AS53667

AS53667 is the network behind the BuyVM and Frantech.ca VPS brands, operated by FranTech Solutions and registered under ARIN to an address in Cheyenne, Wyoming. Founded by Francisco Dias around 2007, it is a budget KVM VPS host known for cheap "slices," optional DDoS-protected IPs, and an explicitly permissive acceptable-use policy. It is a small BGP network — roughly 47–55 IPv4 prefixes (~34,000–37,000 addresses) and ~35–48 IPv6 prefixes — taking transit from Cogent, Hurricane Electric, and UFINET, with partial RPKI coverage. The decisive triage consideration is that this is multi-tenant, shared, and often ephemeral VPS space: an analyst seeing a 209.141.x.x or 104.244.7x.x address should treat it as a rented VPS that may rotate between unrelated customers, so any observed behavior attaches to a tenant rather than to the operator. FranTech is also one of the larger Tor-exit-hosting ASNs by the operator's own account. Its abuse-dataset presence is real but roughly proportional to its size, and the operator publicly engages abuse reports and terminates for malicious use; no sanctions or law-enforcement action against the operator was found as of June 2026.

Operator

FranTech Solutions (ARIN OrgId SYNDI-5; abuse/tech contact Francisco Dias) [Confirmed] — ARIN RDAP

Country / RIR

US (Cheyenne, WY), ARIN [Confirmed] — ARIN RDAP

Allocated

ASN RegDate 2010-11-19 (org RegDate 2010-07-21) [Confirmed] — ARIN

Org status

active — frantech.ca / buyvm.net

Security/abuse context (NEUTRAL, DATED, SOURCED — multi-tenant)

shared/ephemeral VPS IPs; abuse attaches to tenants, not the operator. Scamalytics describes FranTech as "potentially medium fraud risk," ~67,797 IPs mostly running VPNs/proxies/servers/Tor exits [Scamalytics, ongoing]. AbuseIPDB shows individual BuyVM IPs with many reports (e.g., a Tor-exit-labeled 104.244.74.55) [community-sourced]. A 2019 Bromium Labs study (via BleepingComputer) named FranTech among hosts whose servers appeared in Necurs-botnet malware-distribution infrastructure [Bromium/BleepingComputer, 2019]. Operator engages abuse reports on LowEndTalk and terminates for malicious use. No sanctions/LE action found as of 2026-06-07 — scamalytics.com, bgp.tools

Network & routing

Network type

hosting-VPS (free-speech/abuse-tolerant budget VPS; brands BuyVM, BuyShared) [Confirmed]

Size

~47–55 IPv4 prefixes (~34,048–37,376 addrs), ~35–48 IPv6 — bgp.he.net / bgp.tools (2026-06)

Routing/peering

~417 peers, 5 upstreams; upstreams incl. Cogent (AS174), Hurricane Electric (AS6939), UFINET (AS52468); 2 IXes; RPKI partial (~77 valid, 7 invalid, IPv4) — bgp.tools, bgp.he.net

Notable usage

operates BuyVM / Frantech.ca VPS brands — cheap KVM VPS, DDoS-protected IPs (via Path.net/Voxility), permissive AUP; founded ~2007 — frantech.ca / buyvm.net

Related ASNs

sibling AS63018 (FranTech). NOTE: AS3842 (RamNode) is a SEPARATE operator and must not be conflated with FranTech [Likely]

Analyst note

Multi-tenant shared/ephemeral VPS — attribute to a tenant, not FranTech. Also a notable Tor-exit-hosting ASN, so some IPs are anonymity endpoints with unreliable per-IP geolocation.