoming address is a well-known mail drop used by thousands of LLCs. FranTech's actual operations run from Las Vegas and Luxembourg. One person as admin, tech, AND abuse contact for an entire autonomous system means every abuse report goes to the same inbox — the one that, per multiple independent researchers, produces no response.

Three Brands, One Network

Our RDAP analysis reveals FranTech fragments its identity across four distinct registrant names, all on the same AS53667:

The Luxembourg Ghost Cluster

48 of FranTech's 121 IPs geolocate to Switzerland but belong to BuyVM's Luxembourg data center. The entire 107.189.x.x block:

The Luxembourg cluster presents a striking pattern: 100% abuse_score=100 but nearly zero honeypot hits. These IPs are known to AbuseIPDB and other threat feeds as malicious, but they're not attacking OUR honeypot. They're attacking elsewhere — or they're Tor exit nodes generating abuse reports from relayed traffic rather than originated traffic.

The geographic mislabeling (Luxembourg → Switzerland) adds another jurisdictional layer. A Canadian owner, registered in Wyoming, operating from Las Vegas, with European servers geolocated to the wrong country. Five jurisdictions for one hosting operation.

Campaign Membership: The Botnet Portfolio

23 FranTech IPs belong to identified botnet campaigns — a 19% campaign participation rate. But the campaigns themselves tell the real story:

The Top Offenders:

The Tor Question

FranTech's Acceptable Use Policy explicitly states: "Frantech is extremely fair when it comes to abuse complaints for Tor users." They host known Tor exit relays, including tor.exit.us2.2cb.li at 209.141.61.225.

This creates a fundamental measurement problem. When an IP at abuse_score=100 is a Tor exit node, how much of that abuse is:

• Originated — actual malicious activity from FranTech customers?
• Relayed — Tor traffic that merely exits through FranTech infrastructure?

The Luxembourg cluster (48 IPs, 100% at abuse=100, near-zero honeypot hits) strongly suggests Tor exit classification. These IPs appear in global abuse databases because they relay traffic, but they don't directly attack our honeypot because the ACTUAL attacker is elsewhere.

The Parler Connection and Political Neutrality

In January 2021, after AWS, Google, and Apple removed Parler following the January 6th Capitol breach, FranTech/BuyVM provided hosting for the platform. Francisco Dias's position was consistent: if it's legal, he'll host it.

This same philosophy extends to all content. Independent security researchers (OSINTGuardian, Scamalytics, riverside.rocks) have documented FranTech hosting criminal forums, including CSAM-adjacent content, while maintaining the same policy: if no law enforcement order arrives, nothing gets removed.

Scamalytics classifies FranTech as a "potentially medium fraud risk ISP." The LowEndTalk hosting community describes the abuse inbox as "an empty void." Multiple AbuseIPDB reports spanning years show no remediation pattern.

Cross-Investigation Intelligence

FranTech appears in five separate prior investigations in our dossier corpus — more than any other provider in the 032 series:

This is the most documented provider in our entire corpus. The pattern is consistent across years: the same person, the same ASN, the same non-response to abuse, the same hosting of both legitimate privacy tools and criminal botnets.

Comparative Context: The American Mirror at Letter E

Questions That Demand Answers

The Structural Questions

• Why does ARIN allow a sole proprietor to operate an ASN with 36,864 IPv4 addresses? There is no corporate governance, no compliance officer, no board oversight. One person controls more address space than some countries' national registries.
• What is IncogNet LLC's actual relationship to FranTech? It operates on AS53667 but as a separate entity. Is this a subsidiary? A customer? A legal shield?
• Why does the Luxembourg data center geolocate to Switzerland? Misconfiguration or deliberate jurisdiction obscuration?

The Privacy Paradox

• If FranTech is genuinely privacy-focused, why are 14 VPS instances running a coordinated botnet? Tor exits are one thing. Dedicated libssh2 attack infrastructure is something else entirely. Privacy doesn't require outbound SSH brute-forcing.
• Is there a meaningful difference between "bulletproof hosting" and "privacy hosting" at the infrastructure level? Both provide the same service: hosting that won't be taken down. The distinction is in intent, which is precisely what infrastructure analysis cannot see.

The Conspiratorial View

• Is the Tor exit hosting a deliberate noise screen? If 48 of your 121 IPs are Tor exits generating abuse reports from relayed traffic, the ACTUAL abuse infrastructure (the botnet nodes) becomes harder to identify. The noise-to-signal ratio favors the operator.
• Why did FranTech host Parler? The stated reason (political neutrality) is consistent with the abuse tolerance policy. But hosting Parler also generated enormous media attention — and media attention for a hosting provider usually means customer acquisition from people who WANT a provider that won't ask questions.
• Is the Wyoming LLC structure more than tax optimization? Wyoming offers the strongest corporate veil in the US. If a lawsuit targets FranTech's abuse-enabling, the corporate structure provides maximum personal asset protection for Francisco Dias. Privacy for the privacy provider.
• What happens to the 36,864 IPv4 addresses if Francisco Dias disappears? With no corporate succession, no board, no partners — the entire autonomous system is one heart attack away from becoming an orphaned network. In 2026, 36,864 IPv4 addresses are worth approximately $1.3 million on the transfer market.