📞 One telephone number in the Indian Ocean, holding four 'independent' companies together

Pull the contact records for a Hong Kong cloud called Yisu, a Singapore cloud called Scloud, and you find something a coincidence cannot explain: the same support identity, Cloud Innovation Support, the same address tech@cloudinnovation.org, and the same telephone number in the Seychelles — +248-4-610-795 — stitched across AS135377, AS138152, AS142002 and AS142403. Four autonomous systems that present to the world as separate, unrelated, differently-flagged businesses are reachable through a single phone in an archipelago of 100,000 people off the coast of East Africa. That number is the connective tissue of the entire cluster. It is the thread that, pulled, unravels the costume.

Seychelles is not in this story for its beaches. It is here because an International Business Company there discloses no beneficial owner, charges 0% tax, and offers nominee directors as a standard product. It is the legal equivalent of a blank face. So when Chinese-operated capacity routes through Hong Kong intermediaries and Singapore points of presence but registers in the Seychelles, the registration is not where the business is — it is where the business cannot be followed.

🛰️ The famous, the faceless, and the one that is simply a crime scene

The cluster spans the entire respectability spectrum, which is precisely why it is instructive. At the top sit names you know: Tencent, and BytePlus — the enterprise cloud arm of ByteDance, the company that owns TikTok. Their addresses appear in the attack set not because Shenzhen ordered an SSH brute-force, but because hyperscale clouds rent compute to anyone with a card, and abuse control lags abuse. We hold this firmly: presence is high-confidence; corporate intent is not. A honeypot caught a credential like claude:claude being tried from this space — the attackers are guessing at the names of the very era we live in.

At the bottom sits Omegatech (AS202412), and there the hedging stops. Independent research by Breakglass describes this single Seychelles-flagged /24 as hosting 67 command-and-control servers across 16 malware families; abuse.ch's ThreatFox tracks it; Spamhaus drops the whole AS. Inside our own honeypot it produced 753 successful logins and actually ran system-discovery commands — the behaviour of an operator, not a stray VM. Between Tencent's plausible deniability and Omegatech's naked criminality lie the shells — Yisu, YSZ (whose registrant leaked the ordinary Gmail address zengshiyu1992@gmail.com), Scloud — the reseller layer where a mainland operation buys a Hong Kong face and a Seychelles silence.

🏛️ The Official Scaffolding — Institutional Anchors

Nothing at this scale operates without anchors in official structures — Regional Internet Registries, company registrars, state telecoms, regulators, financiers, carriers, and law enforcement. These are the documented anchors (sourced). The inferred ones live in the conspiratorial section below.

The connective tissue of this cluster is not a server — it is a piece of internet governance history. The shared cloudinnovation.org / +248 contact resolves to Cloud Innovation Ltd, the very entity at the centre of the long, bitter litigation against AFRINIC, the African Regional Internet Registry — a fight over millions of allegedly hoarded IPv4 addresses that nearly broke the registry. That entity is registered CIS1-AFRINIC and sits under the Seychelles Financial Services Authority. Around it, APNIC anchors Yisu, Scloud and UCloud, and the single Seychelles contact stitches four nominally-separate ASNs together. Above them tower the giants with dual state anchors: ByteDance/BytePlus, simultaneously investigated by the US Treasury's CFIUS and bound to PRC CAC oversight; Tencent, sitting under a Beijing golden-share entity. At the criminal floor, Omegatech is carried on Spamhaus DROP and abuse.ch ThreatFox. The same cluster touches a UN-adjacent registry war and two of the world's most politically-scrutinised technology companies.

🎯 Actors & Entities

🌐 Infrastructure & Indicators (IOCs)

Threat = composite 0–100 score from honeypot activity + multi-source enrichment.

🔎 Findings

🕳️ The Conspiratorial Read — Questions & Calibrated Answers

Each answer states what the evidence supports and labels where a claim is unproven. Questions are instruments: they pry loose the partial truths the flat record hides.

🔗 Linked Dossiers

• TI-020A — master thesis
• TI-019 "Shadow Nexus" — Tencent/BytePlus weaponization context
• TI-020E — Omegatech & offshore-shell registrants recur in the European cluster
• TI-019K — Omegatech (Seychelles) also a vertex of the w1n Quadrant

📎 Sources & Evidence Chain (17 items)

Every claim above is anchored to a primary source. Full machine-readable evidence in Postgres dossier_intel (investigation 019M).