❓ Why Do 100% of PIO-Hosting IPs in Our Database Have 100% Abuse Scores?

Zero out of 17 PIO-Hosting IPs in our threat intelligence database have an abuse confidence score below 100%. Not 95%. Not 99%. 100% across all 17.

The probability of 17 randomly selected IPs from a legitimate hosting provider all having maximum abuse scores is effectively zero. This is not a hosting company with a bad-customer problem. This is infrastructure that exists to generate malicious traffic. The customers aren't misbehaving — the infrastructure is performing as designed.

❓ Why Are Some PIO IPs Registered in Hong Kong?

Three PIO-Hosting IPs (194.120.230.28, 194.120.230.72, 103.161.34.59) show cymru_country=HK and rdap_country=HK despite being geolocated to the Netherlands and announced from a German ASN.

These IP blocks were originally allocated by APNIC (the Asia-Pacific RIR), registered to Hong Kong entities, and then routed through PIO-Hosting's European ASN. This is geographic IP laundering: blocks allocated in one region are announced from another, making geographic filtering ineffective. A firewall blocking "Hong Kong IPs" won't block them (they geolocate to NL). A firewall blocking "Dutch IPs" might block legitimate Dutch traffic. The discrepancy is the weapon.

Sources: RIPE + APNIC whois; cymru_country vs abuse_country enrichment; Shodan geolocation

❓ What If PIO-Hosting Doesn't Exist to Make Money from Hosting?

PIO-Hosting's website (pio.hosting) exists but offers minimal information. The Scamalytics fraud profile lists PIO-Hosting with associated organizations including "Superhub Limited" — another entity that appears in no corporate filing we can find.

Consider the alternative: PIO-Hosting's purpose isn't to profit from monthly hosting fees. Its purpose is to launder IP addresses — to take blocks from various sources (APNIC allocations, ZeXoTeK holdings, Guosheng leases, HBING BVI allocations) and announce them through a single German ASN via a Dutch data center. The "hosting" is a cover story. The actual service is: providing a legitimate-looking BGP origin for IP blocks that would otherwise be too suspicious to route. This would make PIO-Hosting an IP laundering service rather than a hosting company.

❓ The 628-IP Campaign — What Are PIO's Customers Part Of?

Our campaign detection identified hassh-14b2ddda386a4d10: a HASSH cluster of 628 IPs across 48 countries using libssh2_1.11.0. PIO-Hosting IPs are members of this campaign. So are IPs from AS16276 (OVH), AS32475 (SingleHop), AS40676 (Psychz), AS36352 (ColoCrossing).

628 IPs across 48 countries, all sharing the same SSH client fingerprint, generating 16,253 attack attempts. This is not "bad customers" — this is a globally distributed scanner/botnet operation. PIO-Hosting isn't just hosting some of these nodes — its infrastructure is embedded in a 628-node attack network that spans legitimate providers worldwide. The question isn't "why is PIO bad?" The question is: is PIO-Hosting the coordination point for this 628-node operation, or just one of many providers being abused? The SSH key sharing evidence (Chapter 7) suggests the former.

Sources: Campaign hassh-14b2ddda386a4d10; 628 IPs, 48 countries, 16,253 attempts

❓ 4,931 Abuse Reports on a Single IP — How Is ZeXoTeK Still Operating?

AbuseIPDB shows that 176.65.134.34 (ZeXoTeK, AS8649) received 4,931 abuse reports from 135 distinct sources. That is 37 unique organizations reporting the same IP every single day for four months.

4,931 reports from 135 sources is not a "failure to respond to abuse." It's a policy of ignoring abuse. Under RIPE NCC guidelines, a resource holder must maintain accurate abuse-c contact information and respond to abuse reports. ZeXoTeK demonstrably does neither. The question is: why does RIPE NCC continue to honor ZeXoTeK's resource allocations? The answer: RIPE has no enforcement mechanism beyond deregistration, and deregistration would simply push ZeXoTeK's IP blocks to another maintainer — perhaps one already in the family.

Sources: AbuseIPDB — 4,931 reports, 135 sources; ipapi.is AS8649 — 9,984 IPs

❓ Is ZeXoTeK a German Company or a Ukrainian One?

The name says "GmbH" — Gesellschaft mit beschränkter Haftung, a German legal form. But the RIPE admin contacts list Ukrainian addresses. The RIPE maintainer name is MNT-ZEXOTEK. The ASN (8649) is assigned to "ZeXoTeK IT-Services GmbH" with country "DE."

ZeXoTeK occupies a deliberate ambiguity. For German courts, it's a German entity subject to German law. For Ukrainian authorities, the contacts are Ukrainian. For RIPE NCC, the maintainer is just a database handle. Each authority sees the part of ZeXoTeK that suggests someone else has jurisdiction. This is the same pattern seen in every entity in this network: jurisdiction is not a location but a strategy.

❓ What Is the Financial Relationship Between ZeXoTeK and PIO-Hosting?

ZeXoTeK manages IP blocks (under MNT-ZEXOTEK) that are announced through PIO-Hosting's ASN (198584), via SkyLink's physical infrastructure (AS44592). No public filing, partnership agreement, or contractual disclosure documents this arrangement.

There are two models: (1) ZeXoTeK is a customer of PIO-Hosting, paying for BGP transit to announce its own IP blocks — in which case PIO-Hosting knowingly provides transit for an entity with 4,931 abuse reports on a single IP. (2) ZeXoTeK and PIO-Hosting share common beneficial ownership, and the separate corporate identities exist to distribute legal risk across jurisdictions (Germany + Ukraine + Netherlands). Both models describe a criminal enterprise. The distinction matters only for prosecutors deciding whom to charge.

❓ Why Are Attack Servers Running 58 Unpatched CVEs?

These servers attack our honeypot over SSH with credential stuffing. They are offensive infrastructure. Yet they run PHP versions from 2018, have NetBIOS and SMB exposed to the internet, and carry remote code execution vulnerabilities dating back 7 years.

Two explanations, both damning: (1) These servers are themselves compromised — they were hacked by the botnet operators who then use them as attack proxies. The original tenant never patched them, and the hijackers don't care. This means PIO-Hosting's customers are victims of their own provider's ecosystem. (2) The attack infrastructure is intentionally cheap and disposable — unpatched because no one invests in maintaining attack servers. When one gets burned (blocklisted or seized), you spin up another. The CVEs are a feature: they keep the infrastructure cheap, replaceable, and deniable.

❓ What Are Ports 31210, 9091, and 18062 Used For?

Multiple PIO IPs expose uncommon ports: 31210 (appears on 3 IPs), 9091, 18062. These are not standard HTTP/SSH/mail ports. They don't correspond to well-known services.

Port 31210 is commonly associated with Kubernetes NodePort services or custom C2 (Command & Control) frameworks. Port 9091 is used by Transmission (BitTorrent daemon) and some C2 panels. Port 18062 is non-standard and potentially a custom application. These ports, combined with the attack traffic these IPs generate, suggest these servers are not just SSH scanners — they're multi-purpose nodes in a larger infrastructure that includes C2 communication, data exfiltration, and possibly botnet coordination.

Sources: Shodan port scan data; IANA port assignments; C2 framework documentation

❓ Why Does a BVI Company Need 3,328 IPs Across 8 Countries?

The BVI population: 30,000. Total BVI IPv4 space: 96,893 addresses. HBING alone controls 3.4% of all BVI IP allocations.

HBING isn't a hosting company serving BVI customers. It's an IP holding vehicle — a legal structure designed to hold IP allocations in a jurisdiction where beneficial ownership is not publicly disclosed, then route those IPs through physical infrastructure in jurisdictions where law enforcement cooperation is slow. The BVI was chosen not for its internet infrastructure (it has almost none) but for its opacity laws.

Sources: Hurricane Electric AS208949; IpToolsKit — HBING; WorldIP.io BVI allocation stats

❓ What Is "lir-vg-itweb-1-MNT" and Who Is Behind It?

Three HBING IPs list lir-vg-itweb-1-MNT as their RIPE maintainer. The "vg" suggests Virgin Islands (country code VG). "itweb" suggests an IT/web company. This maintainer also appears on IPs announced by AS198584 (PIO-Hosting).

The same RIPE maintainer (lir-vg-itweb-1-MNT) appears on both HBING IPs and PIO-Hosting IPs. This is the bridge — the technical connection between the BVI offshore shell and the German customer-facing entity. Someone with access to both the HBING corporate structure and the PIO-Hosting technical infrastructure manages this maintainer. That someone connects the entire network: BVI → Germany → Netherlands → Ukraine → China.

❓ How Did Chinese IP Blocks (Guosheng IDC) End Up on a German ASN Announced from the Netherlands?

Guosheng IDC lease is a Chinese Internet Data Center. Their IP blocks (103.161.34.x) are APNIC allocations — registered in the Asia-Pacific region. Yet they appear on AS198584 (PIO-Hosting, Germany), geolocated to the Netherlands, physically in Eygelshoven.

The supply chain: Chinese IDC obtains APNIC allocation → Leases blocks to intermediary → Intermediary assigns to RIPE maintainer → PIO-Hosting announces via BGP from Eygelshoven → Traffic flows through SkyLink. At each step, jurisdiction changes. The Chinese company is subject to Chinese law. The RIPE maintainer is subject to RIPE policies. PIO-Hosting is subject to German law. The data center is in Dutch jurisdiction. No single authority can trace the complete chain. This is IP laundering through jurisdictional fragmentation.

Sources: APNIC whois 103.161.34.0/24; RIPE DB AS198584 announced prefixes; Guosheng IDC RDAP data

❓ Why Was CyberBunker Shut Down But SkyLink Hasn't Been?

CyberBunker hosted darknet drug markets. SkyLink/PIO hosts credential-stuffing botnets and SSH scanners. Both cause immense harm. Only one was raided.

Drug trafficking creates individual victims, media narratives, and political pressure. Credential stuffing creates abstract, distributed losses across millions of accounts — no single victim is harmed enough to trigger an investigation. The total damage from credential stuffing may exceed drug trafficking in monetary terms, but it's invisible. The difference isn't the scale of harm. It's the visibility of harm. Same border region. Same strategy. Different law enforcement priority. CyberBunker got raided because it was photogenic for a press conference. SkyLink survives because SSH botnets are boring.

Sources: Wikipedia — CyberBunker; Ars Technica

❓ Did CyberBunker's Seizure Teach the SkyLink Operators What Not to Do?

CyberBunker was seized in 2019. XSServer GmbH was registered in 2022 — three years later, in the same border region, with a more sophisticated corporate structure.

CyberBunker made a critical mistake: it hosted content that created criminal liability for the operators themselves (aiding drug trafficking). The SkyLink ecosystem learned from this. SSH botnets, credential stuffing, and DDoS-for-hire create civil liability for the targets but rarely criminal liability for the hosting provider. By staying below the criminal threshold — hosting attacks rather than contraband — the SkyLink operators avoid the legal trigger that brought down CyberBunker. The 2019 seizure wasn't a warning to stop. It was a playbook for what to avoid.

❓ When PIO-Hosting Dies, What Comes Next?

At 100% abuse scores across all known IPs, PIO-Hosting has accumulated more heat than most bulletproof providers survive. FluxHosting rebranded after similar exposure. MaxiDed was seized.

The prediction: PIO-Hosting GmbH will be dissolved at the Aachen Amtsgericht. Within weeks, a new GmbH — registered by Edler and Spellerberg, or by nominees — will appear at the same court. It will apply for the same RIPE sponsorship from XSServer (ORG-XG40-RIPE). The same IP prefixes will be re-announced from the same data center through the same BGP peers. The 450-peer SkyLink network won't miss a beat. The only thing that changes is the name on the abuse-c line. MR 1337 GmbH may be that successor, pre-positioned and waiting.

❓ What Would It Take to Actually Stop This Operation?

Dissolving PIO-Hosting won't work (successor ready). Deregistering the ASN won't work (new ASN, same prefixes). Blocking the IP ranges won't work (new ranges from HBING/Guosheng).

The only intervention that would disrupt this ecosystem is physical: seizing the data center in Eygelshoven, as German police did with CyberBunker in Traben-Trarbach. Everything else is reversible. But this requires Dutch law enforcement to act on the data center while German law enforcement simultaneously acts on the corporate entities — coordinated cross-border action that requires BKA-Europol-FIOD cooperation. The jurisdictional gap that protects the operation is the same gap that prevents investigation. The architecture is, in itself, the defense.

❓ How Much Money Is This Operation Making?

SkyLink routes 1-5 Tbps through 16 IXPs. PIO-Hosting announces 28 prefixes. ZeXoTeK manages ~10,000 IPs. HBING holds 3,328 IPs. Bulletproof hosting pricing ranges from $200-500/server/month, significantly above legitimate hosting rates.

Conservative estimate: if even 500 of these IPs are active customer deployments at $300/month, that's $150,000/month or $1.8M/year in revenue — flowing through entities with a combined registered capital of €75,000. The revenue-to-capitalization ratio is 24:1. This is a serious business disguised as a minimum-viable legal structure. And this estimate only counts direct hosting fees — not premium "DDoS protection" charges, not IP leasing fees through HBING, not whatever MR 1337 GmbH invoices for.