The Romanian Corridor
๐ Part A of The Romanian Corridor series โ TI-2026-036
Romania ranks #20 among countries attacking our honeypot. Seventy-five IPs. A modest number โ Belgium has more, Sweden has more. But look closer. Romania is not a source country. Romania is a transit country.
Those 75 IPs are not Romanian hackers targeting the world. They are global attack infrastructure routed through Romania โ through a network of bulletproof hosting providers, VPN operators, and corporate shells that have made Romania the most important cybercrime infrastructure corridor in Europe.
M247 Europe SRL, headquartered in Bucharest, announces 5,000 IPv4 prefixes and peers at 60 internet exchanges across 53 facilities on 6 continents. It carries 5-10 Tbps of traffic. It is the single largest provider of VPN anonymization infrastructure in our honeypot dataset. NexonHost Srl, also Romanian, runs a bulletproof hosting operation with a 93.3 risk score and 100% abuse rates across its IP space โ hosting Chinese-language phishing domains from Romanian datacenters while sharing SSH keys with botnets in the US and Germany. Bunea TELECOM SRL operates three ASNs, all on the Spamhaus ASN-DROP list โ the nuclear option of internet reputation, reserved for networks so toxic that all traffic from them should be unconditionally dropped.
And then there is Rรขmnicu Vรขlcea โ "Hackerville" โ the small city in the foothills of the Southern Carpathians where a generation of cybercriminals learned their trade on eBay auction fraud before graduating to the global stage. Where Guccifer โ an unemployed taxi driver โ hacked Colin Powell, George W. Bush's family, and Hillary Clinton's aide with nothing but a clunky NEC desktop and Google searches for security question answers.
This is the paradox of Romania: a country that produced both world-class cybercriminals and world-class cybersecurity talent. A country where the infrastructure that enables global cybercrime sits alongside the EU's fastest broadband speeds and a thriving legitimate tech sector. A corridor โ not a destination. Everything passes through. Nothing stays.
Exhibit 1: The Honeypot View โ 75 IPs, One Ecosystem
๐ Romania in Our Honeypot: Country Profile
| Metric | Value | Context |
|---|---|---|
| Total IPs | 75 | Rank #20 globally โ behind Belgium (#17), ahead of Japan (#21) |
| Avg Threat Score | 36.4 | Below global average โ because M247's VPN IPs dilute the score |
| Avg Abuse Score | 75.6 | High โ 31 IPs at abuse score 100 |
| Abuse = 100 IPs | 31 (41%) | Highest abuse-100 ratio of any European country in our dataset |
| Bulletproof ASNs | 8 | More bulletproof ASNs than any EU country except Netherlands |
| Spamhaus ASN-DROP | 4 ASNs | Bunea TELECOM (3 ASNs) + Feo Prest SRL (1 ASN) |
| Distinct ASNs | 25 | 75 IPs across 25 different networks โ fragmented by design |
Source: [HONEYPOT] sec_intel_search country=RO, 75 IPs. Enrichment: AbuseIPDB, GreyNoise, Shodan, RDAP, Spamhaus, PeeringDB.
That 41% abuse-100 ratio is the signal. In our dataset, 41% of all Romanian IPs have the maximum possible abuse score โ reported by so many independent sources that AbuseIPDB assigns them a perfect 100. For comparison: US IPs average 52% abuse (but at massive scale โ 1,842 IPs); China averages 44% (697 IPs); Germany averages 38% (533 IPs). Romania's 41% at only 75 IPs means the IP space we observe is concentrated malicious โ almost every IP is either a known-bad hosting node or a VPN exit.
And then notice: 25 distinct ASNs for just 75 IPs. That's an average of 3 IPs per ASN. This fragmentation is not accidental โ it is the fingerprint of jurisdictional arbitrage (035G). Spread your infrastructure across many small providers, each with its own SRL registration, its own abuse contact, its own RIPE allocation. No single provider looks large enough to attract regulatory attention. Together, they form a distributed bulletproof hosting platform that is harder to take down than any single provider.
Exhibit 2: The Big Three โ M247, NexonHost, FlokiNET
๐ข M247 Europe SRL โ AS9009 โ The Anonymization Giant
| Attribute | Value |
|---|---|
| Registered | Romania (Bucharest), 2005 |
| Also Known As | Globalaxs Communications, OHTele, Axamba, WebTapestry, SOInternet |
| IPv4 Prefixes | 5,000 (among the largest in Europe) |
| IPv6 Prefixes | 500 |
| IXP Presence | 60 internet exchanges |
| Facilities | 53 datacenters across 6 continents |
| Traffic | 5-10 Tbps |
| Scope | Global (NSP โ Network Service Provider) |
| Our IPs | 47 (19 geolocated RO, 19 US, 3 GB, 2 ES, 2 DE, 1 CH, 1 SE) |
| Risk Score | 44.0 โ moderate, because VPN exit nodes are ambiguous |
| Bulletproof? | No โ legitimate NSP that tolerates high-risk customers |
M247 is the most interesting entity in the Romanian corridor because it is legitimate. It is not a bulletproof host. It is a real network service provider with 60 IXP peerings, 53 datacenters, and petabits of throughput. It is the infrastructure behind NordVPN, Surfshark, and dozens of other commercial VPN services. When you activate a VPN and your traffic exits through a Romanian, US, or UK endpoint โ there is a significant chance it exits through M247.
And that is exactly why it appears in our honeypot. M247 IPs in our dataset split dramatically by geography:
๐ท๐ด M247 Romanian IPs (19)
Avg threat: 7.4 โ almost clean
These are VPN exit nodes and legitimate hosting. Low threat because they serve millions of legitimate VPN users. The malicious traffic is lost in the noise.
๐บ๐ธ M247 US IPs (19)
Avg threat: 70.4 โ heavily malicious
ISP: "Servers Factory LLC". Abuse score: 100 across all 19. These are not VPN exits. These are dedicated attack infrastructure โ botnet nodes, credential stuffers โ registered under a US LLC but announced through Romanian ASN M247.
The structure is elegant. M247 announces 5,000 prefixes globally. Within that enormous address space, a sub-allocation to "Servers Factory LLC" hosts 19 IPs with perfect 100 abuse scores and average threat scores of 70.4. The attack infrastructure hides inside the VPN provider's legitimate address space โ making IP-based blocking impractical because you'd block millions of VPN users alongside the attackers.
๐ The VPN provider paradox
Q: Is M247 complicit in the abuse on its network?
A: Not in any actionable sense. M247 is a legitimate NSP providing transit and hosting. "Servers Factory LLC" is a customer that leases IP space. M247's terms of service prohibit abuse, but enforcement at the scale of 5,000 prefixes is reactive โ they respond to abuse reports. The abuse exists because the architecture allows it: a legitimate provider with enormous address space provides cover for small malicious sub-allocations. This is not a bug in M247's business model. It is a structural feature of how IP address space is allocated and announced. The same pattern exists at every large NSP. M247 is notable only because it is the largest Romanian-registered example.
Q: Why is M247 registered in Romania?
A: Economics. Romania has among the fastest and cheapest internet in the EU โ a legacy of aggressive fiber deployment by Digi Communications (AS8708) and market competition. Romanian SRL (Limited Liability Company) registration is fast and inexpensive. Romania is an EU member state, providing legal framework and data protection. RIPE NCC (Regional Internet Registry for Europe) is accessible. Bucharest is well-connected โ major IXP peerings. The combination of cheap bandwidth, EU legitimacy, and business-friendly registration makes Romania optimal for network service providers. This is the same economic logic that makes the Netherlands the other major European hosting hub โ except Romania is cheaper.
Q: Five previous names โ Globalaxs, OHTele, Axamba, WebTapestry, SOInternet. What does that mean?
A: It means M247 has grown through acquisition. Each name represents a previously independent network that was absorbed. This is normal for large NSPs. But it also means that M247 inherited customer bases โ and customer relationships โ from five predecessor companies, each with their own history of abuse tolerance. The accumulated address space from five acquisitions is one reason M247 has 5,000 prefixes. The accumulated customer relationships may be one reason "Servers Factory LLC" operates within that space.
๐ด NexonHost Srl โ AS62390 โ The Bulletproof Operation
| Attribute | Value |
|---|---|
| Registered | Romania, 2021 (ASN allocated Nov 2021) |
| Website | nexonhost.com โ "DDoS Protected Servers" |
| IPv4 Prefixes | 37 announced (PeeringDB claims 50) |
| IXPs | 1 (vs M247's 60) |
| Facilities | 4 |
| Traffic | 5-10 Tbps (claimed โ improbable for this size) |
| Our IPs | 13 โ all malicious |
| Avg Threat | 77.6 |
| Avg Abuse | 100.0 โ every single IP at maximum |
| Risk Score | 93.3 ๐ด BULLETPROOF |
| Abuse Contact | ab@vpz.ro (shared across 10 IPs via RDAP) |
| GreyNoise | Classification: malicious (top IP: 103.75.71.22) |
| Classification | Botnet (behavioral, deep enrichment) |
NexonHost is everything M247 is not: small, opaque, and entirely malicious. Every IP we observe from NexonHost has an abuse score of 100. The average threat score is 77.6. The entire ASN is classified as bulletproof by our enrichment pipeline. And it hosts Chinese-language domains:
๐จ๐ณ Chinese Domains on Romanian Bulletproof Hosting
IP 102.129.186.123 (NexonHost, AS62390, geolocated Romania) hosts:
55fad.cn,69cyb.cn,g9r4e.cn,p2y9b.cnโ random-string .cn domains (phishing/scam infrastructure)cntianhetex.comโ Chinese textile company (likely compromised or impersonated)fnclxx.com,lankawebhoster.comโ additional scam domainsfreeholdactionappliance.com,reallyconsulting.comโ English-language scam domains
This single IP hosts both Chinese and English phishing infrastructure โ a multilingual scam operation running from a Romanian bulletproof host. The IP has 1,825 AbuseIPDB reports, threat score 93, and is classified as botnet by GreyNoise and our behavioral classifier.
Source: [HONEYPOT] sec_intel_ip_dossier(103.75.71.22), ip_hostnames via VirusTotal passive DNS. [XREF] TI-2026-035G (jurisdictional arbitrage).
The SSH key sharing is the forensic connection. NexonHost IP 103.75.71.22 shares an SSH host key (fingerprint: 74:05:ae:6d:56:0c:ba:8d:ab:72:b8:1b:ed:6a:ba:b1) with two IPs in completely different networks:
๐ SSH Key Cluster โ The Infrastructure Fingerprint
| IP | Country | ASN | Provider | Threat | Classification |
|---|---|---|---|---|---|
| 103.75.71.22 | ๐ท๐ด Romania | AS62390 | NexonHost Srl | 97 | Botnet |
| 191.101.33.110 | ๐บ๐ธ USA | AS14670 | WHG Hosting Services Ltd (GB) | 92 | Botnet |
| 78.111.67.246 | ๐ฉ๐ช Germany | AS33984 | Surfplanet GmbH | 77 | Scanner |
Three IPs. Three countries. Three providers. One SSH key. This means the same operator deployed the same server image โ or the same automated provisioning system โ across Romania, the US, and Germany. The SSH key is the digital DNA that connects these nodes to a single campaign.
Source: [HONEYPOT] sec_intel_find_related(103.75.71.22), entity_links relationship=shared_ssh_key.
๐ฎ๐ธโ๐ท๐ด FlokiNET ehf โ AS200651 โ The WikiLeaks Connection
| Attribute | Value |
|---|---|
| Registered | Iceland (ehf = private limited company), 2015 |
| Website | flokinet.is โ "Privacy-focused hosting" |
| Operations | Iceland, Romania, Finland, Netherlands |
| Our IPs | 24 total (7 in Romania, 11 in Iceland, 4 in Finland, 2 in Netherlands) |
| RO Avg Threat | 49.0 (vs 19.7 for Iceland IPs) |
| Known Clients | WikiLeaks (historically), whistleblower platforms, free speech organizations |
| Risk Score | 50.5 โ elevated but not bulletproof |
FlokiNET is the ideological counterpart to NexonHost. Where NexonHost is bulletproof hosting for profit, FlokiNET is privacy hosting for principle โ or so it positions itself. Registered in Iceland (strong free speech laws), operating in Romania (cheap bandwidth), Finland (Nordic privacy), and the Netherlands (peering). FlokiNET has historically hosted WikiLeaks infrastructure and positions itself as a haven for whistleblowers and press freedom.
But our honeypot doesn't distinguish between ideological hosting and criminal hosting. FlokiNET's Romanian IPs have an average threat score of 49.0 โ significantly higher than their Icelandic IPs (19.7). The Romanian infrastructure is either being abused by malicious actors leveraging FlokiNET's no-questions-asked policy, or FlokiNET's Romanian presence attracts a different customer profile than its Icelandic presence. Either way, the privacy-focused hosting model and the bulletproof hosting model produce the same observable output in honeypot data: elevated malicious traffic from IPs that cannot be meaningfully traced to an operator.
Exhibit 3: The Spamhaus Four โ Bunea TELECOM and Friends
๐จ Romanian ASNs on the Spamhaus ASN-DROP List
The Spamhaus ASN-DROP list is the internet's nuclear option. It contains ASNs so consistently malicious that Spamhaus recommends unconditionally dropping all traffic from them โ no inspection, no logging, just drop. Of the 431 ASNs on the global ASN-DROP list, 4 are Romanian:
| ASN | Name | Registration | Status |
|---|---|---|---|
| AS35478 | DATACENTER โ Bunea TELECOM SRL | Romania | ๐จ ASN-DROP โ 10 prefixes announced |
| AS42397 | BUNEA-HIGH-VOLUME-NETWORK โ Bunea TELECOM SRL | Romania | ๐จ ASN-DROP โ 3 prefixes announced |
| AS62380 | BUNEA-HIGH-PEER-NETWORK โ Bunea TELECOM SRL | Romania | ๐จ ASN-DROP โ 0 prefixes (dark) |
| AS208137 | FPS12 โ Feo Prest SRL | Romania, allocated Aug 2025 | ๐จ ASN-DROP โ 3 prefixes, risk 4.2 |
Source: [HONEYPOT] asns table (is_bulletproof=true, spamhaus_listed=true). Spamhaus ASN-DROP list (verified 2026-06-22).
Bunea TELECOM SRL operates three separate ASNs, all on the Spamhaus ASN-DROP list. This is not an accident or a marginal case. This is an entity that registered three autonomous system numbers with RIPE NCC โ requiring three separate applications, three justifications, three allocations โ and all three ended up on the global nuclear blocklist.
The naming is revealing. "DATACENTER" (AS35478) is the primary. "BUNEA-HIGH-VOLUME-NETWORK" (AS42397) suggests a network designed for volume โ bulk traffic that would be blocked on the primary ASN. "BUNEA-HIGH-PEER-NETWORK" (AS62380) suggests a network designed for peering โ connecting to other networks. Three ASNs, three functions, one operator. This is the multi-ASN evasion pattern documented in 035G: when one ASN gets blocked, traffic shifts to another. When your business is sending traffic that gets blocked, you need redundant autonomous systems.
Feo Prest SRL (AS208137) is the newest โ allocated August 2025, already on ASN-DROP by 2026. Less than a year from RIPE allocation to global nuclear blocklist. That is a speed record that suggests the entity existed for the sole purpose of obtaining IP address space for malicious use.
Exhibit 4: The Constellation โ Every Romanian SRL
๐๏ธ The Complete Romanian Bulletproof Landscape
| ASN | Entity | Risk | Our IPs | Status | Notable |
|---|---|---|---|---|---|
| AS205275 | ROMARG SRL (admin: Radu Tofan) | 96.0 | 2 | ๐ด BP | Highest risk Romanian ASN. Threat 100 IP. 6,383 AbuseIPDB reports on one IP. |
| AS62390 | NexonHost Srl | 93.3 | 13 | ๐ด BP | Chinese phishing domains. SSH key sharing with US/DE botnets. |
| AS60982 | X-ZONE IT SRL | 89.2 | 1 | ๐ด BP | Allocated Nov 2023. Single prefix. |
| AS212221 | INTERNET BROKER SRL | 88.0 | 1 | ๐ด BP | Hostname: pc189.efx.ro. 100 prefixes announced. |
| AS208137 | Feo Prest SRL | 4.2 | 2 | ๐ด BP ๐จ DROP | Allocated Aug 2025, already ASN-DROP. |
| AS35478 | Bunea TELECOM SRL | 0.0 | 0 | ๐ด BP ๐จ DROP | 3 ASNs, all dropped. Zero risk because universally blocked. |
| AS42397 | Bunea TELECOM SRL | 0.0 | 0 | ๐ด BP ๐จ DROP | HIGH-VOLUME-NETWORK. Bulk abuse ASN. |
| AS62380 | Bunea TELECOM SRL | 0.0 | 0 | ๐ด BP ๐จ DROP | HIGH-PEER-NETWORK. Dark โ 0 prefixes announced. |
Eight bulletproof ASNs. Six distinct SRL entities. All registered in Romania. Combined risk infrastructure serving global cybercrime from EU jurisdiction.
Source: [HONEYPOT] asns table filtered by country=RO AND is_bulletproof=true. Cross-referenced with Spamhaus ASN-DROP, PeeringDB, and RDAP.
The pattern repeats: Romanian SRL registration, RIPE NCC ASN allocation, minimal infrastructure, maximum abuse tolerance. Each SRL is a separate legal entity โ making coordinated enforcement difficult. Each ASN is a separate network โ making coordinated blocking incomplete. The constellation is designed to be resilient through fragmentation.
Exhibit 5: The Global Campaigns โ Romania as a Node
๐ Attack Campaigns with Romanian Participation
Romanian IPs appear in 7 global HASSH-based attack campaigns, spanning 48 countries:
| Campaign | Tool | Global IPs | Countries | Romanian IPs | RO Avg Threat |
|---|---|---|---|---|---|
| libssh_0.11.x Cluster | libssh botnet | 1,313 | 84 | Part of cluster | โ |
| OpenSSH_7.4 Cluster | Legacy OpenSSH | 757 | 78 | 2 | โ |
| libssh2_1.11.0 Cluster | libssh2 scanner | 628 | 48 | 16 | 69.5 |
| Go_SSH Cluster | Go SSH library | 320 | 43 | 2 | โ |
| OpenSSH_10.0 Cluster | Cutting-edge SSH | 18 | 11 | 1 | โ |
| OpenSSH-keyscan Cluster | Key reconnaissance | 4 | 4 | 1 | โ |
| openssh_modern Cluster | Modern SSH variant | 3 | 3 | 1 | โ |
Source: [HONEYPOT] campaigns table, HASSH-based clustering. The libssh2_1.11.0 campaign is the most significant Romanian-connected campaign: 628 IPs across 48 countries, with Romania contributing 16 IPs (2.5% of the campaign) at a threat score of 69.5.
The libssh2_1.11.0 campaign is the clearest illustration of Romania-as-corridor. This is a global credential-scanning operation using 628 IPs across 48 countries. The top countries: US (270 IPs), Netherlands (84), Germany (39), France (37), Canada (21), Romania (16). Romania is the 6th-largest participant in a 48-country scanning campaign โ contributing 2.5% of the infrastructure.
That 2.5% is revealing. Romania is not the campaign's base โ the US and Netherlands are. Romania is a participating node โ providing hosting infrastructure that the campaign operator provisioned alongside infrastructure in 47 other countries. The Romanian nodes are hosted on NexonHost (AS62390) โ the bulletproof provider. The campaign uses them because NexonHost will not respond to abuse complaints. Romania's contribution to the campaign is not Romanian hackers. It is Romanian hosting.
Exhibit 6: Hackerville โ Where It Began
๐๏ธ Rรขmnicu Vรขlcea: From Auction Fraud to Global Stage
Around 2005, the small city of Rรขmnicu Vรขlcea (population ~93,000) in the foothills of the Southern Carpathians gained international notoriety as "Hackerville" โ a center of internet fraud, primarily eBay auction scams.
- The business model: Young Romanians posted fake auctions on eBay (cars, electronics), collected payments via Western Union, and disappeared. At its peak, an estimated $1 billion annually flowed through Romanian internet fraud operations.
- Guccifer (Marcel Lehel Lazฤr): Born 1971, unemployed taxi driver from Sรขmbฤteni, Arad County. With "no fancy equipment, only a clunky NEC desktop and a Samsung cellphone, and no special skills beyond what he had picked up on the web" โ he hacked Colin Powell, George W. Bush's family, Sidney Blumenthal (exposing the Hillary Clinton private email server), a UN official, the Rockefeller family, and dozens of US government officials. Convicted in Romania (2014, 7 years) and the US (2016, 52 months). His technique: Google searches for security question answers. Patience and persistence, not technical skill.
- DIICOT (Directorate for Investigating Organised Crime and Terrorism): Romania's answer to the cybercrime wave. Created dedicated cybercrime units and became a key FBI partner for European cybercrime investigations. Romanian law enforcement has participated in multiple international takedowns.
Source: [OSINT] Wikipedia (Guccifer), Wired ("The Rise and Fall of Hackerville"), FBI/DIICOT joint operations. Rรขmnicu Vรขlcea Wikipedia confirms cybercrime notoriety circa 2005.
Hackerville is the origin story, but it is not the current story. The eBay scammers of 2005 were users of the internet โ social engineers, fraudsters, confidence artists who happened to work online. The Romanian corridor of 2026 is infrastructure โ ASNs, prefixes, hosting, transit, anonymization. The evolution is from Romanian hackers using the internet to global hackers using Romanian infrastructure.
Guccifer is the perfect metaphor for this transition. A Romanian who hacked Americans โ the Hackerville model. But the infrastructure that makes NexonHost, M247, and Bunea TELECOM possible is the inverse: global actors using Romanian legal entities to host attack infrastructure that targets the entire world.
๐ The corridor question
Q: Why Romania specifically?
A: Five structural factors converge:
1. Bandwidth: Romania has some of the fastest and cheapest internet in the EU โ fiber penetration driven by Digi Communications' aggressive rollout. Cheap bandwidth attracts hosting providers.
2. EU membership: Romanian SRLs are EU legal entities. An ASN registered to a Romanian SRL operates under EU data protection law, appears in RIPE NCC databases as legitimate, and benefits from EU mutual recognition. This is jurisdictional legitimacy at minimal cost.
3. SRL registration: A Romanian SRL (Societate cu Rฤspundere Limitatฤ) can be registered quickly and cheaply. Minimum capital: 1 RON (~โฌ0.20). This makes Romania the cheapest jurisdiction in the EU for creating the legal entities that RIPE NCC requires for ASN and IP allocation.
4. Enforcement gap: Romania has cybercrime enforcement (DIICOT) but it focuses on Romanian criminals targeting foreign victims โ the Hackerville model. Hosting infrastructure that serves foreign criminals is a lower enforcement priority because the victims are not Romanian and the operators may not be Romanian.
5. Geographic position: Romania sits at the intersection of Western European internet infrastructure and Eastern European/Russian networks. It is physically close to both the Amsterdam/Frankfurt peering hubs and the Eastern European hosting markets.
Q: Is this unique to Romania?
A: No โ the Netherlands, Germany, and the US all serve similar corridor functions. But Romania occupies a specific niche: the cheapest EU jurisdiction with the fastest bandwidth and the lowest barriers to SRL/ASN registration. The Netherlands has more hosting but higher costs. Germany has stricter enforcement. The US has more infrastructure but higher liability. Romania is the low-cost, low-friction, EU-legitimacy corridor โ the EasyJet of cybercrime infrastructure.
โ๏ธ The Romanian Corridor โ Verdict
Romania is not a cybercrime country. Romania is a cybercrime corridor โ the physical location where global attack infrastructure is hosted, anonymized, and routed through EU-legitimate legal entities.
- M247 โ 5,000 prefixes, 60 IXPs, "Servers Factory LLC" hiding 19 attack IPs (all abuse=100) inside a legitimate VPN provider's address space
- NexonHost โ bulletproof, risk 93.3, 100% abuse rate, Chinese phishing domains, SSH key sharing with US/German botnets
- Bunea TELECOM โ 3 ASNs, all Spamhaus ASN-DROP, the only entity in our dataset with 3 separate nuclear-blocklisted networks
- 8 bulletproof ASNs, 6 SRL entities, 4 on Spamhaus ASN-DROP โ more bulletproof infrastructure per capita than any other EU country
- 16 IPs in a 48-country, 628-IP scanning campaign โ Romania as a provisioned node in global attack infrastructure
The corridor exists because Romania offers the rarest combination in European cybercrime infrastructure: EU legal legitimacy at post-Soviet prices. A Romanian SRL costs โฌ0.20 to capitalize. An ASN allocation from RIPE NCC takes weeks. A bulletproof hosting operation takes months to attract attention and years to shut down. In the meantime, the infrastructure serves global cybercrime from an EU jurisdiction โ legitimate until proven otherwise, and proving otherwise takes longer than the infrastructure needs to operate.
Seventy-five IPs. Twenty-five ASNs. Eight bulletproof. Four on the global nuclear blocklist. Chinese phishing domains on Romanian servers. SSH keys shared between Romanian, American, and German botnets. One corridor connecting the world's attack infrastructure to EU legitimacy. This is not Hackerville anymore. This is the Romanian Corridor โ where everything passes through, and nothing stays.
Series Preview: The Romanian Corridor (TI-2026-036)
| ID | Title | Focus |
|---|---|---|
| 036A | The Corridor | Overview: M247, NexonHost, Bunea TELECOM, the bulletproof constellation |
| 036B | The M247 Empire | Deep dive: 5,000 prefixes, 60 IXPs, VPN anonymization as infrastructure |
| 036C | The SRL Factory | Romanian company registration as a cybercrime enabler, RIPE NCC allocation patterns |
| 036D | Hackerville to Hosting | The evolution from Romanian hackers to global infrastructure through Romania |
| 036E+ | forthcoming | Cross-corridor connections, ROMARG deep dive, FlokiNET ideology, and more |
Methodology
- [HONEYPOT] โ sec_intel_search(country=RO): 75 IPs, 25 ASNs. honeypot_asn_dossier for AS62390, AS9009, AS200651, AS205275, AS35478. sec_intel_ip_dossier for top-threat IPs. sec_intel_find_related for SSH key and entity graph analysis.
- [ENRICHMENT] โ AbuseIPDB (abuse scores, ISP attribution), GreyNoise (mass scanner classification), Shodan (port/service discovery), RDAP (registration data), Spamhaus (ASN-DROP list), PeeringDB (network metadata), VirusTotal (passive DNS for hostname resolution).
- [INTEL-LINKER] โ Automated cross-referencing: shared SSH keys, shared RDAP organizations, shared abuse contacts, shared service stacks, shared OTX pulses. Entity graph depth-2 traversal from Romanian ASNs.
- [OSINT] โ Wikipedia (Guccifer biography, Rรขmnicu Vรขlcea history), Spamhaus ASN-DROP list (431 entries, 4 Romanian), RIPE NCC allocation records.
- [XREF] โ TI-2026-023 (M247/VPN analysis), TI-2026-035G (jurisdictional arbitrage), TI-2026-035A (kill chain pipeline), TI-2026-035K (convergence entity table).
๐ Series Navigation โ The Romanian Corridor (TI-2026-036)
036A โ The Corridor โ 036B โ The M247 Empire โ 036C โ The SRL Factory โ 036D โ Hackerville to Hosting โ forthcoming
Related series: Kill Chain Economy (035A-L) | Full Dossier Archive