"the CTU research team provided the BGP evidence to the upstream ISP closest to the origin of the malicious activity."

I think this likely means it's a smaller ISP.