Summary

  • Routing aggregators now describe AS210328 (AO ALMAZ, almazcloud.network) as a network with three originated IPv4 prefixes — 77.91.65.0/24, 185.136.15.0/24 and 185.218.138.0/24 — of which only two are currently announced, both with RPKI-valid ROAs (Hurricane Electric; ping.pe).
  • The third prefix, 185.218.138.0/24, has no covering ROA and is announced by three different origin ASes, including a bank (AS209630, LLC VASH KREDIT BANK) and a private registrant (AS205997, Vlad Cojuhari) whose name also appears as the prefix registrant (Hurricane Electric prefix page; rpki-client console).
  • The neighbourhood is upstream-only: three upstreams (AS202425 IP Volume inc, AS201814 MEVSPACE, AS48693 Rices), zero observed peers and zero downstreams — a topology that sits uneasily beside first-party claims of direct physical peering to Yandex, Sberbank and Rostelecom (ping.pe peers; almazcloud.network).
  • Third-party registry views disagree sharply: IPinfo classifies the ASN as Inactive with zero prefixes, while iptrace and Robtex still mirror the 2021-era routing policy pointing at AS12695; the live RIPE object was last modified 2026-08-21 with policy now referencing AS48693 (IPinfo; IPtrace; IPGeolocation.io).

A cloud provider can be described on a website. Whether it exists as an operating network is a different question, and it is answerable only through observations that do not depend on the operator's own statements. For AS210328, the operator registered by RIPE NCC as AO ALMAZ under organization ORG-ZA238-RIPE, those observations now exist in enough quantity to say something precise.

Start with what several independent aggregators agree on. Hurricane Electric's BGP toolkit reports three IPv4 prefixes originated under AS210328, of which two are announced, with 512 originated IPv4 addresses, 717 observed AS paths and an average path length of 5.319, and an RPKI-originated-valid count of 2. ping.pe lists the same three prefixes — 77.91.65.0/24 (registered to Foton Telecom / IP-FI), 185.136.15.0/24 and 185.218.138.0/24 (both registered to Vlad Cojuhari) — and gives per-prefix RPKI status: the first two VALID, the third NOT-FOUND.

The rpki-client console independently confirms ROAs with maximum length 24 exist for exactly the two prefixes ping.pe marks valid, published in the RIPE repository. That is three sources converging on one coherent picture: a small, real, partially routed network.

Now the part that is not coherent. The 185.218.138.0/24 prefix is a multi-origin (MOAS) condition: Hurricane Electric's prefix page shows AS209630 (LLC VASH KREDIT BANK), AS205997 (Vlad Cojuhari) and AS210328 (AO ALMAZ) all appearing as origins, and the prefix's registrant differs from the AS's own registrant. It is also the one prefix with no covering ROA, which means no cryptographic assertion ties any of those origins to it. In routing terms this is the least trustworthy advertisement in the network, and it is the one most closely associated with the almazcloud brand's announced address space.

The topology observations are equally specific. ping.pe's peer records for AS210328 report three upstreams — AS202425 (IP Volume inc), AS201814 (MEVSPACE sp. z o.o.) and AS48693 (Rices) — with very asymmetric collector visibility (seen 290, 267 and 1 times respectively), and explicitly state no peers and no downstreams were returned. IPregistry's record, updated 21 August 2026, concurs that the ASN has no direct peering agreements and no downstream networks.

A network whose commercial proposition is peering and connectivity — the almazcloud.network site lists CLOUD CONNECT from 499 USD per month per 10G physical port, BGP ANNOUNCEMENTS from 99 USD per month per prefix, NO-BGP GRE TUNNEL from 99 USD per month per 100Mbps, and CORPORATE CLOUD VPN from 9 USD per month per user — is being observed as a transit customer with no lateral interconnection and no customers of its own visible in routing data.

The registry layer adds a caution about freshness. The live RIPE aut-num object, as embedded in Hurricane Electric and IPGeolocation.io pages, shows the routing policy changed from AS12695 to AS48693 with a last-modified timestamp of 2026-08-21T04:38:32Z. Yet IPtrace and Robtex still display the old AS12695 policy with a 2021-12-28 last-modified date, and IPinfo classifies AS210328 as Inactive with zero prefixes and a December 2021 update date.

PeeringDB record 19111 — short name ALMAZCLOUD, organization AO ALMAZ — self-reports zero IPv4 and zero IPv6 prefixes, 10–20Gbps of balanced traffic, and three Moscow facilities (Berzarina Data Center, IXcellerate MOS1, Moscow M9), but its fields were last updated 2022-07-27. Anyone sourcing this network from a single aggregator would draw a materially wrong conclusion, in either direction.

What follows is not an accusation and not a vindication. It is a boundary. The observable footprint of AS210328, as documented across these dated sources, is a small network that originates three IPv4 prefixes, announces two of them under valid ROAs, buys transit from three upstreams, and has no independently observed peering or downstream relationships. Its first-party commercial claims — direct physical peering to Yandex, Sberbank and Rostelecom among them — remain self-declarations that no routing observation in this evidence set corroborates.

The one thing a buyer, a peer or an abuse responder should do with this briefing is check the current RIPEstat routing status and the live BGP tables before relying on any of it, because every observation here is snippet-indexed with an unknown observation window, and this network's own registry object changed three days before this briefing's research snapshot.