Omegatech (AS202412) is on Spamhaus DROP. TechTies (AS197170) is on Spamhaus DROP. KPROHOST (AS214940) shares the same operational identity. All three are registered through RIPE NCC, the Regional Internet Registry responsible for Europe and the Middle East.

RIPE's position: they are a neutral registry, not a police force. They allocate number resources based on technical justification, not moral judgment. Their de-registration process requires either a court order or demonstrated violation of their specific policies (address space, documentation fraud). Being on Spamhaus DROP — a list that explicitly identifies networks as "100% criminal" — is not, technically, a RIPE policy violation.

The result: an ecosystem where registries provide legitimacy by default, and withdrawal of legitimacy requires extraordinary effort.

Pfcloud UG (AS51396) is registered as a German Unternehmergesellschaft — the lowest tier of German limited company, requiring only €1 in capital. Registered at HRB 12249, Amtsgericht Passau, under Daniel Mishayev's name. It provides BGP transit to at least 7 Spamhaus DROP-listed ASNs.

The "negligent transit provider" theory requires believing that:

• A company notices none of its major customers are on every major threat list
• Said company ignores abuse reports from major security organizations
• Its website (whitelabel.sh) describes exactly the infrastructure that bulletproof hosts need
• All this happens by accident

The alternative: Pfcloud UG is the service layer of the Virtualine Technologies operation. The German registration provides EU legal jurisdiction (harder to shut down from abroad). The transit role provides plausible deniability ("we just provide connectivity, we can't control what our customers do with it"). The €1 capitalization ensures no recoverable assets if it's eventually prosecuted.

The name appears on German corporate registration documents. That's the extent of publicly verifiable information. There's no LinkedIn profile. No conference presentations. No blog posts. No academic publications. No other business registrations under the same name in the German Handelsregister.

This absence is itself data. In the legitimate hosting industry, principals are visible. They speak at peering forums. They appear on PeeringDB records. They have professional histories. The absence of all this for someone controlling transit infrastructure worth millions in the criminal economy suggests one of:

• A nominee director (the registered name is not the actual operator)
• An operational security practice (minimize public footprint)
• A recently-created identity (limited digital history because it hasn't existed long)

Consider what the reconnaissance script actually collects:

• UNAME → kernel version, hostname, OS
• ARCH → hardware architecture
• CPUS → number of cores
• GPU → NVIDIA model, compute capability
• UPTIME → system stability (always-on = server, reboots frequently = workstation)
• CAT/LS → BusyBox detection (IoT device vs. full Linux)

A criminal mining operation needs: GPU present? Yes/no. But the script collects far more than that. CPU count, architecture, kernel version, uptime patterns — this is a hardware census. It maps the computational topology of every server it touches.

A state actor conducting such a census would know: where the GPUs are, what they're running, how powerful they are, how stable the systems are, and whether they're IoT or full servers. This is the groundwork for:

• Pre-positioning for supply-chain attacks on AI infrastructure
• Mapping adversary compute capacity
• Identifying high-value targets for espionage (GPU servers often belong to research institutions)
• Building a reserve compute network for wartime operations

Russia's relationship with cybercriminal infrastructure is well-documented:

• Russian law enforcement rarely prosecutes cybercriminals operating against foreign targets
• The FSB has documented relationships with cybercriminal groups (Lurk → FSB recruitment documented in 2016 court proceedings)
• Post-2022 sanctions created explicit economic incentive for compute theft (revenue generation outside sanctioned banking)
• Russian military intelligence (GRU) has used criminal infrastructure for operations (Olympic Destroyer, NotPetya)

Virtualine operating from Russia doesn't prove state involvement. Thousands of criminal operations run from Russia simply because it's safe to do so. But it creates an environment where state interests and criminal interests can align without formal coordination.

The GPU reconnaissance question becomes: if you're a state that's been cut off from NVIDIA hardware purchases by export controls, and you can't buy A100s legitimately, do you need to know where they are on the internet? The answer is obviously yes.

All three bulletproof ASNs (Omegatech, TechTies, KPROHOST) are registered in the Seychelles. This isn't coincidence — it's a product. Seychelles International Business Companies (IBCs) offer:

• No public register of beneficial owners (until 2023 reforms, enforcement still minimal)
• Annual cost: ~$500 for the company + ~$200 for a registered agent
• Formation time: 24-48 hours
• No requirement for physical presence, local directors, or audited accounts
• Tax: 0% on foreign-sourced income
• No information exchange agreements that are actively enforced for IP-layer crime

The Seychelles Financial Services Authority (FSA) ostensibly regulates these entities. But with 200,000+ registered IBCs (in a country of 100,000 people) and limited enforcement resources, the regulatory framework is structural rather than practical.

For €700/year total (Seychelles IBC + RIPE membership), you get a legally distinct entity with opaque ownership that can hold internet routing resources in perpetuity. This is cheaper than a Netflix subscription.

The legitimate AI compute market has a structural problem: demand vastly exceeds supply. NVIDIA A100/H100 GPUs have multi-month waitlists. Cloud GPU instances are consistently sold out. Startups lose competitive advantage simply because they can't get hardware.

In this environment, a "no questions asked" compute provider — offering A100 access at 30-50% of market rate, payable in cryptocurrency — would have eager customers. The question isn't whether such services exist (they almost certainly do), but whether any "legitimate" companies knowingly or unknowingly use them.

The plausible deniability chain:

1. Criminal operator compromises 100 GPU servers across cloud providers
2. Deploys vLLM/TGI inference endpoints on compromised hardware
3. Sells API access through a "startup" with Stripe billing
4. Customer sees: fast API, cheap rates, good uptime
5. Customer doesn't see: that compute was stolen from the company next door

IP 157.230.112.58, the one running nvidia-smi --query-gpu=name --format=csv,noheader, is associated with reconnaissance that maps to E2B's business model: knowing exactly which GPU models are available on target infrastructure.

E2B Networks provides GPU cloud in India. They offer bare-metal NVIDIA GPU access (A100, H100). Their customers are AI companies who need compute. If someone is building a shadow inventory of GPU resources that maps which servers have which exact GPU models — that data is worth something to someone in the GPU cloud business.

Two scenarios:

• Innocent: E2B Networks is unrelated. "E2B" in the digital ocean metadata is coincidence or an unrelated abbreviation. The IP belongs to a criminal who happens to use more sophisticated GPU profiling.
• Less innocent: Competitive intelligence. Someone in the GPU cloud market wants to know where competitor GPUs are deployed, what models, what utilization. Not to steal compute, but to understand the landscape.

This is the question that can never be fully answered — by design. Monero's privacy features (ring signatures, stealth addresses, RingCT) make transaction tracing mathematically impossible without the private view key.

But we can reason about the structure:

• Pool mining means the pool operator knows the wallet address (pool.supportxmr.com, pool.hashvault.pro, etc.)
• Payouts from pools to the operator's wallet are detectable by the pool (they have the transaction records)
• Conversion from XMR to fiat requires an off-ramp: exchange (KYC'd or not), P2P trade, or mixing service
• KYC exchanges are increasingly requiring source-of-funds documentation for large XMR deposits
• Non-KYC exchanges (Bisq, LocalMonero before shutdown, Haveno) enable conversion without identity

The revenue flow: Stolen GPU → XMR mining → Pool payout → Monero wallet → DEX swap to BTC/ETH → Mixer → Clean exchange → Fiat. Each step adds friction (and fees: typically 5-15% total), but the starting cost was zero.

Our data shows 11 scanner IPs. The entity graph shows 68 shared_hassh links. The campaign has been active for 30+ days (our observation window). But we only see the reconnaissance phase. We don't know:

• How many targets had GPUs (the script filters them — we just see the recon)
• How many of those got payloaded (we're filtered out at triage)
• How many active mining victims exist right now
• What GPU models they're running

But we can model it. If 11 scanners are running 24/7, each testing perhaps 10,000 IPs per day:

• 110,000 IPs tested/day
• Maybe 1-5% have weak SSH credentials → 1,100-5,500 successful logins/day
• Maybe 2-5% of those have GPUs → 22-275 GPU targets identified/day
• Maybe 30-50% successfully payloaded → 7-138 new miners/day
• Average GPU value: $5-20/day in mining revenue
• Accumulated fleet after 30 days: 200-4,000 active miners
• Monthly revenue range: $30,000 to $2,400,000

Several structural barriers prevent takedown:

1. Jurisdictional fragmentation: Victims are global. Infrastructure is in Seychelles/Russia. Operators are unknown. No single law enforcement agency has jurisdiction over the entire chain.
2. Low per-victim impact: Each victim loses perhaps $50-200/month in electricity. This isn't enough to justify FBI investigation. It's not even enough for most companies to notice.
3. Privacy coin obfuscation: Even if the operation is identified, tracing the proceeds to an individual requires breaking Monero's cryptography — which hasn't been done publicly.
4. Bulletproof infrastructure: The hosting layer is designed to resist takedown. Omegatech has been DROP-listed and continues operating. The infrastructure doesn't care about blocklists — only BGP peering matters.
5. Renewable access: Even if individual mining payloads are cleaned, the SSH credential vulnerability persists. The operator can re-compromise the same targets within days.

The result: a permanent criminal economy that operates below the response threshold of every institution theoretically responsible for stopping it. It's not that nobody could stop it — it's that nobody has sufficient incentive to coordinate the cross-jurisdictional effort required.

The parallel between OPEC and stolen compute is more apt than it appears:

• Both control a scarce resource (energy / compute)
• Both benefit from coordination (avoid flooding the market / avoid mining the same targets)
• Both have structural incentives to limit individual production (difficulty adjustments penalize oversupply in mining)

Our entity graph shows interesting non-competition: the GPU reconnaissance botnet operates on Omegatech/TechTies infrastructure. The wallet hunter (103.24.212.42) operates from Indonesia. Meow botnet runs on Google Cloud. Sysrv-hello operates independently. They share the same attack surface but use different infrastructure — suggesting either coordination or territorial agreement.

In darknet markets, "non-compete" agreements between cybercriminal groups are documented (see: Conti leaks showing communication with other ransomware operators about target deconfliction). The concept of "this is my victim pool, those are yours" is operational reality in some criminal ecosystems.

Google publishes Threat Horizons reports documenting that 86% of compromised GCP instances are used for mining. AWS and Azure have similar statistics. They invest in detection systems. They publish best practices. They offer multi-factor authentication.

But consider: every compromised cloud instance generates revenue for the cloud provider. The victim pays for the compute. The miner uses the compute. The cloud provider bills for both the legitimate and illegitimate usage. From a pure revenue perspective, a compromised instance running a miner 24/7 is a better customer than an idle development instance.

Cloud providers' incentive is to appear to fight the problem (maintaining trust) without actually eliminating it (maintaining revenue). The optimal strategy is: detect fast enough that customers don't leave, but not so fast that mining revenue disappears from your platform.

Is this what's happening? Probably not consciously. But the structural incentive exists, and institutions generally follow structural incentives regardless of stated policy.

Right now, stolen GPUs mine cryptocurrency. But the same infrastructure that can mine Monero can train neural networks. As AI training costs increase (GPT-4 training cost estimated at $100M+), and as small AI companies face compute shortages, the incentive to use "gray" compute grows.

The scenario:

1. Criminal group controls 500 stolen A100s (via botnet or compromised cloud accounts)
2. Instead of mining at $50/GPU/day, they sell distributed training time at $100/GPU/day
3. An AI startup, unable to get H100 allocation from legitimate providers, contracts "cheap cloud" from a company that's suspiciously affordable
4. The startup's model is trained on stolen compute
5. The model is deployed commercially
6. The original victims never know their GPUs trained someone else's product

This isn't hypothetical technology — distributed training frameworks (DeepSpeed, PyTorch FSDP) already support exactly this topology. The criminal innovation needed is purely business-model: pivot from mining (commodity) to training-as-a-service (premium).