🏢 Corporate Archaeology — One company, four skins, fifteen years of continuity

The brand history matters because it disproves the “random cheap host” reading. The identity chain is continuous: SkyTechnology → Skynode → Meverywhere → MEVSPACE. The corporate shell changed names; the network stewardship and sales logic did not.KRS · RIPE · PeeringDB

Timeline

👤 Named Principals — The RIPE record names names

This is not an attribution-by-vibes section. The registry data gives named humans, named roles, and named contact surfaces. What it does not give is a public KRS board-level proof that the RIPE operator and the corporate controller are the same person. That gap matters.RIPE WHOIS · KRS

🏗️ Physical Infrastructure — Owned metal, premium colo, expanding ASN set

The infrastructure picture removes another excuse. MEVSPACE is not just flipping third-party VPS inventory. It shows signs of mixed ownership: an owned datacenter in Wyszków and presence in premium Warsaw colocation.PeeringDB · RIPE · corporate materials

The datacenter address is almost too perfect: ul. Serwerowa — literally “Server Street.” It would be comic if the downstream abuse pattern were not so persistent.

🧰 Attack Platform Analysis — Two boxes, one toolkit family, one cross-country echo

The observed attack infrastructure inside MEVSPACE is operationally interesting because the hosts are not generic commodity Linux scanners. One is a Windows attack workstation; the other is a quieter Ubuntu SSH node. Both align to the same Paramiko-family HASSH that later appears in Cambodia.honeypot telemetry · recon · HASSH correlation

The cross-country signal is the important one. Different jurisdictions, same fingerprint, same attack family. That is not enough to collapse everything into one human operator; it is enough to say the tooling and tradecraft are shared across borders.

☠️ The Rhadamanthys Connection — Same /22, same host, same problem

195.3.223.218, inside the same 195.3.220.0/22 MEVSPACE allocation, was publicly documented as Rhadamanthys infostealer C2 on 2023-03-02. The customer name on RIPE-side records is given as “Innowacyjne Rozwiazania Informatyczne.pl sp. z o.o”, which reads like either a real customer or a shell-like abstraction layer. Either way, it sits inside the same MEVSPACE-addressed space as the credential-spray nodes targeting the honeypot.MalwareConfigLists · RIPE

Why this matters: Rhadamanthys is not trivial malware. It has been used by actors linked to Iranian MOIS (Void Manticore / Handala) and Russian GRU (Sandworm) in adjacent reporting ecosystems. That does not mean MEVSPACE is a state host. It means the same address space has already serviced infrastructure attractive to serious criminal and state-adjacent actors.public CTI reporting

Critical inference: the same /22 hosting both infostealer C2 and credential-spray infrastructure is fully consistent with a single-customer allocation theory — one criminal tenant or reseller layer using one block for multiple phases of the access economy.

📡 CVE-2025-55182 — MEVSPACE as campaign origin infrastructure

On 2026-01-20, GreyNoise documented MEVSPACE as the #1 source for a broad exploitation campaign around CVE-2025-55182 (React Server Components RCE). That is not a side note; it is an industrial-scale abuse signal.GreyNoise

This is the same pattern defenders keep seeing with bulletproof hosts: a provider does not need to write the exploit. It only needs to be the place the exploit reliably comes from.

💸 Financial & Abuse Profile — The business model in plain sight

The public commercial posture matches the abuse story too neatly to ignore.site capture · PeeringDB · AbuseIPDB

🧠 Vectorized Cross-Links — What the graph adds

The Qdrant-linked dossier graph connects this host to wider patterns already present elsewhere in the corpus.

🕳️ The Conspiratorial Read — Questions & calibrated answers

Questions are tools. Each answer states what the evidence supports, and stops where proof stops.

👁️ Read Between the Lines

🔬 Methodology — How this dossier was built

🔗 Cross-References

• TI-2026-025A — campaign overview for the full “Personal Touch” operator set
• TI-2026-025C — the infostealer pipeline that explains private credential appearance
• TI-2026-025D — Grameen Bangladesh as head-of-state-linked access infrastructure
• TI-2026-025E — Go scanner botnet and FranTech ecosystem overlap
• TI-019G “The Broken Window” — bulletproof hosting providers enabling abuse
• TI-024A “Offshore Bulletproof” — comparison case for explicit offshore abuse hosting

📎 Sources & Evidence Chain

Primary evidence preserved in structured investigation artifacts and corroborated with public records. Claims are either documented or explicitly labelled as inference.