The First New Address: Pursuing Zkillu, the Lead the Ladder Found

The Recidivists — Part 7

The synthesis of Part 6 ended with a promise rather than a conclusion. Of the seven dedicated-hosting providers the escalation ladder had fingered, five were already in this investigation's files — confirmations, not discoveries. But two were not, and one of those, Zkillu SAS, appeared in zero prior dossiers: a provider surfaced not by tracing registrar graphs or abuse feeds, but by the raw fact that five of its rented boxes attacked one apartment often enough to earn a block ban. Part 6 flagged it as a genuine new lead and left it there.

This letter picks it up. It is the moment the series turns from reading the ledger to acting on it — taking a single address the demand-side sensor produced and running it the way the corpus ran DMZHOST and the Phantom ASN: pull the registration, map the neighbours, find the front, and see what a thread the ladder handed up actually unravels into. What it unravels into is small, young, and instructive — a compact specimen of how grey hosting is stood up in 2026, and a template for turning every future subnet ban into a supply-side investigation.

A caution stated up front, because this letter is about a lightly-documented entity and honesty is the whole point of the series: much of what follows is structural evidence — registration ages, routing relationships, geolocation mismatches — which is strong for characterising a network and weak for naming intent. Where the evidence supports only "this looks like grey hosting," that is what it will say, and no more.

The subject: a two-year-old company with two decades-old blocks

Zkillu SAS holds AS215599, a French-registered autonomous system allocated on 2024-01-31 — a little over two years old at this writing. It is small in every dimension that can be measured. It announces exactly two IPv4 prefixes and two IPv6 blocks, single-homed behind one upstream, with no downstream customers of its own. This is not an infrastructure company; it is a leaf — a thin allocation at the very edge of the routing graph.

The two IPv4 prefixes are where it gets interesting, because they are far older than the company holding them:

• 31.56.58.0/24 — the block the ladder banned. Originally allocated 2011-01-28, it geolocates to the United Arab Emirates.
• 82.152.54.0/24 — the block the ladder never saw. Originally allocated 2003-11-10, it geolocates to the United Kingdom.

A two-year-old French company announcing a 2003 British prefix and a 2011 Emirati one is not organic growth. It is acquired address space — legacy /24s that predate Zkillu by a decade or two, transferred or leased into a young ASN and re-announced from France while still carrying their old geolocation. The corpus has a name for exactly this shape, from an earlier investigation: The Geography of Nowhere — registrant in one country, ASN in another, IP geolocation in a third, so that no single jurisdiction cleanly owns the accountability. Zkillu is a textbook small instance: French on paper, British and Emirati by IP, hostile in practice.

The acquired-legacy-space pattern matters beyond aesthetics. Old prefixes carry old reputation — or, more usefully to an abuser, old neutrality. A /24 first allocated in 2003 has two decades of being nobody's problem; it is not on the wholesale bulletproof blocklists because it was never a bulletproof range. Wrapping fresh malice in aged, geographically-scattered address space is the same "hide above consequence" move Part 6 documented in the grey midtier, executed at the level of the IP block itself.

The legacy-space market: why a 2024 company wants a 2003 block

The mismatch between Zkillu's age and its prefixes' ages is not an anomaly to note and move past; it is a mechanism, and it is worth understanding because it recurs across the grey-hosting economy. The reason a two-year-old ASN ends up announcing a prefix first allocated in 2003 is the IPv4 transfer market. The free pool of unallocated IPv4 exhausted years ago; the only way to obtain address space now is to buy or lease it from someone who was allocated it long ago. A thriving secondary market moves these legacy /24s between holders, and the registries record the transfers — which is how a French company minted in 2024 comes to announce a British block from 2003 and an Emirati one from 2011.

For an ordinary host, acquired legacy space is simply the only space available. For a grey operator, it carries a specific bonus: aged reputation is laundered reputation. A prefix that spent fifteen or twenty years as some unremarkable British or Emirati allocation accumulated no blocklist history, no threat-feed presence, no wholesale distrust — it was, for two decades, nobody's problem. Transfer it into a fresh ASN and point it at targets, and the attacks arrive from address space that every reputation system still regards as clean legacy allocation, not as known-bad bulletproof range. The abuser inherits the prefix's long innocence. It is the same "hide above consequence" logic Part 6 found in the grey midtier and Part 5 found in reputation-dampened cloud, pushed down to the level of the individual block: the value of the space is precisely that it has no record — and the escalation ladder, which builds its own record from scratch off local behaviour and consults no external reputation at all, is the one sensor immune to that laundering. It did not care that 31.56.58.0/24 looked like a clean 2011 Emirati legacy block. It counted five attackers and banned it.

This is also why the geographic smear is not incidental. The two prefixes geolocating to the UK and UAE while the ASN registers in France is not one operator being sloppy about GeoIP; it is the natural residue of buying prefixes from wherever they were available and announcing them from wherever the shell is incorporated. The Geography of Nowhere is, in part, just what the second-hand IPv4 market looks like when its customers are not trying to be locatable.

The footprint: everything observed is critical

For all its small size, Zkillu's observed behaviour is uniformly bad. Across the six addresses of its that the intelligence pipeline has records for, the abuse distribution is not mixed, not mostly-grey-with-some-bad. It is six of six in the critical (80–100) abuse bucket. Every Zkillu IP the corpus has seen is a critical-abuse address. The ASN's aggregate risk score sits at 82 — high, though notably not flagged bulletproof, which places it precisely in the grey tier of Part 6: bad enough to be all-attackers, clean enough to dodge the automatic bulletproof label.

The specific campaign that drew the ladder's attention was documented in Part 4: 31.56.58.0/24 produced a five-IP fleet — .122, .124, .127, .129, .134 — every one of them firing the same scenario, credential_harvest, until three of them crossed the subnet threshold and the whole block was banned on 2026-07-22. That date makes 31.56.58.0/24 the newest block on the entire subnet-ban roster — Zkillu is not a historical curiosity but an actively-firing range, caught in the act during the writing of this very series. The behavioural homogeneity is the same fingerprint Part 4 found everywhere: five addresses, one campaign, one operator's rented fleet wearing consecutive numbers in a small block.

Worth pausing on what credential_harvest actually is, because it names the whole point of the operation. Unlike the honeypot's SSH brute-forcers or the generic http-probing scanners, this scenario is a web-layer intent classification: the perimeter's autoban pipeline labelled these requests as hunting for exposed secrets — the patient sweep for .env files, .git directories, backup archives, configuration dumps, and unguarded login and API endpoints where credentials leak. It is the same behaviour that recurs across this investigation's corpus under the heading of the credential-harvesting economy: not an attempt to break a door, but a search for a key someone left under the mat. A five-host fleet running it in coordination is a small, disciplined credential-scanning operation, and the fact that it is the newest range to trip the ladder is a reminder that this economy is not winding down — it is provisioning fresh French shells and pointing them at the same exposed-secret surface as always. Zkillu is what the credential-harvest economy's supply chain looks like the week it was stood up.

The front: a managed abuse desk between the range and the complaints

Pull Zkillu's registration contacts and a second layer appears — the mechanism by which a hostile range keeps its landlord's hands clean. At the autonomous-system level, Zkillu wears an ordinary, branded abuse address: abuse@zkillu.fr. Tidy, on-brand, unremarkable. But descend to the inetnum level — the registration of the actual 31.56.58.0/24 block that did the attacking — and the abuse contact is different: report@abuseradar.com, listed under the organisation "Internet Utilities Abuse Contact" and the person Mathis AGOSTINI.

This split is worth naming precisely, because it is a structure and not an accusation. The range that fires the attacks routes its abuse complaints to a third-party managed abuse desk — abuseradar.com, listed under the organisation Internet Utilities Abuse Contact, a service that fields and processes abuse reports on behalf of the networks that hire it. There are entirely legitimate uses for such a service; small hosts outsource abuse handling routinely, the same way they outsource billing or DNS. But there is also a well-worn grey-hosting use, and the corpus has documented its cousins before — the abuse-report handling layer that sits between a hostile range and the people it attacks, absorbing complaints so the operator never has to.

The mechanism, stated neutrally, is this. When a victim network sends an abuse complaint about 31.56.58.0/24, it does not reach Zkillu; it reaches Internet Utilities, which processes it according to whatever policy it keeps. If that policy is diligent, the range gets cleaned up. If it is nominal — an auto-acknowledgement, a ticket number, a form reply, and no action — then the desk functions as insulation: a professional-looking front that converts an angry victim's report into a closed ticket while the range keeps firing. The two outcomes are indistinguishable from the outside, and deliberately so; the value of a compliant abuse desk to a grey host is precisely that it is procedurally correct and operationally inert. Whether abuseradar.com is the diligent kind or the inert kind is not something this perimeter can determine from thirteen bans, and this letter asserts neither. What it can say is documented and structural: the block that attacked us does not field its own abuse mail, its ASN wears a clean branded address while its attacking inetnum is handled by a named third party, and that separation — clean face at the top, managed buffer at the range — is itself a recognisable feature of how grey hosting presents. It is a lead to hand to whoever pursues abuseradar.com as its own node: which other hostile ranges does Internet Utilities field abuse for, and is the pattern of non-response consistent across them? That is a question about a service, and it is a good one.

The neighbours: a nest of young French shells — with a caveat

Follow Zkillu's single routing connection outward and it lands in a small, suggestive constellation. Its sole upstream — the one network that carries Zkillu's traffic to the rest of the internet — is EASIO-COM SASU (AS50124), a French autonomous system allocated 2023-01-04. Its one recorded peer is HaloAgency SAS (AS198607), a French AS allocated 2026-04-21 — barely three months old at this writing. Zkillu itself is 2024. Three French corporate shells — a SAS, a SASU, another SAS — all minted within roughly three years of one another, routing through and beside each other at the ragged edge of the graph.

The shape is familiar from the bulletproof corpus: clusters of freshly-registered corporate entities in a permissive jurisdiction, providing transit and peering to one another, is a recurring substrate of grey hosting. It is tempting to call this "one operator behind three shells," and the temptation must be resisted, because the evidence does not support it. Each of the three carries a distinct, branded abuse contact — abuse@zkillu.fr, abuse@easio-com.com, abuse@haloagency.fr — with no shared email, no shared handle, no registry object tying them to a common person. What connects them is routing and typology: a transit relationship and a shared profile (young, French, small, edge-of-graph). That is a real and reportable pattern — a cluster worth watching — but it is co-location in a network neighbourhood, not proof of common control. The same discipline that governed the OTX co-listings of Part 3 and the shared-maintainer artefacts of Part 6 governs here: shared substrate is not shared operator. The honest finding is a cluster of interest, not a unmasked conglomerate.

What would move it from cluster to conglomerate is the next tranche of work — pulling the full customer lists and announced space of EASIO-COM and HaloAgency, checking their ranges against this and other perimeters, and looking for the operational fingerprints (shared TLS certificates, reused SSH keys, common tooling) that survive across branded abuse contacts. That work is teed up, not done, and this letter marks it as the frontier rather than claiming it as a result.

The unwatched half

There is one more thing the ladder's lead reveals by omission. Zkillu announces two /24s, but this perimeter has only ever been attacked by one of them. Every observation in this series — the five-IP credential-harvest fleet, the subnet ban, the critical-abuse footprint — comes from 31.56.58.0/24. The other block, 82.152.54.0/24, the 2003 British-geolocated prefix, has never fired a packet at this apartment that the sensors recorded. It is, from this vantage point, dark.

That darkness is not evidence of innocence; it is evidence of the limits of a single perimeter. One vantage point sees only what is aimed at it. Zkillu pointed one of its two blocks here and, apparently, the other somewhere else — at targets this sensor cannot see. The subnet ban closed the door on 31.56.58.0/24; 82.152.54.0/24 remains a fully-loaded, uncharacterised half of the same small hostile ASN, and the only reason it is not in the ban list is that this particular door was never the one it knocked on. It is the clearest possible illustration of why the ladder's leads must be pursued outward, not just banned in place: the perimeter caught half of Zkillu by being attacked; the whole of Zkillu is only visible by taking the lead and looking past your own logs.

The checklist, made explicit

Because this letter is offered as a template, the method deserves to be written down as a method — the ordered questions that turned one banned /24 into the profile above, each answerable from open registries and the local ledger, none requiring privileged access:

1. How old, how big? Pull the ASN's allocation date and its announced-prefix count. Young-and-tiny (Zkillu: 2024, two /24s) is the grey-shell signature; old-and-large is usually a real carrier. This is the first sort.
2. How old is the space, and where does it geolocate? Compare prefix allocation dates and GeoIP to the ASN's registration. A young ASN on decades-old, geographically-scattered prefixes (2003 UK, 2011 UAE under a 2024 FR company) is acquired legacy space — laundered reputation and jurisdictional smear.
3. Whose transit? Find the single upstream. A leaf single-homed behind one small, similarly-young AS (EASIO-COM) is a different animal from one multi-homed behind tier-1 carriers. The upstream is the next node to pull.
4. Whose abuse mail? Compare the ASN-level abuse contact to the inetnum-level one. A clean branded address at the top with a managed third-party desk at the attacking range (abuse@zkillu.fr over report@abuseradar.com) is the insulation pattern — and the desk is its own lead.
5. What's the behaviour, and is it homogeneous? Read the local ledger. One scenario across the whole block (five hosts, all credential_harvest) is a single coordinated operation; mixed behaviour is co-located strangers.
6. What haven't you seen? List the ASN's other prefixes. The ones that never attacked you (Zkillu's 82.152.54.0/24) are the uncharacterised remainder — the reason to pursue the lead outward rather than stopping at the ban.

Six questions, one afternoon, one banned block turned into a characterised supply-side entity plus three onward leads (the upstream, the abuse desk, the dark prefix). That is the entire method, and it scales to every row in the Part 4 ban list.

The template

Zkillu is a small fish, and that is exactly why it is worth this letter. It is the first worked example of the Part 6 thesis in action — the demand-side sensor producing a supply-side target, and that target, pursued for one afternoon, resolving into a legible specimen: a young French shell, wearing two decades-old geographically-smeared prefixes, all of its observed addresses critical-abuse, its attacking range fronted by a managed abuse desk, nested among other young French shells it routes through but is not provably one with, and half of it still dark because this perimeter only sees what points at it.

None of that required special access. It required taking one address the ladder banned and asking the ordinary forensic questions in order — how old, how big, whose transit, whose abuse mail, which geographies, what else is nearby, what have we not seen. Every subnet ban in Part 4 is a thread that unravels the same way. Zkillu is simply the first one pulled. The recidivist ledger, it turns out, does not just record who to keep out. Read forward, address by address, it is a worklist — and this letter is the first item on it, crossed off and pointing at the next. Zkillu was the smallest, newest thread in the pile; it still unravelled into a legacy-space acquisition, a managed abuse front, a cluster of sibling shells, and a dark half nobody has yet looked at. The larger threads — Advin's eighteen-host block, the Bucklog cluster, the whole NextGenWebs /22 — are waiting, and they will unravel further.