Summary

The registration record for Thanh Trang Cloud Computing and Technology Company Limited reads like the profile of a functioning cloud operator. A company registered in Ho Chi Minh City in February 2024 holds an APNIC portable allocation — IPv4 block 157.66.252.0 through 157.66.253.255, netname THANHTRANG-VN — with the administrative and technical contact listed as BTT4-AP, an abuse mailbox at cloudthanhtrang.online, and maintenance under MAINT-VN-VNNIC. https://records.ping.pe/whois/157.66.252.0/23 The same organization holds its own autonomous system number: AS151934, as-name THANHTRANG-VN, allocated on 9 October 2023 within the VNNIC-managed AS block AS151851 through AS151950. https://ipgeolocation.io/browse/asn/AS151934

Then the operational record diverges from the registry. AS151934 announces nothing. Not one IPv4 prefix, not one IPv6 prefix. IPinfo lists the ASN with zero prefixes and zero addresses and marks it Inactive; IPGeolocation's APNIC-derived record independently shows zero routes of either family. https://ipinfo.io/AS151934 https://ipgeolocation.io/browse/asn/AS151934 The only route that carries Thanh Trang's address space into the global routing table is announced by a different autonomous system altogether — AS150820, as-name LIENVPS-VN, registered to LIENVPS TECHNOLOGY COMPANY LIMITED at an address in Hoa Hoi Village, Xuan Canh Commune, Song Cau Town, Phu Yen Province. https://bgp.he.net/AS150820 The APNIC route object for the block states this explicitly: route 157.66.252.0/23, descr THANHTRANG-VN, origin AS150820, last modified 13 May 2024. https://records.ping.pe/whois/157.66.252.0/23

This split between resource holding and routing operation is the whole story, and previous reporting on Thanh Trang has covered it from two directions: a July 2026 company research piece framed the dependency in hosting-capacity terms, and a piece published earlier on 4 October 2026 examined the RPKI-valid path originating from another operator. What neither piece examined is the structure that makes such arrangements durable: AS150820 is not an anomaly attached to one registrant. It is a hub. Its authorization records cover a dozen or more /23 blocks belonging to different organizations, and aggregator tables map those blocks to names such as Proxy VN, PVH Technology, AZVPS, Vietnam Physical Server, HT Proxy, VUTA Viet Nam, Top Proxy and STNC, alongside Thanh Trang. https://ipgeolocation.io/browse/asn/AS150820 One routing identity, many registered owners. Thanh Trang's arrangement is one instance of a pattern.

The technical facts are unusually well-documented for a small operator. AS150820 originates thirteen IPv4 prefixes and no IPv6 prefixes, all thirteen carrying RPKI Originated Valid status, totalling 6,656 IPv4 addresses. https://bgp.he.net/AS150820 CIDR Report characterizes it as origin-only: an Originate figure of 6,656 addresses with Transit at zero, meaning the network carries no transit traffic for others. https://www.cidr-report.org/cgi-bin/as-report?as=AS150820&v=4&view=2.0 Its observed adjacencies are two upstreams — AS18403, FPT Telecom Company, one of Vietnam's largest consumer and enterprise carriers, and AS140810, Megacore Technology Company Limited. https://bgp.he.net/AS150820 The observed AS path for Thanh Trang's block reads 4777 2516 18403 18403 150820: a route that leaves the network through FPT Telecom's upstreams and reaches the global table on their coattails. https://www.cidr-report.org/cgi-bin/as-report?as=AS150820&v=4&view=2.0

The cryptographic layer reinforces the same structure. A single APNIC ROA under AS150820 covers 157.66.252.0/23 with maximum length 23, alongside 157.15.38.0/23, 157.20.62.0/23, 160.22.172.0/23, 160.22.174.0/23, 160.30.190.0/23, 160.187.120.0/23, 160.191.176.0/23, 160.191.240.0/23, 160.250.46.0/23, 161.248.208.0/23 and 165.99.14.0/23 — each at maximum length 23, each a block registered to a different holder. https://console-ams.rpki-client.org/AS150820.html A second ROA covers 36.50.174.0/23, 103.70.114.0/23, 203.175.96.0/23 and several IPv6 /48s. https://console-ams.rpki-client.org/AS150820.html A maximum length equal to the prefix length means no more-specific announcement is authorized: the ROA does not merely permit AS150820 to originate the block, it forecloses any valid announcement by anyone else, including the registered holder's own ASN. If AS151934 attempted to originate 157.66.252.0/23 today, RPKI validation would return Invalid, and any conforming peer of a validating network would reject the route. The registry has been configured so that the registered owner cannot route its own addresses without invalidating itself.

It is worth pausing on what that means. Route Origin Authorizations were designed as a defence against hijacking — a way for resource holders to state, cryptographically, which autonomous systems may announce their prefixes. Here the authorization instrument has been created by, or in the name of, the operating party rather than the resource holder. The ROA is legitimate and valid; validation will pass. But its effect is to lock the address space to one operator's identity, regardless of what the registrant listed in the inetnum record wants or does.

The mechanism that was built to prevent unauthorized announcements has become the mechanism that enforces a particular delegation structure — with the registered holder on the wrong side of its own authorization.

Aggregators disagree about how to name this arrangement, and the disagreement is itself informative. IPGeolocation's route table maps 157.66.252.0/23 to the ISP name Thanh Trang Cloud Computing and Technology Company Limited while listing AS150820 and LIENVPS in adjacent columns. https://ipgeolocation.io/browse/asn/AS150820 CIDR Report attributes the same prefix to AS150820 without mentioning Thanh Trang. https://www.cidr-report.org/cgi-bin/as-report?as=AS150820&v=4&view=2.0 One row in the same IPGeolocation table lists the origin-name for 160.191.176.0/23 as the Vietnam Internet Network Information Center itself, which almost certainly reflects a registry data artifact rather than VNNIC operating a proxy network. https://ipgeolocation.io/browse/asn/AS150820 A monitoring system that relies on any single aggregator would draw a different conclusion about who controls this address space than a system that reads the registry, the ROA and the routing table together. Attribution in delegated-routing structures is not a lookup; it is a reconciliation problem.

The timeline adds one more wrinkle. AS151934 was allocated on 9 October 2023, according to the APNIC aut-num record mirrored by IPGeolocation. https://ipgeolocation.io/browse/asn/AS151934 The company Thanh Trang Cloud Computing and Technology Company Limited appears in Vietnamese corporate registration from 22 February 2024. https://vnbis.com/products/companies/translated-name-thanh-trang-cloud-computing-and-technology-company-limited-2860121/ An autonomous system number was reserved in the name of a legal entity that, on the public record, did not yet exist as a registered company — a sequence consistent with Vietnamese practice, where VNNIC-managed assignments can be initiated by unregistered ventures before incorporation completes, but also a sequence that makes the registry's entity attribution a snapshot of intent rather than a verified corporate identity. The inetnum and aut-num records were last modified on 8 May 2024, and the route object on 13 May 2024 — a tight cluster of updates in the same week, five days after the company registration. https://records.ping.pe/whois/157.66.252.0/23 Whatever assembly process put these pieces together, it happened largely in May 2024.

What does the hub structure do for the registrants? The economics are visible in the shape of the network. A Vietnamese entity that obtains a portable /23 from APNIC through VNNIC cannot announce it from a residential connection or a rented virtual server; it needs a routing relationship with a network that participates in the global table. For a small company without its own peering or transit contracts, acquiring an ASN is the easy part — the registry will issue one — while acquiring a place in the routing system is the hard part. An operator like AS150820 sells exactly that: it holds upstream relationships with FPT Telecom and Megacore, originates the customer's prefix under its own ASN, and wraps the arrangement in a valid ROA so that the route survives RPKI filtering. The registrant keeps the registry record in its own name — the portable allocation remains Thanh Trang's — while the routing identity, and therefore operational control of reachability, sits with the hub. https://records.ping.pe/whois/157.66.252.0/23 https://bgp.he.net/AS150820

This is not inherently abusive. Sub-allocation and managed routing are ordinary industry practices; countless small operators worldwide reach the internet through a provider's ASN with proper Letters of Authorization and customer-origin ROAs. The significance of the Thanh Trang case is what the public record does and does not let an observer verify. The registry layer is legible: who holds the block, who holds the ASN, what the route object says, when each record changed. The routing layer is legible: which ASN originates the prefix, through which upstreams, under which cryptographic authorization.

What is not legible is the layer in between — whether a written agreement exists, what it obliges either party to do, who pays whom, and under what conditions Thanh Trang could take back its own routing. No public document answers any of those questions. An investor or enterprise customer evaluating Thanh Trang as a cloud provider can see that its address space depends on another company's network and cannot see on what terms.

The dependency has concrete operational consequences. Reachability for 157.66.252.0/23 depends on AS150820's health, its upstream relationships and its continued willingness to announce the block. The observed path runs through FPT Telecom; if that adjacency fails, the block's visibility depends on whatever resilience the hub has arranged, and the public record shows none beyond a second upstream peer. https://www.cidr-report.org/cgi-bin/as-report?as=AS150820&v=4&view=2.0 https://bgp.he.net/AS150820 Conversely, AS150820's fate binds all of its registrants at once: any routing problem that affects the hub — a filtering incident, a settlement dispute with an upstream, a revocation of the ROA key — would affect every block it originates simultaneously, including those of unrelated companies that may believe they operate independently. The structure trades the registrant's routing autonomy for the hub's economies of scale, and the bill for that trade arrives in correlated failure modes.

The RPKI dimension deserves its own accounting, because it cuts against the usual narrative that validation improves attribution. In this structure, a valid ROA is evidence of delegated control, not of the holder's own operation. A security team that treats RPKI-valid as meaning legitimate-and-self-operated would classify 157.66.252.0/23 as a normally operated network of AS150820 and never notice that the registry names a different organization.

A team that cross-checks registry and routing data would flag the mismatch but still could not determine from public sources whether it reflects a routine managed-routing contract, a resource-leasing arrangement, or something the registrant did not knowingly authorize. The evidence supports all three readings. This is precisely the class of ambiguity that route-security tooling does not surface, and the Thanh Trang /23 is a compact demonstration of why registry-versus-routing reconciliation must remain a manual analytical step rather than an automated pass.

There is also a signal here about Vietnam's number-resource ecosystem. The hub's client list — proxy services, virtual private server brands, small technology companies — reflects how address scarcity and entry barriers interact at the bottom of the market. Portable IPv4 allocations are scarce and valuable; the administrative path through VNNIC is real but slow; and the technical path to global visibility requires relationships most small registrants cannot build alone. A shared-origin hub converts that friction into a service. The pattern is not unique to Vietnam — similar structures exist wherever registration is accessible and routing is expensive — but the concentration of Vietnamese registrants under one APNIC-member ASN with a dozen-plus ROAs makes the structure unusually legible in this case. https://console-ams.rpki-client.org/AS150820.html https://ipgeolocation.io/browse/asn/AS150820

For Thanh Trang specifically, the boundary of the public record is firm. It holds a portable /23 and a silent ASN; another company's network carries its addresses to the internet, under an authorization that excludes its own; and no public document explains the arrangement between them. Every element of that sentence traces to a dated registry or routing source. What lies beyond the boundary — the commercial terms, the existence of actual infrastructure, the recoverability of routing control — is not ascertainable from the sources examined here, and an article that claimed otherwise would be inventing facts.

The verifiable story is the delegation structure itself, and it is enough.