The Invisible Infrastructure

Executive Summary

In 034A — The Empty Column, we documented a statistical anomaly: Israel — a nation of 10 million people with the world's highest per-capita cyber capability — appeared in our 8,000+ IP threat intelligence database with exactly 7 IPs and 0 honeypot hits.

This letter reveals what happens when you stop searching by country field and start tracing by operator nationality.

This is not a coincidence. It is the most sophisticated geographic registration arbitrage we have documented in 31 prior investigations. An Israeli national operates from Bavaria. His companies register in Seychelles. His ASNs host in Netherlands. His bulletproof clients attack from Luxembourg. Every layer of indirection removes one more trace of origin.

And beyond this measurable infrastructure, two additional invisible layers — Bright Data's 150 million residential proxy IPs and Kape Technologies' VPN empire — create attack surfaces that are structurally impossible to attribute.

The Three Layers of Israeli Infrastructure

We discovered the true footprint through three progressive searches, each revealing infrastructure invisible to the previous method:

Layer 1: The Visible Seven

Seven Israeli IPs exist in our database. All belong to consumer ISPs — Partner Communications, Pelephone, Cellcom. None has a single honeypot interaction.

This is what 034A documented. A conspicuous absence from a nation that produces more cyber tools per capita than any other country on Earth. The question was: where is the infrastructure?

The answer is: everywhere except Israel.

Layer 2: The Kamatera Shell Game

Kamatera Inc. was founded in Israel (Tel Aviv headquarters). Today it operates under at least 8 different entity names across 5 ASNs in 3 regional internet registries:

Additional names include: Global Cloud Infrastructure LLC, Cloud Web Manage, IRT-KAMATERAINC-AP. The same Israeli company uses different legal wrappers in every jurisdiction. 315 Madison Avenue, NYC — their ARIN registration address — is a virtual office service.

DNS reveals a deeper layer: omc.co.il — OMC Group, an Israeli cloud services provider — resolves on Kamatera's Spain and Netherlands infrastructure. The Israeli connection is there, but you have to read DNS records to find it.

Seven Kamatera IPs appear in our database. One is an active attacker:

Layer 3: The Mishayev Ecosystem

This is where the investigation transforms from a statistical curiosity into a forensic case study.

An Israeli national, operating from a Bavarian village, provides a service called whitelabel.sh — literally a turnkey system for creating branded autonomous systems. His clients are uniformly Spamhaus DROP-listed:

Note the registration countries: Seychelles, Germany, United States. Never Israel. Yet the operator — the single individual whose RIPE record says country=IL — controls all of them.

The Top Attacker: 94.154.35.215

Campaign Coordination Across ASNs

HASSH fingerprint analysis reveals that the nominally separate ASNs share operational tooling:

• hassh-a7a87fbe86774c2e: Links Omegatech IPs (94.154.35.215, 178.16.54.226) with Private Layer Switzerland (179.43.x.x) — a 4-node coordinated attack cluster
• hassh-2ec37a7cc8daf20b: 12-node cluster spanning Omegatech (Turkey, Germany, Netherlands), TechTies (Netherlands), and external providers (DigitalOcean, Scaleway, FranTech)
• hassh-63ae64767f334c6a: Includes 91.92.243.49 (Omegatech, Netherlands)

These shared SSH client fingerprints prove that the "separate" ASNs operated under separate Seychelles IBCs are running identical attack toolkits. The corporate separation is cosmetic. The operational infrastructure is unified.

Third-Party Validation: GBHackers / Intrinsec

Our honeypot data (930 hits from the Mishayev ecosystem) is independently confirmed — and dramatically exceeded — by third-party research.

Our 930 hits represent 0.14% of the attack volume documented by Intrinsec in a single month. This is not a small-time operation. This is industrial-scale malware infrastructure operated by an Israeli national through a chain of shell companies that makes the origin invisible.

The Layers You Cannot See

The three measurable layers — Israeli ISPs, Kamatera, Mishayev/Pfcloud — account for 51 IPs and 961 hits. But Israel's cyber footprint extends into infrastructure that is structurally impossible to detect with honeypots.

Bright Data: 150 Million Exit Nodes

Bright Data Ltd. (formerly Luminati Networks), headquartered in Netanya, Israel, operates what they describe as the world's largest residential proxy network: 72 million to 150+ million IP addresses across 195 countries.

The company grew from Hola VPN — which was caught in 2015 selling its users' bandwidth as commercial proxy exit nodes without consent. Rather than shutting down, the proxy business was spun out as Luminati, then rebranded as Bright Data.

Bright Data's annual revenue is estimated at $500 million+. Their client list reportedly includes Fortune 500 companies, but also — as documented by the Swedish digital rights organization Qurium — entities that used their infrastructure to DDoS Philippine human rights organizations.

Zero Bright Data IPs appear in our honeypot. That is not because they're not involved in our traffic — it's because residential proxy IPs are attributed to the home user's ISP. If an attacker routes through Bright Data's network, our database records it as Comcast, AT&T, or Deutsche Telekom. The Israeli infrastructure is structurally invisible.

Kape Technologies: The Privacy Empire

If Bright Data controls the proxy layer, Kape Technologies controls the VPN layer — and the review ecosystem that recommends VPNs.

Read that timeline again. A company founded by a convicted fraudster, evolved from an adware platform, co-led by a Unit 8200 alumnus, now controls four of the world's most popular VPN services AND two of the largest VPN review sites that recommend them. Then it was taken private, removing all public reporting obligations.

This is documented extensively in our prior investigations (TI-2026-023D: The Trust Chain). What's new here is the pattern match: Kape is another Israeli-founded company where the origin is systematically obscured. ExpressVPN appears to customers as a British Virgin Islands company. CyberGhost appears Romanian. PIA appears American. The Israeli founding origin appears nowhere in the consumer-facing brand.

The Unit 8200 Pipeline

Unit 8200 is the Israeli Defense Forces' signals intelligence unit — the equivalent of the NSA, but with a unique characteristic: its alumni systematically found private-sector companies.

According to DropSite News, hundreds of former Unit 8200 operatives now work at Microsoft, Google, Amazon, and other major technology companies. Bismarck Analysis documented that the unit's alumni have "founded hundreds of cybersecurity companies."

This pipeline explains WHY Israel doesn't need visible hosting infrastructure:

• NSO's Pegasus runs on target phones — the customer's infrastructure
• Cellebrite's UFED runs in police stations — the customer's infrastructure
• Check Point firewalls run in enterprise networks — the customer's infrastructure
• Kape's VPNs run on user devices — the customer's infrastructure

The Israeli model is fundamentally different from Chinese or Russian cyber infrastructure. China builds the cloud. Russia hosts the botnet. Israel builds the tool and sells it. The tool runs everywhere, but its origin appears nowhere.

The Physical Chokepoint: Submarine Cables

Israel's cyber capability is not only digital — it is physically positioned at a critical junction of global internet infrastructure.

Wikipedia records — citing French press sources — that Unit 8200 "reportedly taps undersea cables." Middle East Eye reported that Red Sea submarine cable landing points enable surveillance by US, UK, and allied intelligence agencies.

A nation that controls both the physical chokepoint (Blue-Raman cable) and the tool ecosystem (NSO, Cellebrite, Check Point) and the proxy network (Bright Data, 150M+ IPs) and the VPN infrastructure (Kape, 4 major VPNs) does not need to appear in honeypot databases. The honeypot sees the exit nodes. The cables carry the backbone. The tools run on the targets. Everything is everywhere, and origin is nowhere.

Synthesis: The Architecture of Invisibility

Seven layers of invisibility, documented and cross-referenced:

The Comparison: How Nations Hide

Every other nation leaks. China's country field reveals 300+ IPs. Russia's 400+. Vietnam's 38+. Even Iran, routing through European LIRs, shows 20+ IPs with country=IR. Israel shows 7 IPs and zero hits. The architecture of invisibility is complete.

Investigative Q&A

Reading Between the Lines

Methodology

Data Sources

• LSN Honeypot Database: 8,000+ attacker IPs with enrichment from 12+ OSINT sources
• LSN Intelligence Platform: 277K+ entity links across 17 relationship types
• Dossier Vector Store: Cross-referenced against 31 published investigations
• RIPE Database: ORG-DM262-RIPE, corporate records, LIR sponsorship data
• German Corporate Registry: HRB 12249 (Pfcloud UG), District Court Passau
• Spamhaus: ASN-DROP classifications for all Mishayev-sponsored networks
• GBHackers / Intrinsec: Third-party validation report (May 28, 2026)
• Include Security: Bright Data SDK analysis (June 2026)
• European Investment Bank: Blue-Raman cable project documentation
• DropSite News: Unit 8200 alumni in private sector investigation
• Qurium Media Foundation: Bright Data enabling Philippines DDoS documentation

Search Methodology

1. Country field search: SELECT * FROM ips WHERE country='IL' — yielded 7 IPs
2. Organization search: Searched all known Israeli cyber companies (Check Point, NSO, Cellebrite, Candiru, Radware, CyberArk) — zero matches
3. RDAP registration search: Searched for ", IL" suffix in RDAP org fields — 6 consumer ISP IPs
4. Founding origin trace: Identified Israeli-founded cloud providers (Kamatera) — 7 IPs across 5 ASNs
5. Operator nationality trace: Searched RIPE for Israeli nationals operating German/EU companies — discovered Daniel Mishayev (ORG-DM262-RIPE, IL) — 37 IPs, 930 hits
6. Vector cross-reference: Searched all 31 prior dossier investigations — found extensive existing coverage of Mishayev ecosystem across 5+ investigations
7. BGP upstream analysis: Traced transit relationships between Pfcloud and co-located ASNs
8. Open-source intelligence: GBHackers, Include Security, Qurium, DropSite News, Wikipedia, EIB documents

Confidence Assessment

• Mishayev → Pfcloud → bulletproof ASNs: HIGH (RIPE records, corporate filings, Spamhaus data, third-party reporting)
• Kamatera identity fragmentation: HIGH (5 ASNs in 3 RIRs under 8+ names — all publicly verifiable)
• Bright Data residential proxy scale: HIGH (company's own claims + June 2026 SDK analysis)
• Kape → Unit 8200 connection: HIGH (documented co-founder biography)
• Submarine cable tapping: MEDIUM (Wikipedia citing French press; no primary source available)
• Israeli state direction of Mishayev operations: LOW (no evidence; pattern is private sector)