I don't know who was ultimately the upstream reseller or hosting provider. These were all dodgy fly-by-night resellers of resellers that were in the same place. Their CIDR blocks are still active and I still get bad traffic from them. Each CIDR block was swipped out to each reseller.