🏗️ TI-2026-023B — The Backbone: How M247 Europe SRL Became the Plumbing of Internet Abuse

Chapter 1: The Romanian Giant Nobody Talks About

If you've ever used a VPN, your traffic almost certainly passed through M247 Europe SRL. The company, headquartered in Bucharest, Romania, operates AS9009 — one of the most prolific autonomous system numbers in the global routing table. Under various names (M247 Ltd, M247 Europe SRL, formerly Datacamp Limited), it has become the invisible backbone of the commercial VPN industry.

The company provides infrastructure to NordVPN, Mullvad VPN, IVPN, Windscribe, and numerous smaller providers. When NordVPN advertises "5,000+ servers in 60+ countries," a significant portion of those servers run on M247's network. When Mullvad offers endpoints in exotic locations, many of those endpoints are M247 virtual machines.

But M247's network carries more than privacy traffic. Our honeypot captured 47 distinct M247-routed IP addresses engaging in SSH brute-force attacks, scanning campaigns, and botnet operations. Twenty of these IPs — all in the 185.255.100.x subnet — belong to the same coordinated campaign that spans 628 machines across 49 countries.

The Corporate Structure

M247 Europe SRL (CUI: 38286790) is registered in Romania. The company has undergone multiple transformations:

Chapter 2: The 185.255.100.x Bloc — A Botnet in Plain Sight

Within M247's vast network, one subnet stands out: 185.255.100.0/24. This block is registered under "Servers Factory LLC" — a UK-registered entity operating under the serversf-mnt maintainer on RIPE.

Our database contains 18 IPs from this subnet. Every single one is part of the same campaign — hassh-14b2ddda386a4d10 — sharing the identical SSH client fingerprint SSH-2.0-libssh2_1.11.0 with HASSH 14b2ddda386a4d1006108ccd231b42fc.

The Identical Fingerprint Problem

All 18 IPs run the exact same SSH daemon configuration with the same 25 CVEs — including CVE-2023-48795 (Terrapin), CVE-2025-26465, and CVE-2018-15473 (username enumeration). This isn't coincidence. These machines were deployed from a single template, provisioned simultaneously, and configured identically. They are not independent customers who happen to run the same software — they are a fleet.

Five of the 18 IPs expose MySQL (port 3306) alongside SSH. In the context of a botnet, exposed MySQL databases serve a specific purpose: command-and-control coordination. The botnet operators likely use these databases to distribute target lists, store stolen credentials, and coordinate scanning campaigns across the 628-node fleet.

Chapter 3: The Geography Deception — Virtual Locations, Real Attacks

M247's network contains a revealing pattern: IPs that physically sit in Romanian data centers but are RDAP-registered to countries where M247 has no physical presence.

These IPs expose ports 443, 1337, 6443, 8080, 8081, 8443 — the signature of a VPN/proxy server stack. Port 1337 (leetspeak for "elite") is commonly used by custom VPN/proxy protocols. Port 6443 suggests Kubernetes API servers — indicating these virtual location endpoints are managed as containerized workloads, likely by a VPN provider's orchestration platform.

How Virtual Locations Work

When NordVPN advertises a "Venezuela" server, most users assume their traffic exits through Venezuelan infrastructure. In reality:

This practice is technically documented by NordVPN (they call them "virtual locations" and mark them with a small icon in their app). But the implication is profound: VPN providers are selling geographic arbitrage based on RDAP registration, not physical presence.

Chapter 4: Omegatech LTD — A Shell Born Six Months Ago, Already Weaponized

If M247 is the backbone, Omegatech LTD is what happens when the same model is replicated by someone with no interest in legitimacy.

Omegatech LTD was registered in the Seychelles on January 5, 2026 — exactly six months ago. Its registered address is "House of Francis, Room 303, Île du Port, Mahé, Seychelles" — one of the most prolific corporate formation agent addresses in the offshore world, shared by hundreds of shell companies.

Within one week of incorporation, Omegatech obtained AS202412 from RIPE NCC and began announcing 20 /24 blocks — 5,120 IP addresses — across Netherlands, Germany, and the United States.

The Sponsoring LIR: Daniel Mishayev and pfcloud.io

Omegatech's RIPE resources were sponsored by Daniel Mishayev (ORG-DM262-RIPE), whose LIR registration lists country as Israel but whose actual address is Lilienstraße 5, 94051 Hauzenberg, Germany — a small town in rural Bavaria near the Austrian border.

Mishayev operates Pfcloud UG (haftungsbeschränkt), a German limited-liability company registered at District Court Passau (HRB 12249), located at Waning 1, 94136 Thyrnau, Germany. The phone number for both the personal LIR and the company is identical: +4917640385000.

Pfcloud's business model is white-label ASN provisioning. Through whitelabel.sh, Mishayev offers "turnkey" RIPE LIR sponsorship — meaning anyone with money can obtain an ASN and IP blocks without being a RIPE member themselves. Omegatech is a customer of this service.

The Ukrainian IP Block: A Network from Kharkiv

Among Omegatech's 20 announced /24 blocks, one stands out: 94.154.35.0/24. This block's RDAP record shows it belongs to "SKAYVIN-BROADBAND-UA" — a small Ukrainian ISP serving residential and business customers in the Kharkiv region, registered to individual entrepreneur Dyachenko Valentina Ivanovna in the village of Andreevka, Balakleya area.

The RIPE record explicitly states: "This network is not used for hosting, VPN or proxy."

Yet Omegatech announces this block as its own, and our highest-threat IP (94.154.35.215, threat score 99, abuse score 100, 560 honeypot hits) sits in this range. A Kharkiv village ISP's IP space is being routed through a Seychelles shell company to attack SSH infrastructure worldwide.

The HASSH Connection: Omegatech ↔ Private Layer

Two Omegatech IPs — 94.154.35.215 and 178.16.54.226 — share the SSH client fingerprint a7a87fbe86774c2e40cc4a7ea2ab1b3c (SSH-2.0-libssh2_1.8.1) with two Private Layer INC (Panama/Switzerland) IPs: 179.43.133.154 and 179.43.139.58.

This fingerprint identifies a specific version of libssh2 — a programmatic SSH library used for automated attacks, not human terminal sessions. The four IPs using this exact fingerprint form a tight cluster:

Combined, these four IPs generated 8,709 honeypot interactions. The Private Layer IPs used credentials admin:admin (5,589 attempts) and admin:123456 (504 attempts) — dictionary attacks at industrial scale.

Chapter 5: The protonserv Deception — A Russian Hand Behind a Ukrainian Mask

At 185.156.73.233, we find something that looks like a Ukrainian network but is operated by a Russian national in Novosibirsk.

FOP Dmytro Nedilskyi (ORG-FDN3-RIPE) is a Ukrainian sole proprietor ("FOP" = Фізична особа-підприємець) registered in Dnipro, Ukraine. He operates AS211736, announced through sponsoring LIR Merezha LLC (Kyiv). His IP address 185.156.73.233 geolocates to the Netherlands but carries a threat score of 78 and an abuse score of 100.

But the real story is buried in the RIPE maintainer records.

Who Really Controls the Network

The IP block 185.156.73.0/24 is maintained by protonserv-mnt — a RIPE maintainer created on February 1, 2019, two full years before FOP Nedilskyi's AS211736 was created (February 2021).

The admin contact for protonserv-mnt is VI1350-RIPE = Vorozhtsov Igor:

The TOV E-RISHENNYA Cross-Link

The formal RIPE registrant for the 185.156.73.0/24 block is TOV E-RISHENNYA (ORG-TE87-RIPE), a Ukrainian company (registration #43489990) at Zoologichna Street 4a, Kyiv. The technical contact is Kozar Konstyantin Igorevich (Kyiv, +380933778218).

But the organization's RIPE record lists two email addresses:

The Abuse Contact: "pwnx"

FOP Nedilskyi's abuse contact email is abusepwnx@gmail.com. In hacker terminology, "pwn" means to compromise or take control of a system. "pwnx" is unambiguous — it's a handle that celebrates system compromise.

No legitimate network operator uses "pwnx" as their abuse contact. This is either:

Chapter 6: Proton66 OOO — The St. Petersburg Bulletproof

Operating from an apartment in St. Petersburg's Nevsky District, Proton66 OOO (AS198953) is one of Russia's newer bulletproof hosting providers. Despite the similar naming, Proton66 has no connection to Proton AG (the Swiss company behind ProtonVPN and ProtonMail).

The Bulletproof Indicators

Proton66 exhibits every indicator of bulletproof hosting documented in threat intelligence literature:

Our database contains 6 Proton66 IPs. The most notable: 37.77.150.223 with abuse_score 100, and 37.77.150.119 with 197 honeypot hits.

Chapter 7: The Interconnected Web — Mapping the Relationships

These entities don't operate in isolation. The forensic evidence reveals a network of connections — some through shared infrastructure, some through shared behavior, some through shared silence.

The Connection Patterns

Chapter 8: The Virtualine Layer — ARIN Blocks Through a London Virtual Office

Omegatech's reach extends beyond RIPE. Two /24 blocks registered through ARIN (the American IP registry) are allocated to Virtualine Technologies:

The address — 71-75 Shelton Street, Covent Garden, London WC2H 9JQ — is one of London's most notorious virtual office addresses. Companies House records show thousands of companies registered at this address, most of them shells used for corporate opacity.

The block names — "INTERNET-SECURITY-02" and "INTERNET-SECURITY-03" — are ironic given that these blocks are announced by a Seychelles shell company with a threat score of 99.

Chapter 9: The Temporal Architecture — When Things Were Created

The creation timeline of these entities reveals a pattern of sequential infrastructure deployment:

The pattern is clear: infrastructure is layered over time. First the maintainer (control plane), then the organization (legal front), then the ASN (routing capability), then the IP blocks (operational capacity). Each layer provides plausible separation from the previous one.

Chapter 10: The Economics of Dual-Use Infrastructure

Why does M247 host both NordVPN and botnet nodes? Why does Omegatech exist? The answer is economic.

The Revenue Stack

Chapter 11: What RIPE NCC Knows — and What It Doesn't Do

Every entity in this investigation is a RIPE NCC member or sponsored member. RIPE is the Regional Internet Registry responsible for IP address allocation in Europe, the Middle East, and Central Asia. It is the organization that gave AS numbers, IP blocks, and legitimacy to:

RIPE's position, stated repeatedly in policy documents, is that it is a "technical registry" that does not make judgments about how resources are used. This position is legally convenient — it shields RIPE from liability for the actions of its members. But it means that the organization responsible for allocating the internet's addressing infrastructure has no mechanism for preventing its resources from being weaponized.

Chapter 12: Conclusions and Implications

What We Found

The Bigger Picture

This dossier reveals a layered infrastructure ecosystem where:

Each layer has plausible deniability. M247 says "we provide transit, we don't control what our customers do." Pfcloud says "we provide LIR services, we don't control what the sponsored entities do." Omegatech says nothing — because there's nobody to say it. And the botnet operators are invisible behind three layers of corporate opacity.

Appendix A: Methodology

Appendix B: Series Navigation

TI-2026-023B | Published 2026-06-19 | LSN Threat Intelligence
Data current as of 2026-06-19T12:00:00Z
This investigation was conducted using exclusively open-source intelligence and our own honeypot data. No systems were accessed without authorization.