🌍 TI-2026-023C — The Virtual Country: How M247's Geofeed Creates Imaginary Geography for Sanctioned Nations

Chapter 1: What Is a Geofeed and Why Should You Care

In 2020, the Internet Engineering Task Force published RFC 8805 — "A Format for Self-Published IP Geolocation Feeds." The standard was designed to solve a legitimate problem: GeoIP databases often mislocate IP addresses, causing users to see wrong-language content, incorrect pricing, or unavailable services. RFC 8805 lets network operators publish a CSV file saying "these IPs are in this location" — and GeoIP databases like MaxMind, IPinfo, IP2Location, and DB-IP consume these feeds to correct their records.

The format is simple:

Here's the critical design flaw: RFC 8805 has no verification mechanism. There is no validation that the IP actually routes to that country. There is no physical presence requirement. There is no audit. The network operator simply declares a location, and the world's geolocation databases update accordingly. It is a system built entirely on trust — trust that is trivially exploited.

The Trust Chain

When M247 publishes a geofeed entry saying 62.133.46.0/24 is in Tehran, Iran, the following cascade occurs:

One CSV line in a file hosted on a Romanian server rewrites the geographic identity of 256 IP addresses across every geolocation system on the internet.

Chapter 2: The Sanctioned Countries File

We downloaded M247's complete geofeed on June 19, 2025. Among 2,191 entries spanning 116 countries, we found active entries for the following sanctioned or heavily restricted nations:

The Full Sanctioned/Sensitive Inventory

The pattern is unmistakable. M247 has systematically created virtual endpoints in countries where it has no physical infrastructure, including four nations under comprehensive US sanctions. These are not errors — they are named RIPE objects with dedicated entities.

Chapter 3: The Sanctions Framework

The US Treasury's Office of Foreign Assets Control (OFAC) administers comprehensive sanctions programs against Iran, Cuba, North Korea, Syria, and — since 2022 — broad sectoral sanctions against Russia and Belarus. These sanctions are not suggestions. They carry criminal penalties of up to $1 million and 20 years imprisonment per violation (International Emergency Economic Powers Act, 50 U.S.C. § 1705).

What OFAC Prohibits

Under the Iranian Transactions and Sanctions Regulations (31 CFR Part 560) and the Cuban Assets Control Regulations (31 CFR Part 515), the following are prohibited for US persons:

Where M247 Intersects

M247 Europe SRL is a Romanian company — not directly a US person. But since January 2023, M247 has been wholly owned by Macquarie Group, one of Australia's largest investment banks with $945 billion AUD in assets under management (as of March 2025). Macquarie operates extensively in the United States through:

As a company with substantial US operations, US employees, US-registered entities, and US-dollar transactions passing through the US financial system, Macquarie falls under OFAC jurisdiction. Its subsidiary — M247 — operates IP blocks explicitly labeled as "Iran" and "Cuba."

Chapter 4: The 116-Country Illusion

M247 claims presence in 116 countries. No company on earth operates physical data centers in 116 countries. For context:

The gap between M247's physical footprint and its geofeed claims is not a rounding error — it is the entire business model. Here is the distribution of M247's geofeed entries by category:

Approximately 72% of the countries in M247's geofeed are virtual — servers physically located in Romania or Germany, relabeled as endpoints in Mongolia, Brunei, Papua New Guinea, or Haiti.

The Exotic Locations Map

Countries in M247's geofeed where no reasonable person could believe they operate physical infrastructure:

Note the geofeed quality itself — Haiti's "city" is listed as "Haiti" and Papua New Guinea's postal code is "123-151." These entries were created to fill a dropdown menu in a VPN app, not to describe physical infrastructure.

Chapter 5: The Iran Block — Anatomy of "M247-Iran"

Of all the virtual countries in M247's geofeed, Iran requires the deepest examination. The RIPE registration tells a story:

What Happens When Traffic Is "From Iran"

When a VPN user connects to 62.133.46.0/24, the following occurs:

The GLOBALAXS Connection

The GLOBALAXS-MNT maintainer appears in multiple M247-related IP registrations. Global AXS Ltd was a UK-registered ISP (company number 06475375) that was part of M247's acquisition trail. The use of this legacy maintainer for the Iran block suggests one of two things:

Chapter 6: The Cuba Block — "M247-Ltd-Cuba"

Cuba's internet infrastructure is controlled by ETECSA (Empresa de Telecomunicaciones de Cuba S.A.) — the state telecommunications monopoly. Cuba has approximately 7.6 million internet users (2023 estimate), with connectivity primarily through mobile data and wifi hotspots. International bandwidth is limited and expensive.

Against this backdrop, M247 — a Romanian company — maintains a block of 128 IP addresses (89.238.155.0/25) labeled as "Havana, Cuba" in its geofeed. The RIPE registration is explicit: object name "M247-Ltd-Cuba", maintainer M247-EU-MNT.

Cuba's Sanctions Profile

Cuba has been under US sanctions since 1962 — the longest-running embargo in modern history. The Cuban Assets Control Regulations (31 CFR Part 515) prohibit:

The Obama administration's 2015 relaxation included a general license for telecommunications services to Cuba (§ 515.578). However, this license specifically authorizes activities that improve Cuban people's access to communications — it was designed for companies physically installing infrastructure in Cuba, not for companies relabeling European servers as Cuban endpoints.

Chapter 7: The Belarus Anomaly

The Belarus block (91.238.70.0/24, 256 IPs) presents a different pattern. While Iran and Cuba are maintained under M247's own entities, Belarus is registered to "us-fxcapital-1-mnt" — a completely different RIPE maintainer.

Belarus Sanctions Context

Belarus sanctions intensified after the disputed 2020 election and Belarus's role in facilitating Russia's 2022 invasion of Ukraine:

A US-based entity (indicated by "us-fxcapital-1-mnt") operating IP addresses geolocated to Belarus raises direct sanctions questions that do not require the Macquarie jurisdictional analysis — this is potentially a US person providing services to/appearing as a Belarusian entity.

Chapter 8: The Russia Portfolio

Russia presents the largest virtual-location portfolio in M247's sanctioned-country inventory: 10 geofeed entries comprising approximately 1,280 IPv4 addresses plus IPv6 allocations, all mapped to "Moscow."

Since February 2022, Russia has been subject to the most extensive sanctions program since the Cold War. The EU, US, UK, Australia, Japan, and Canada have imposed coordinated sanctions targeting Russia's financial sector, energy exports, technology access, and trade. Providing IT infrastructure services to Russia is restricted under multiple legal frameworks.

M247's 1,280 Russian virtual IPs exist in a legal gray zone: the servers are physically in the EU, the traffic exits from Romania or Germany, but every database on earth says these IPs are in Moscow. For sanctions compliance purposes, is a "Russian" VPN endpoint a service to Russia? For law enforcement purposes, is traffic from these IPs "Russian" — and should it be treated as such in investigations?

Chapter 9: The Discrepancy Matrix — Where Sources Disagree

Our threat intelligence database reveals a systematic pattern: M247 IPs where the BGP-derived country (where the traffic actually routes) differs from the RDAP-registered country (where the IP is supposed to be). This is the discrepancy that started this investigation.

Every single one of these IPs is physically in Romania (BGP routing through Romanian networks) but administratively claimed as Venezuela, Qatar, Bahamas, Sri Lanka, Panama, Nigeria, Ireland, or Switzerland. Note the common port pattern: 443, 1337, 6443, 8080, 8081, 8443. Port 1337 is a common VPN/proxy service port. Port 6443 is the Kubernetes API server port. Ports 8080/8443 are alternative HTTP/HTTPS ports.

These are VPN endpoints running on Kubernetes infrastructure. The entire virtual country system is orchestrated through containerized deployments — spin up a pod, assign it an IP from the "Venezuela" pool, publish it in the geofeed, and a server in Bucharest becomes Caracas.

Chapter 10: The Consumer Deception

When a VPN user selects "Iran" or "Bahamas" or "Mongolia" in their app, they believe they are connecting to a server in that country. The VPN industry has introduced the concept of "virtual locations" to partially address this — NordVPN, for example, uses a small globe icon to indicate servers that aren't physically where they claim to be.

But the disclosure is inadequate. Consider what the user actually gets:

The VPN tunnel is real. The encryption is real. The country is not.

Chapter 11: The RFC 8805 Problem — A Standard Without Verification

RFC 8805 was designed with good intentions. GeoIP databases are notoriously inaccurate — a server in France might be identified as being in Belgium, causing the user to see Dutch-language content. Self-published geofeeds let operators correct these errors.

But the standard has a fundamental design flaw: it trusts the operator.

RIPE NCC has added geofeed support to its database objects (inetnum and inet6num), allowing operators to reference their geofeed URLs directly in the registry. This gives the geofeed the imprimatur of a Regional Internet Registry — but RIPE doesn't validate the content any more than the GeoIP databases do.

Chapter 12: The Macquarie Compliance Question

Macquarie Group acquired M247 in January 2023. As one of Australia's "Big Four" financial institutions (alongside ANZ, CommBank, NAB, and Westpac), Macquarie is subject to:

Australia's autonomous sanctions regime includes comprehensive sanctions against Iran (Autonomous Sanctions (Designated Persons and Entities and Declared Persons — Iran) List 2012) and Russia/Belarus (expanded post-2022). Australia also maintains targeted sanctions against Zimbabwe and other countries present in M247's geofeed.

The Compliance Gap

Macquarie's 2024 Annual Report discusses ESG commitments, climate targets, and governance frameworks. It does not mention M247's geofeed, virtual locations, or the fact that a wholly-owned subsidiary maintains IP address blocks labeled "Iran" and "Cuba" in a public internet registry.

This omission creates several risk vectors:

Chapter 13: The Broader Implications — When Geography Is a Database Entry

This investigation began with a simple observation: M247 IPs in our honeypot showed different countries depending on which data source we consulted. BGP said Romania. RDAP said Venezuela. The geofeed said Qatar. This discrepancy led us to M247's geofeed file, which led us to Iran, Cuba, Belarus, and 113 other countries that exist only as lines in a CSV file.

The implications extend far beyond M247:

For Law Enforcement

Every investigation that uses GeoIP data to attribute network activity to a country is potentially contaminated by geofeed manipulation. An "Iranian" cyber attack may originate from Romania. A "Mongolian" phishing campaign may be a European operation. The investigative assumption — that an IP's geographic location reflects something real about the attacker — is fundamentally undermined by the virtual location industry.

For Sanctions Enforcement

Sanctions screening systems that rely on GeoIP databases are operating on potentially fabricated data. A transaction screening system that flags "Iranian" IP addresses will flag M247's virtual Iranian endpoints — creating both false positives (legitimate VPN users incorrectly flagged) and, more dangerously, potential false negatives (actual Iranian traffic routed through non-Iranian virtual locations to avoid detection).

For Intelligence Analysis

Threat intelligence that attributes activity to countries based on GeoIP data is building analytical frameworks on manufactured geography. A threat report claiming "increased Iranian cyber activity" may actually reflect increased VPN usage through M247's Romanian servers. The entire discipline of geographically-attributed threat intelligence is only as reliable as the geolocation data it depends on.

For Internet Governance

RFC 8805 was designed to solve a legitimate problem. But its adoption without verification has created a larger problem: network operators can now claim any geography for any IP address, and the world's databases will reflect that claim. RIPE NCC, as the registry that hosts these geofeed-referenced objects, bears responsibility for providing a framework that enables geographic misrepresentation without safeguards.

Chapter 14: The Scale of the Problem

M247 is not alone. To understand the scope, consider the VPN industry's virtual location practices:

The industry standard is to offer more "countries" than you have servers. Virtual locations are the norm, not the exception. M247 is the infrastructure provider that makes this possible — its geofeed is the factory where virtual countries are manufactured at wholesale scale.

Chapter 15: Methodology and Sources

Key Limitations

Chapter 16: Conclusions

M247 Europe SRL operates the internet's largest virtual country factory. Through a single CSV file — a geofeed — it instructs the world's geolocation databases to label Romanian and German servers as endpoints in 116 countries, including Iran, Cuba, Belarus, and Russia. The RIPE registry contains purpose-built entities — "M247 Ltd Iran" and "M247-Ltd-Cuba" — that exist solely to provide the appearance of legitimate operations in comprehensively sanctioned countries.

The geofeed mechanism (RFC 8805) that enables this contains no verification, no audit trail, and no sanctions screening. It is a system built entirely on trust, operating in an industry where trust is a commodity sold for $12/month.

Macquarie Group — a $945 billion investment bank subject to sanctions regimes in Australia, the US, the EU, and the UK — owns this infrastructure. Whether by design, by negligence, or by the structural gap between network engineering and compliance law, one of the world's most powerful financial institutions operates what may be the world's most accessible sanctions-circumvention infrastructure, published as a public CSV file hosted on a Romanian domain.

The virtual country is not a place. It is a database entry that tells every system on the internet — every GeoIP lookup, every compliance check, every threat intelligence platform — that a server in Bucharest is actually in Tehran. The server hasn't moved. The data has.

And in a world where geography is enforced by databases, changing the database is the same as changing the geography.