🔗 The Upstream

038D named four persons behind three shell companies. This letter traces the infrastructure upstream: who provides the network connectivity that makes the proxy factory possible? Who carries the traffic? And who has been enabling this ecosystem for years?

The answer came from Recorded Future's Insikt Group, whose 2025-2026 intelligence reports documented the complete upstream chain — and placed our proxy factory within a far larger criminal infrastructure ecosystem that includes sanctioned entities, Russian state-linked disinformation networks, and the most prolific malware hosting operations on the internet.

I. The Chain of Enablement

When our honeypot records 86,239 proxy verification attempts from 179.43.139.58, the traffic traverses a specific chain of network operators. Each link in that chain made a choice — a commercial choice — to carry that traffic.

Every entity in this chain has been independently documented by multiple security research organizations. This is not inference. This is routing data.

II. Railnet LLC — The Predecessor

Railnet hosted over 30 malware families: DarkComet, Amadey, Remcos RAT, Latrodectus, Dark Crystal RAT, Rhadamanthys, StealC, Vidar, and Lumma. As of October 2025, Recorded Future observed 80+ validated C2 servers on Railnet's AS.

The Virtualine Connection

Railnet's significance extends beyond its own malware hosting. It serves as the backbone for Virtualine Technologies, a Russia-linked bulletproof hosting provider that openly advertises on Russian-language underground forums.

• Virtualine leases at least 14 IP prefixes through Railnet
• Virtualine's registration address: 71-75 Covent Garden, London — a virtual office hub shared with Stark Industries Solutions, Aeza International, and Global Connectivity Solutions
• Virtualine's domain (virtualine.net) was hosted alongside proxio.net, antired.net, and lanedo.net — all bulletproof hosting fronts
• A forum user "Secury" on BlackHatWorld promoted the Proxio proxy service using Virtualine's logo as their avatar

III. The Migration — Railnet to OMEGATECH

In January 2026, Recorded Future observed infrastructure migrating from Railnet LLC (AS214943) to OMEGATECH LTD (AS202412). The IP prefixes that appeared in Railnet's space — 91.92.240.0/22, 158.94.208.0/22, 178.16.52.0/22 — are the exact same prefixes where our honeypot observes proxy verification and C2 activity.

The same IP blocks. The same malware. The same operator. What Recorded Future tracked as "Railnet LLC" through 2025, we track as "OMEGATECH LTD" through 2026. The only thing that changed was the shell company name.

IV. MGN Teknoloji — The Turkish LIR

All three /22 prefixes (91.92.240.0/22, 158.94.208.0/22, 178.16.52.0/22) are sub-allocated from MGN Teknoloji Anonim Sirketi, a Turkish Local Internet Registry headquartered in Istanbul. According to Recorded Future, this LIR sponsors several suspicious ASNs, all created in 2025.

Turkey occupies an unusual position in internet governance — a NATO member with both strong Western commercial ties and permissive hosting regulation. A Turkish LIR can allocate RIPE IP space to entities in any RIPE region (Europe, Middle East, parts of Central Asia), providing a layer of jurisdictional distance between the operator and the IPs.

V. The Aeza Parallel — Sanctioned Infrastructure in the Same Ecosystem

Our proxy factory shares upstream infrastructure with Aeza Group — a Russian hosting provider that was sanctioned by the US Treasury (OFAC) on July 1, 2025 and by the UK government on September 19, 2025.

The parallels between Aeza and our proxy factory's operators are structural:

Same upstream. Same virtual office address. Same malware families. Same jurisdictional arbitrage pattern. The proxy factory that tests our honeypot 186,000 times operates within the same documented ecosystem as a US-sanctioned entity whose founders were arrested by the FSB in a former Wagner PMC building.

VI. The aurologic Question

VII. The Company Impersonation Pattern

The Railnet/OMEGATECH ecosystem has a documented pattern of impersonating legitimate companies to register ASNs:

• metaspinner net GmbH: A legitimate Hamburg software company's name was used to register AS209800. The real metaspinner provided evidence to Recorded Future proving identity theft.
• VSVK Onderhoud B.V.: A legitimate Dutch construction firm's name was used to register AS213511, with Railnet as upstream.
• Lanedo GmbH: A legitimate Hamburg software consultancy's name was used to register "Lanedo Datacenter" (ORG-LD194-RIPE) on the same day IP prefixes were transferred from metaspinner.

This pattern suggests that RIPE's verification procedures are insufficient to prevent criminal actors from registering network resources under stolen corporate identities. A basic check against publicly accessible company registration documents would have prevented these fraudulent registrations.

VIII. What Our Honeypot Proves

Our Cowrie honeypot sits at the end of this chain. When 179.43.139.58 connects and attempts to tunnel traffic to Yahoo.com, it is executing the final step in a vertically integrated criminal enterprise:

1. Virtualine (Russian BPH) provides the commercial proxy service
2. Railnet/OMEGATECH provides the network infrastructure and C2 hosting
3. Socks5 Systemz/ProxyBox converts malware victims into proxies
4. Pfcloud UG provides upstream transit to OMEGATECH
5. aurologic GmbH provides upstream transit to Pfcloud and Railnet
6. MGN Teknoloji (Turkish LIR) allocated the IP space
7. RIPE NCC approved the allocations without catching company impersonation

Each entity has plausible deniability. Each can point to the entity below or above it. But the result is measurable: 186,923 proxy verification attempts on a single honeypot over 94 days, from infrastructure that simultaneously hosts 67 C2 servers for 16 malware families, operates in the same ecosystem as sanctioned entities, and is run by operators who impersonate legitimate companies to obtain network resources.

"They didn't build one network. They built layers of deniability. Kentucky shells, Seychelles registrations, Turkish LIRs, German transit, London virtual offices, Ukrainian phones. Every layer exists to make accountability impossible. But routing data doesn't lie. And honeypot logs don't forget. This is all the same system."

TI-2026-038E · The Permanent Siege · Letter E
Published by LSN Threat Intelligence · June 22, 2026
Sources: Recorded Future Insikt Group, Cowrie honeypot, threat_intel PostgreSQL, Spamhaus, RIPE NCC, US Treasury OFAC, CORRECTIV, Qurium, Abuse.ch ThreatFox, BGP routing data
Cross-referenced: TI-010 (GPU Hunter), TI-019I (Trident), 038A-D, Aeza sanctions