TI-2026-096B — One Company, Two Dozen Numbers: The Contrust Accumulator

Classification: HIGH · Forensic threat intelligence · Entity-graph / lifecycle vector · Series: The Unannounced

The census in Part A found 197 autonomous systems sitting dark, and sorted them into strata. This letter zooms into the single densest spot on that map. One legal entity — a Moldovan company called Contrust Solutions S.R.L. — is the largest occupant of the dark, holding roughly two dozen globally-routable numbers by itself. It did not buy them in one lot. It gathered them, over years, across two generations of AS number space, and let every one of them route nothing. Behind the corporate name there is one Gmail address and one first name. This is what the reserve looks like when you hold it up to the light: not a network, a hoard.

1. The Densest Spot on the Map

Part A (The Dark Census, TI-2026-096A) established the population: 197 RIPE-region autonomous systems that announce no routes, recorded in a single resolver pass on 2026-07-03, stratified into a bulletproof reserve, a retail tier of individual holders, a never-routed SME bulk, and a legacy graveyard. It named Contrust Solutions S.R.L. as the largest single sub-cluster and deferred the detail. This is the detail.

Sort the 197 by holder and one name dominates. Roughly two dozen of the dark ASNs — comfortably the largest block from any single entity — resolve to Contrust Solutions S.R.L., a company registered in Moldova (MD) and carried as a RIPE Local Internet Registry. Every one of them was recorded un-announced on 2026-07-03, most in the tight 10:47–10:54 UTC sub-window. One cheap corporate shell is the biggest single occupant of the allocated-but-dark population this program can see.

That is worth a letter for a simple reason: a company holding two dozen autonomous systems is holding a serious quantity of a scarce, institution-grade internet resource. Universities hold one. Regional ISPs hold a handful. An entity with two dozen — all dark — is not running networks. It is keeping numbers.

2. An Accumulation, Not a Purchase

The first thing the allocation dates tell you is that this was assembled patiently. If Contrust had bought a bloc of numbers in one transaction, they would share an allocation date and cluster in one IANA block. They do not.

Two structural facts jump out. First, the span: allocations reach from mid-2017 to at least early 2019, so the entity returned to the registry repeatedly over roughly two years to acquire more numbers. Second, the range crossing: AS42881 is a 16-bit AS number (the old, more prestigious, harder-to-get range that predates the 2007 exhaustion), while AS205770/209375/209982 sit in the modern 32-bit space above 200000. A holder that carries both a legacy 16-bit number and a fistful of fresh 32-bit numbers has been in the AS-acquisition business across eras. This is the profile of an accumulator, not a network operator kitting out one deployment.

And the right-hand columns are the punchline. Every sampled holding routes zero IPv4 prefixes, zero IPv6 prefixes, and has zero BGP neighbours. Not "a few small prefixes." Zero. Across two years of acquisitions, this company has never — in the graph's observation — actually used any of these numbers to carry traffic. They are pure paper: allocated identifiers, held, dark.

3. The Human Seam: One Gmail, One Name

A company is a mask; the question is always what is behind it. For Contrust, the registry answers with unusual directness.

The RIPE abuse contact published on AS205770 is alex.kontrast.eu@gmail.com. Sit with that for a moment. This is the officially-registered abuse-handling contact for an entity that holds two dozen globally-routable autonomous systems — the address to which the world is supposed to send complaints about a portfolio of internet infrastructure. It is a consumer Gmail account. Not abuse@contrust.md, not a NOC ticketing system, not even a corporate domain at all. One person's free email, carrying a first name — Alex — and a brand string, kontrast.eu.

The gap between the two halves of that fact is the entire finding. On one side, institution-grade resources: two dozen AS numbers, a RIPE LIR membership, a company registration. On the other side, the operational reality: a single human reachable at a Gmail address. That mismatch — heavyweight resources, featherweight administration — is the defining signature of the retail AS-manufacturing tier. Real ISPs do not run their abuse desk out of a personal Gmail. Number-hoarding shells do, because there is no operation to staff — only numbers to hold.

4. Kontrast, Contrust, kontrast.eu

The Gmail address also explains a small mystery in the census. Most of the dark ASNs read Contrust Solutions S.R.L.; one, AS42881, reads Kontrast Contrust Solutions S.R.L. The entity-resolution graph correctly coalesced the two spellings — its verdict on AS42881 is rebrand, canonical name Contrust Solutions S.R.L. — but the spelling doubling is itself informative.

Kontrast with a K is not a typo; it is the same string that appears in the abuse email's kontrast.eu. So the entity has, in effect, run under two interchangeable brand spellings — Contrust and Kontrast — both tied to the same human at alex.kontrast.eu@gmail.com. Whether the "Contrust" spelling was a deliberate near-homophone of a more legitimate-sounding word ("contrast," "trust") or simply the Latin-alphabet rendering an operator settled on, the effect is a small amount of naming ambiguity smeared across a large number of AS numbers. It is the kind of low-grade brand fog — one entity, two spellings, no corporate domain — that makes bulk registry analysis harder and that the golden graph's coalescence is specifically built to cut through.

5. The SRL Factory, At Rest

None of this is new as a mechanism. TI-2026-036C (The SRL Factory) documented it in detail: under Romanian and Moldovan law a Societate cu Răspundere Limitată — an SRL — can be formed for a minimum capital on the order of €0.20, with one person as sole shareholder, sole director, and sole employee, and no proof of business activity required. That filing, plus a RIPE LIR membership, is enough to begin acquiring globally-routable autonomous systems. 036C called it a manufacturing process: the cheap company is the machine, and AS numbers are the product.

Contrust is that machine seen at rest. 036C mostly caught SRLs in the act — space moving, prefixes announcing, abuse flowing. Here there is no motion at all: no prefixes, no neighbours, no honeypot hits. What there is, is stock. Two dozen numbers, manufactured through one €0.20-tier shell over two years, and parked. If 036C showed the factory running, Contrust shows the factory's warehouse — and it is exactly the concrete supply that Part A's abstract "reserve" pointed at. When the dead-ASN carousel (TI-2026-024G) needs its next clean-enough wrapper, an accumulator like this is where the number comes from.

6. The Counter-Narrative

Steelman. "You have built a menacing story out of paperwork. A Moldovan company holding some unused AS numbers and listing a Gmail is not a crime, not even unusual — plenty of small networking outfits over-register, under-deploy, and use personal email. You have no attacks, no announced prefixes, no abuse reports. You are inferring a 'hoard' from an empty warehouse and a first name."

The objection is fair and the finding is deliberately narrow:

• "Not a crime." Agreed, and not alleged. Holding un-announced ASNs and using a Gmail abuse contact violate no rule. This dossier makes no criminal claim about Contrust. It documents a structure — one shell, two dozen dark numbers, personal-email administration — and names that structure as the accumulator tier of the number economy.
• "No attacks." Conceded, exactly as in Part A. Every Contrust holding shows zero honeypot activity. The claim is about accumulation and dormancy, not active abuse. If Contrust's numbers are ever announced and turn abusive, that will be a future finding; this one is about the reserve, not the flow.
• "Over-registration is normal." Bounded true. One or two unused ASNs would be unremarkable. What lifts Contrust out of the noise is the combination: two dozen numbers (not one), accumulated across years (not a single mistaken over-order), spanning 16-bit and 32-bit space (sustained acquisition), all dark, all administered from one consumer Gmail carrying a brand that also appears as a second holder-name spelling. Any one of those is mundane. Together they are the accumulator signature.

What is not claimed: that Contrust has attacked anyone (no evidence it has); that holding dark ASNs is illegal (it is not); that 'Alex' is a specific identifiable wrongdoer (the Gmail is a public RIPE abuse contact, presented as the registry-published human seam, not as an accusation). The claim is structural: this is the single clearest instance of AS-number accumulation in the dark census.

Confidence: HIGH that one Moldovan SRL holds ~two dozen dark ASNs accumulated 2017–2019 across 16-bit and 32-bit space, all routing zero prefixes, administered via a personal Gmail. MEDIUM on the interpretation that this constitutes deliberate reserve-inventory accumulation rather than benign over-registration.

7. Defence Response

• Treat multi-ASN dark holders as single blocklist objects. Contrust is not two dozen unrelated networks; it is one entity behind one Gmail. If any Contrust number lights up abusively, the correct response is to flag the whole holder's portfolio, not just the one announcing ASN — the graph's coalescence to a single canonical entity is what makes that possible.
• Weight the resource/administration mismatch. A holder of many AS numbers reachable only through a consumer email is a high-value watch candidate. The mismatch between institutional resources and personal-email administration is cheap to detect at registry-scan time and is a strong discriminator between real ISPs and number-hoarding shells.
• Pivot on the human seam, not just the ASN. alex.kontrast.eu@gmail.com and the kontrast.eu brand are the durable identifiers here — they survive ASN churn. When burnt space reappears behind a new number, the abuse contact and brand spelling are where continuity is proven. Track the seam, not only the numbers.

8. A Note on Method

Built entirely through the entity-graph MCP layer, no direct database access — entity_changes(change_type=taken_down) to isolate the Contrust sub-cluster within the census, and entity_detail on individual holdings to recover ASN numbers, allocation dates, prefix/neighbour counts, the abuse contact, and the Kontrast/Contrust coalescence. The alex.kontrast.eu@gmail.com address is the public RIPE abuse-c, carried in the graph as a contact_of edge; it is presented as registry-published attribution data. No SQL touched the investigation.

9. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence