Summary

  • AS210328's valid RPKI coverage exists for exactly two of its three announced IPv4 prefixes; the ROA covering 185.136.15.0/24 carries a not-before timestamp of 20 August 2026, roughly 4.5 years after the ASN was created on 27 December 2021.
  • That ROA was created one day before the RIPE aut-num object was repointed toward AS48693 on 21 August 2026, and four days before the only covering ROA for the disputed prefix 185.218.138.0/24 — held by a different operator, AS205997 — was revoked on 24 August 2026.
  • AS205997, registered to the same private individual (Vlad Cojuhari) who holds the RIPE registrations of two of AS210328's three prefixes, also held or holds an ROA over 185.136.15.0/24 — extending an overlapping-claim pattern to a second prefix.
  • Observed topology remains transit-only across three small upstreams with wildly asymmetric collector visibility; the company's advertised direct peering to Yandex, Sberbank and Rostelecom remains uncorroborated by any routing observation.
  • A disputed IPv6 PI /48 (2001:67c:29c::/48) is attributed to AS210328 by some mirrors and denied by others; its RPKI status cannot be verified from available sources.
  • No substantive change is detectable in any retrievable source since 26 September 2026, and every registry timestamp is older than 21 August 2026 — the network's paper trail has effectively been frozen for over five weeks.

Routing security is usually discussed as a property networks either have or lack. For most of the internet's history, that framing was adequate: a prefix was either announced or not, and the only assurance a neighbour had was the word of whoever filed the routing objects. Resource Public Key Infrastructure (RPKI) changed the evidentiary texture of that question. A ROA — Route Origin Authorization — is not a claim in a text file; it is a signed cryptographic object with explicit validity boundaries, published in a repository, carrying a not-before timestamp and a not-after expiry. When a network acquires one, it leaves a dated footprint.

When one is revoked, that revocation is dated too.

That evidentiary property is what makes AS210328's late-August 2026 worth reading closely. The autonomous system is registered in RIPE to ORG-ZA238-RIPE — AO ALMAZ, a Russian organisation with registration number 1196501003357 and organisation-type OTHER — with status ASSIGNED, created 27 December 2021, sponsored through ORG-DNJ1-RIPE (IPGeolocation; RIPE DB query). The organisation object was last modified on 13 May 2026. The aut-num object itself was last modified on 21 August 2026 at 04:38:32 UTC — a date that, as prior BTW coverage established, corresponds to a repointing of the object's routing policy toward AS48693.

What the earlier coverage did not develop is what the cryptographic layer shows around those same dates. The rpki-client validation console lists exactly two ROAs published for AS210328 in the RIPE repository: one covering 77.91.65.0/24 and one covering 185.136.15.0/24, both with maximum prefix length 24, both validating OK (rpki-client console, AS210328). The individual ROA object covering 185.136.15.0/24 — object identifier E442yFoubLa9bbHQX2sPzSASVTE — carries a not-before of 20 August 2026, 06:30 UTC, and a not-after of 1 July 2027 (ROA E442yFoubLa9bbHQX2sPzSASVTE). Read plainly: AS210328's cryptographic assurance over its second prefix did not exist, in its current form, until 20 August 2026 — roughly four and a half years after the ASN was allocated.

The timing is not incidental. The ROA was created one day before the aut-num policy change of 21 August 2026. It was created four days before the certificate of the only covering ROA for 185.218.138.0/24 — an ROA with asID 205997, signed 18 February 2026, whose certificate was revoked on 24 August 2026 at 05:53:28 UTC — was revoked (revoked ROA d_jfHKcWqSUAsdXVXLjJb7Gc6bo). Within a four-day span, 20–24 August 2026, the network's cryptographic and registry posture both changed: a new ROA appeared, the registry object was rewritten, and a competitor's covering certificate disappeared. Prior BTW reporting documented the registry edit and the revocation in outline; the ROA not-before timestamp is the element that had not been developed, and it is the element that gives the window its shape.

What the three prefixes are, and who holds them

AS210328 originates three IPv4 /24 prefixes, and their registration ownership is itself a finding. 77.91.65.0/24 is registered to IP-FI/Foton Telecom. The other two — 185.136.15.0/24 and 185.218.138.0/24 — are registered in RIPE to a private individual, Vlad Cojuhari, rather than to the corporate operator AO ALMAZ (IPGeolocation; bgp.he.net). A network marketing enterprise cloud connectivity is announcing, as two of its three prefixes, resources whose RIPE registrations belong to a named private person.

Aggregators disagree about how many of these prefixes are actually announced, and the disagreement is itself informative. The ping.pe record lists all three prefixes under AS210328 origin with per-prefix RPKI verdicts of VALID, VALID and NOT-FOUND respectively (ping.pe). Hurricane Electric's toolkit reports 3 prefixes originated but only 2 announced in IPv4, and zero in IPv6 (bgp.he.net). IPregistry, whose record is self-stated as updated 21 August 2026, reports 2 IPv4 ranges announced plus 1 IPv6 range (IPregistry). These are not contradictions of fact so much as differences of observation window and deduplication rule — but they mean any statement about what AS210328 "currently announces" must be dated and source-attributed, not asserted flatly.

The third prefix's status is the sharpest edge of the picture. 185.218.138.0/24 is multi-origin (MOAS): it appears under AS209630 (LLC VASH KREDIT BANK), AS205997 and AS210328. After the 24 August 2026 revocation of the only covering ROA, it has no valid RPKI coverage at all, which makes it effectively unreachable to any RPKI-enforcing network. The marketed product of this company — BGP announcement services starting at 99 USD per prefix — is sold by a network whose own third prefix cannot pass the validation gate that its prospective customers may themselves enforce.

The overlapping-ROA pattern on a second prefix

Prior coverage framed 185.218.138.0/24 as the contested prefix. The current evidence extends that pattern. The rpki-client console page for AS205997 — the ASN also registered to Vlad Cojuhari — lists an ROA over 185.136.15.0/24 with maximum length 24 (rpki-client console, AS205997). That is the same prefix for which AS210328 now holds a valid ROA created on 20 August 2026.

Two qualifications are required, and both come from the evidence itself. First, overlapping ROAs on one prefix are not automatically an RPKI violation: two different origin ASNs can each legitimately hold authorisation from the resource holder. But when the two asserting origin ASNs are linked to the same private individual who holds the RIPE registrations, and one of the pair's earlier covering certificate was revoked mid-window, the pattern stops looking like routine co-authorisation and starts looking like an unresolved control question.

Second, the two rpki-client console mirrors disagree on AS205997's prefix set — one lists only 185.136.15.0/24, the Amsterdam mirror lists both /24s — and the current validation state of AS205997's ROA over 185.136.15.0/24 is not determinable from the retrieved material. The overlap is documented; its current validity is not.

Topology: what routers actually see

The observable topology of AS210328 has not changed since prior coverage, and its asymmetry is worth restating with numbers. Three upstreams are observed: AS202425 (IP Volume inc, Seychelles), AS201814 (MEVSPACE sp. z o.o., Poland) and AS48693 (Rices, a privately owned enterprise in Ukraine). Collector visibility across them is wildly uneven — on the order of 290, 267 and 1 sightings respectively — and the only upstream formalised in the RIPE aut-num's import/export policy is AS48693, which is precisely the least-visible of the three (IPGeolocation; bgp.he.net). Zero peers are observed. Zero downstream networks are observed.

Against this, the company's own commercial presentation on almazcloud.network advertises direct physical peering to Yandex, Sberbank and Rostelecom, traffic levels of 10–20 Gbps, and a product ladder from a 9-dollar corporate VPN to 499-dollar physical cloud-connect ports. No routing observation corroborates any of it. A network with three small upstreams and no observed peers is, in the observable record, a transit customer — not a network offering physical interconnection to Russia's largest platforms.

This gap between the sales catalogue and the routing record was the core of the 26 September BTW report; the present evidence adds only confirmation that nothing has moved since.

The IPv6 question that won't close

AS210328 holds an IPv6 PI allocation: 2001:67c:29c::/48, designation RU-DINET-20211227, ASSIGNED PI to AO ALMAZ within the RIPE NCC service region (IPregistry; tom.be subnet mirror). What cannot be established from available sources is whether the prefix is currently announced. Two mirrors — tom.be's subnet page and IPregistry — attribute an active route for the /48 to AS210328. Hurricane Electric and IPGeolocation both report zero IPv6 prefixes for the ASN (bgp.he.net; IPGeolocation). No RPKI console listing shows any IPv6 ROA for AS210328 (rpki-client console, AS210328).

This is a genuine open question, not a rhetorical one. If the /48 is announced without an ROA, it is IPv4's problem repeated in v6: an origin claim with no cryptographic assurance, from a network whose entire v4 validation posture was assembled in a single four-day window. If it is not announced, the mirrors attributing a route to it are stale. Either way, the discrepancy between mirrors is itself a finding about how poorly third-party freshness serves this small corner of the routing table — a theme the 26 September briefing developed for IPv4 and which the IPv6 evidence extends.

What has not changed — and what that proves

The most recent registry timestamp in the entire evidence set is 21 August 2026. The most recent cryptographic event is the 24 August 2026 revocation. No retrievable source shows any substantive change since the 26 September 2026 briefing: identical prefix set, identical VALID/VALID/NOT-FOUND split, identical three-upstream topology (BTW briefing, 26 September; BTW sequence report). For more than five weeks, the network's verifiable paper trail has been static.

Static paper trails are themselves evidence. A network selling routing services as a product needs its origins to validate reliably; this one let its third prefix go without covering ROA for over a month while continuing to advertise announcement services. A network claiming direct peering with major Russian platforms would, over five weeks of continued observation, be expected to show some topological trace of them; none appears.

The timestamps that do exist — 20, 21 and 24 August 2026 — cluster around the one documented governance event in the network's recent life, and they tell a coherent story: cryptographic cover for one prefix was acquired, the registry object was rewritten toward one upstream, and a competitor's cover over the disputed prefix was removed. What that sequence means operationally is a question for the operator; what it proves evidentially is that the network's routing-security posture, as it stands today, is a five-week-old construction.

A final evidentiary caveat belongs in the body of this report rather than a footnote. This research pass is search-snippet level: no full-page retrievals succeeded, verbatim publisher passages beyond snippets were not inspected, and the two primary targets — the bgp.tools ASN page and the RIPE Database web UI — were not retrievable during the run (bgp.tools; RIPE DB). Observation windows for the aggregator snapshots are unknown. Every date cited above is, however, a timestamp printed by a registry or validation console, not an inference, and the converging structure of the evidence — registry layer, cryptographic layer, routing-observation layer — holds across independent mirrors. Where mirrors contradict each other, this report has said so explicitly rather than resolving the contradiction by preference.