📊 The Discrepancy Landscape

Our threat intelligence platform tracks 8,000+ unique IPs. When we filtered for cases where the geolocation country (where the packets physically originate) differs from the RDAP registration country (where the organization claims to be), we found 469 addresses — nearly 6% of our entire database.

This is not random noise. The discrepancies cluster around specific providers who have made geographic fiction their business model:

Source: Honeypot threat intelligence database, 8,000+ IPs, enrichment from RDAP, AbuseIPDB, Shodan, GreyNoise. Counts reflect IPs where at least two country signals disagree.

Notice the pattern: the biggest discrepancies are not in the darkest corners of the internet. They are at Contabo, Microsoft, Google Cloud, DigitalOcean. The infrastructure of mainstream cloud computing has the same geographic identity problem as the infrastructure of bulletproof hosting. The difference is one of intent — but from a defender's perspective, the packet looks the same.

🗺️ The Top Discrepancy Corridors

When we map where packets appear to come from versus where they are registered, clear corridors emerge:

The Netherlands emerges as the world's geographic laundering hub — a small country that appears in 25 of the top 20 discrepancy corridors, serving as the physical location for infrastructure registered in the US, Germany, Hong Kong, Poland, India, and the EU generally. This is not coincidence. The Netherlands has the densest data center concentration in Europe, liberal hosting laws, and excellent peering.

🕵️ The Second Private Layer Attacker: 179.43.133.154

The second high-activity IP confirms the pattern:

• 1,018 sessions, all successful logins
• Same credentials: admin:admin (1,015x), admin:123456 (3x)
• Same HASSH fingerprint: a7a87fbe86774c2e40cc4a7ea2ab1b3c
• Classified as botnet by our behavioral analysis
• Threat score: 74.4, AbuseIPDB confidence: 91%
• 45+ Shodan ports open in the 5985-15084 range
• Passive DNS resolves to hostedby.privatelayer.com

The Shodan port profile is unusual. Ports 5985 (WinRM), 10010-15084 — these are not standard web services. The pattern suggests a command-and-control infrastructure with multiple management ports, or a distributed scanning system with dedicated ports for each campaign.

Both Private Layer attackers stopped zero commands after successful login. They prove credentials work, record the success, and move on. This is credential validation at scale — building a database of compromised systems for later exploitation by a different operator, on a different IP, through a different VPN endpoint.

🏢 M247 Europe SRL — The Numbers

M247 is not a shell company. It is not a fly-by-night bulletproof host. It is a serious, ISO-certified Romanian telecom and hosting operator with over €30 million in annual revenue, 90 employees, and documented presence in 53 PeeringDB facilities across four continents. After its 2025 acquisition by a UK-based group, the Romanian operations continued under the same ASN with the same infrastructure.

The business model is documented in their own marketing. M247 operates dedicated VPN hosting as a product line, alongside standard colocation, transit, and IP services. They sell to VPN providers who sell to end users who may or may not be attackers. The result is a three-layer attribution gap.

🔌 The NordVPN Backbone — Documented, Not Insinuated

The cleanest factual bridge in this dossier connects the world's most popular VPN provider to the same Romanian backbone:

This does not make NordVPN complicit in attacks. But it makes the mechanism undeniable. The same backbone that carries legitimate VPN traffic for 14 million NordVPN subscribers also carries the traffic that generates threat scores of 100 in our honeypot. The packets travel the same fiber. They traverse the same routers. They exit the same prefixes. The only difference is the customer's intent — and nobody checks intent at the BGP level.

🌐 M247's Global Anonymity Fabric

The RDAP data reveals M247's geographic reach extends far beyond Romania:

Venezuela, Qatar, "Shenzen" (misspelled Shenzhen), Switzerland — the subsidiaries follow VPN demand. Where consumers want to appear to be, M247 has a subsidiary ready to route their traffic. This is geography as a service, sold at scale.

🧅 Torservers-NET and the Zwiebelfreunde Foundation

AS60729 is operated by "Stiftung Erneuerbare Freiheit" — the Foundation for Renewable Freedom, a German non-profit. Its associated entity, Zwiebelfreunde (German for "Onion Friends"), is a registered association that operates Tor exit nodes as a public service.

Our database contains 100 IPs on this ASN — all within the 185.220.101.0/24 range. Every single one geolocates to Germany. The RDAP registration for 17 of them lists the country as United States — because Zwiebelfreunde registers some IP blocks through US entities for operational reasons.

The zero honeypot hits tell a story. These IPs appear in threat intelligence feeds because Tor exit traffic is inherently suspicious — it originates from known exit nodes and scans the internet. But none of the 100 Torservers IPs has attacked our honeypot directly. They scan. They probe. They appear in Shodan and AbuseIPDB databases. But they do not log in with stolen credentials and run malware.

This is the paradox. The Tor Project and its operator foundations exist to protect press freedom, whistleblowers, and dissidents in authoritarian regimes. The same infrastructure also carries traffic for ransomware operators, darknet markets, and SSH brute-force campaigns. The Zwiebelfreunde foundation has faced this tension directly:

The question for defenders is not whether Zwiebelfreunde is malicious (evidence suggests they are not). The question is whether the system they operate can distinguish between a journalist in Myanmar and a botnet operator in Moscow. It cannot. That is by design. And that design choice has consequences that show up in every threat intelligence feed on earth.

🐴 The PONYNET Ecosystem

FranTech Solutions (AS53667, branded "PONYNET") is a US-based hosting provider that operates under two consumer brands: BuyVM (budget VPS hosting) and IncogNet LLC (privacy-focused hosting). Our database contains 100 IPs on this ASN.

FranTech's geographic discrepancy is specific: 8 IPs in the 107.189.x.x range geolocate to Switzerland but are registered in the United States. These are BuyVM's Luxembourg datacenter servers — physically in Europe, registered in America. The geographic mismatch is an artifact of BuyVM's business model: US company, European servers, Swiss IP geolocation databases.

FranTech's founder, Francisco Dias, has been publicly vocal about hosting controversial content under US First Amendment protections. The company has declined takedown requests from various organizations, citing free speech. This philosophy extends to hosting Tor exit nodes and privacy-focused services. The result is an ASN that appears frequently in threat intelligence feeds — not because FranTech itself is malicious, but because its customer base includes operators who generate significant scanning and brute-force traffic.

The top threats from this ASN are real:

• 209.141.57.35 — Threat score 90, 18 honeypot hits
• 205.185.125.209 — Threat score 84, 12 honeypot hits
• 209.141.47.217 — Threat score 84, 28 honeypot hits
• 209.141.33.207 — Threat score 83, 21 honeypot hits (BuyVM Services)

🇷🇺 Proton66 OOO — The Russian Privacy Host

Proton66 OOO (AS198953) is a different entity entirely — a Russian limited liability company (OOO = Общество с ограниченной ответственностью). Our database contains 6 IPs on this ASN, all Russian:

Proton66 OOO has no documented connection to Proton AG (Switzerland) or to the protonserv-mnt Ukrainian entity. Three entities, three countries, one name fragment. The privacy industry has a branding problem — or a branding strategy.

🎭 The Mechanisms of Geographic Fiction

IP geolocation is not GPS. There is no satellite telling a network where a packet originates. Instead, geolocation databases like MaxMind, IP2Location, and DB-IP use a combination of signals to estimate where an IP address is physically located. Every signal can be manipulated.

Signal 1: RDAP/WHOIS Registration

When an organization registers an IP block, they declare a country. This becomes the legal jurisdiction of the address. But nothing prevents a company registered in Panama (Private Layer) from declaring its addresses as Swiss, or a Ukrainian sole proprietor (protonserv-mnt) from declaring them as Dutch.

Signal 2: BGP Announcements

The Border Gateway Protocol announces routes. The ASN originating the route is registered in a country. But the route can be announced from routers in any country. M247 (Romania) announces routes that appear to originate from servers in the US, Venezuela, Qatar, and Switzerland.

Signal 3: Geofeed (RFC 8805)

In 2020, IETF published RFC 8805, which allows network operators to publish machine-readable files declaring the geographic location of their IP addresses. MaxMind and other databases can consume these files. The problem: the operator self-declares the location. There is no verification. A hosting company in Romania can publish a geofeed claiming its servers are in New York, and geolocation databases will accept it.

Signal 4: Latency Measurements

Some geolocation services use ICMP ping and traceroute timing to triangulate physical location. This can be spoofed with anycast routing, traffic engineering, or simply by choosing transit paths that add latency in specific directions.

The result is that any hosting company with moderate technical sophistication can make its servers appear to be anywhere on earth. This is not a bug. It is the business model of the VPN industry. And our data proves it works: 469 IPs where at least two geographic signals disagree.

📊 The Netherlands: Europe's Geographic Laundering Hub

In our discrepancy dataset, the Netherlands appears as either the geo or RDAP country in 25 of the top 20 discrepancy corridors. This is not coincidence:

• AMS-IX (Amsterdam Internet Exchange) is one of the world's largest IXPs by traffic volume
• The Netherlands has more data centers per capita than any country in Europe
• Dutch law is permissive on hosting content
• Transit prices in Amsterdam are among the lowest in Europe
• NL-ix, AMS-IX, and NIKHEF provide redundant peering

The practical effect: a company can register in Germany, host in the Netherlands, announce routes through a Romanian transit provider, and serve traffic that geolocation databases label as American. That company's customer can launch SSH brute-force attacks that appear to originate from the United States while the legal entity, the physical server, and the transit provider are all European.

💰 The VPN Industry in Numbers

The global VPN market was valued at $44.6 billion in 2024 and is projected to reach $134.2 billion by 2032 (Grand View Research). This is not a niche industry. It is larger than the cybersecurity industry's endpoint protection market.

The Kape Technologies Story

Kape Technologies deserves special attention. Before becoming a VPN conglomerate, Kape operated as Crossrider — a company that developed browser extensions classified as adware and potentially unwanted software by security vendors including Malwarebytes and Symantec. Crossrider's technology was used to inject advertisements into web pages and collect user browsing data.

In 2018, Crossrider rebranded to Kape Technologies and pivoted to "digital privacy and security." It subsequently acquired:

• CyberGhost VPN (2017, ~$10.4M)
• ZenMate VPN (2018)
• Private Internet Access (2019, ~$95.5M)
• ExpressVPN (2021, ~$936M)
• Webselenese (2021) — VPN review websites

The company's co-founder, Koby Menachemi, previously served in Unit 8200 — the Israeli Defense Forces' intelligence unit specializing in signals intelligence and cyber operations. The company's early investor, Teddy Sagi, was convicted of securities fraud in 1996 in Israel.

A company that made money from adware now makes money from "privacy." Its co-founder's background is military intelligence. Its major investor has a fraud conviction. And it controls four of the world's most popular VPN brands. These are facts, not allegations.

📉 The "No Logs" Promise

Every major VPN provider claims a "no logs" policy. The enforcement record tells a different story:

The pattern is consistent: VPN providers market "no logs" as an absolute guarantee, but the servers exist in jurisdictions with legal systems. When law enforcement obtains warrants or court orders, logs materialize that were not supposed to exist. Sometimes the VPN provider cooperated voluntarily. Sometimes the datacenter operator (M247, Datacamp, etc.) provided the data without the VPN provider's knowledge.

For attackers, this means VPN privacy is probabilistic, not absolute. For defenders, it means VPN attribution is possible but expensive — requiring legal process in multiple jurisdictions simultaneously.

📋 Recommendations

For Network Defenders

• Do not trust IP geolocation for attribution. Cross-reference at minimum: geo, RDAP, ASN registration, BGP origin, and reverse DNS
• Block or rate-limit traffic from known VPN/proxy ASNs (AS9009/M247, AS51852/Private Layer, AS53667/FranTech) on SSH-exposed infrastructure
• Monitor for HASSH fingerprint clustering — shared fingerprints across different ASNs indicate coordinated campaigns
• The Netherlands (NL) as a source country is nearly meaningless — it is Europe's hosting hub, not a threat indicator

For Policymakers

• Require verified geolocation data in RDAP records. Self-declared geography with no verification is the root of the problem
• Apply beneficial ownership transparency requirements to hosting companies as they are applied to financial institutions
• Establish mutual legal assistance processes specific to hosting infrastructure, with timelines measured in hours, not months
• Require VPN providers to implement know-your-customer (KYC) processes proportional to the services they provide

For the VPN Industry

• Implement abuse monitoring that does not require logging user content — behavioral signals (connection rates, credential-stuffing patterns) can detect abuse without violating privacy
• Publish transparency reports that include abuse complaint volumes, not just government requests
• Adopt geofeed (RFC 8805) with independently verifiable location claims

📎 Sources & Evidence Chain

Primary Data

• Honeypot threat intelligence database — 8,000+ unique IPs, 469 with geo/RDAP discrepancies
• Entity link graph — 271K+ edges across 17 relationship types
• Active reconnaissance data — Tor-routed scanning of attacker infrastructure
• RDAP/WHOIS records via RIPE NCC, ARIN, APNIC
• AbuseIPDB confidence scores and category breakdowns
• Shodan port and service data
• GreyNoise classification data

Corporate & Financial

• M247 Global press releases (2025 acquisition, revenue data)
• Kape Technologies PLC annual reports (LSE: KAPE)
• Panama commercial registry records
• RIPE NCC allocation records and RPKI data
• PeeringDB facility and peering data

Legal & Enforcement

• Zwiebelfreunde raid: German court records (2018-2019)
• PureVPN FBI case: US District Court filings (2017)
• IPVanish DHS case: court records (2016)
• HideMyAss/LulzSec: UK Crown Court records (2011)
• MaxMind lawsuit: US District Court, Kansas (2016)

Industry Analysis

• Grand View Research: Global VPN Market Size Report (2024-2032)
• RFC 8805: A Format for Self-Published IP Geolocation Feeds (2020)
• Citizen Lab: Reports on VPN provider security practices
• EFF: Analysis of VPN provider logging practices

🔬 Methodology

This investigation used the following methodology:

1. Data Collection: Honeypot database query for all IPs where geo ≠ RDAP country (469 IPs). Deep enrichment from 10+ OSINT sources.
2. Provider Clustering: Grouped discrepant IPs by ASN and organization. Identified 7 major privacy/VPN ASNs.
3. Corporate Research: Traced corporate structures through RDAP, WHOIS, PeeringDB, and commercial registries.
4. Attack Analysis: Full session analysis for high-activity IPs (Private Layer, M247, FranTech).
5. Entity Linking: HASSH fingerprint clustering, credential sharing, and passive DNS correlation.
6. Economic Analysis: Revenue data, market sizing, and business model analysis for VPN providers.
7. Legal Research: Court cases, law enforcement actions, and regulatory frameworks.

All active reconnaissance was conducted through Tor-routed infrastructure. No unauthorized access was attempted. All data is from publicly available sources or our own honeypot.