🎭 The genius of attacking from a name no one dares to block

The offshore shell hides by being unfindable. The respectable front hides by being too important to block. These are mirror images of the same idea. When a honeypot logs an attack from Microsoft Azure (AS8075), a SOC analyst's hand hesitates over the firewall, because blocking Microsoft's ranges can break Microsoft 365, Teams, authentication, the very tools the company runs on. The attacker has not compromised Microsoft. The attacker has compromised the defender's risk calculation — and in this dataset Azure's abuse spreads across sixteen countries under one serene US corporate label. Google describes its own clouds being seized and set to mining crypto within 22 seconds of compromise. The brand is the camouflage; the speed is the business model.

For the cheap clouds — DigitalOcean, Contabo, OVH, IONOS — the camouflage is economic rather than reputational: a hostile droplet in Frankfurt looks exactly like ten thousand developer droplets in Frankfurt. Contabo even appears twice, as a German GmbH and a US Inc., the same brand split across two corporate skins so that 'where it is registered' and 'where it operates' can never quite be made to agree. None of this requires the provider to be complicit. It only requires the asymmetry: the attacker pays cents; the defender, to block them, must risk breaking the legitimate world.

🌍 M247: a Romanian company that sells the right to seem to be everywhere

And then there is M247 (AS9009), where the laundering is not a side effect but the product. M247 is a real backbone and VPN-hosting business — acquired by Metronet for £47.5m, run out of Manchester and Bucharest — and its address space is a passport drawer. Inside one Romanian-registered autonomous system the RDAP records read M247 Ltd Bahamas, M247 Ltd Sri Lanka, M247 Ltd Lagos, M247 Ltd Panama, M247 Ltd Qatar, M247 Ltd Venezuela, alongside a 'ServersFactory New York' slice (185.255.100.0/24) that geolocates US, routes via Britain, registers US, and is owned by a Romanian AS — with threat scores up to 100 and SSH and MySQL hanging open.

A VPN provider needs to make geography pliable; that is a legitimate product. But from the honeypot's chair the same property becomes attribution laundering: whoever rents a Lagos-labelled exit inherits a Nigerian origin they never set foot in. This is the soft, mainstream cousin of w1n Ltd (TI-019K) — the £1 'dormant' UK shell whose single address 185.246.128.133 threw 5,129 attacks at us while hosting darknet-market mirrors. In 019K the clean label was a shell company. Here it is the brand gravity of real clouds and real VPNs. Same trick, better tailoring. The lesson of the whole suite is in this pairing: trust, at internet scale, is something you rent — and therefore something that can be rented against you.

🏛️ The Official Scaffolding — Institutional Anchors

Nothing at this scale operates without anchors in official structures — Regional Internet Registries, company registrars, state telecoms, regulators, financiers, carriers, and law enforcement. These are the documented anchors (sourced). The inferred ones live in the conspiratorial section below.

This cluster inverts the whole investigation. The offshore shells hide by being unfindable; these providers hide by being too official to touch, and the anchors prove it. Microsoft Azure holds US DoD Impact Level 5/6 authorizations, FedRAMP, the UK's G-Cloud, and NHSmail. Google Cloud holds FedRAMP High, DoD IL5, and NHS compliance. Read that against the honeypot log and the paradox is total: the same autonomous systems that attacked a home honeypot are certified to host militaries and health services. DigitalOcean is NYSE-listed; OVHcloud is the French sovereign-cloud champion on Euronext; IONOS trades in Frankfurt. And the financial seam closes the loop: Contabo is owned by Oakley Capital (since 2019, with KKR taking majority control in 2022) — the same Oakley Capital that backs World Host Group in Part C. M247 sits slightly apart as the VPN and virtual-location nexus.

🎯 Actors & Entities

🌐 Infrastructure & Indicators (IOCs)

Threat = composite 0–100 score from honeypot activity + multi-source enrichment.

🔎 Findings

🕳️ The Conspiratorial Read — Questions & Calibrated Answers

Each answer states what the evidence supports and labels where a claim is unproven. Questions are instruments: they pry loose the partial truths the flat record hides.

🔗 Linked Dossiers

• TI-020A — master thesis
• TI-019K "The Quadrant" — w1n Ltd — the archetype this part links to
• TI-019 "Shadow Nexus" — Azure/Google/DigitalOcean weaponization map
• TI-020C — World Host Group/IPXO — leased-space sibling of the respectable front

📎 Sources & Evidence Chain (16 items)

Every claim above is anchored to a primary source. Full machine-readable evidence in Postgres dossier_intel (investigation 019M).