🇸🇪 TI-2026-044D — The Backbone: M247, NordVPN, and Mullvad — When Privacy Is Plumbing

The Backbone: M247, NordVPN, and Mullvad — When Privacy Is Plumbing

Series: The Nordic Paradox

Confidence: High on the documented facts; medium on motive

Core judgment: The privacy VPN market does not sit above the internet's abuse layer. It rents it.

Executive Summary

In the first three parts of The Nordic Paradox, the series mapped a Scandinavian privacy ecosystem that presents itself as principled, transparent, and rights-conscious. Part A documented the Swedish privacy-hosting tradition around PRQ, Bahnhof, DFRI, and Njalla. Part B showed that the same Swedish hosting cluster produces measurable attack traffic. Part C traced how Baltic address leasing turned Lithuania into an IP-laundering junction. Part D moves lower in the stack. It examines the network plumbing itself.

That plumbing is M247 Europe SRL (AS9009), a Romanian carrier owned by Australia's Macquarie Group, and it appears everywhere once you start looking. The investigation data shows three things simultaneously. First, M247-linked infrastructure accounts for 47+ attacker IPs in the honeypot corpus, with the ServersFactory subset in 185.255.100.x reaching threat scores of 95-100 and clustering into a large libssh2_1.11.0 campaign. Second, the same network is a named provider for Mullvad in 27+ countries and a confirmed infrastructure dependency for NordVPN. Third, M247's official geofeed projects the company into 116 countries, including sanctioned jurisdictions such as Iran and Cuba. Privacy routing, jurisdiction shopping, and attack infrastructure are not separate businesses here. They are the same substrate. [E1][E4][E7]

This matters because the VPN industry's core promise is not speed or convenience. It is trust. Consumers are told that a VPN creates distance between them and surveillance, or between them and crime, or between them and corporate profiling. The investigation data shows a more precise reality: a user who buys a "no-log" VPN frequently lands on infrastructure that is also selling transit, virtual geography, and operational cover to everyone else. The internet's respectable privacy layer is built on wholesale capacity that does not distinguish between a dissident, a fraud operator, a Netflix bypass customer, or a botnet node. [E1][E4][E8]

The industry defense is always the same: infrastructure providers do not control how customers use servers. That argument becomes weak when the same patterns recur across the same address space, across the same sub-entities, across the same geofeed practices, and across the same incident history. It becomes weaker still when the market's moral claims fail under legal pressure. The investigation data records that PureVPN provided logs to the FBI in 2017, IPVanish provided data to DHS/HSI in 2016, HideMyAss assisted in the 2011 LulzSec case, EarthVPN produced information for Dutch police in 2014, and Windscribe produced identifying traces in 2021. The baseline, empirically, is not "no logs." It is unverified marketing until tested. [E3]

There is one documented exception in the dataset: Mullvad. In April 2023 Swedish police arrived with a warrant. They left without customer data because Mullvad's RAM-only design reportedly gave them nothing durable to seize. That result does not rescue the market. It isolates the anomaly. Mullvad is notable precisely because the outcome is so rare. The article's title is not metaphorical. Privacy is plumbing. And plumbing inherits the ethics of whoever owns the pipes. [E5][E10][E11]

---

FINDINGS

1. M247 is dual-use infrastructure, not a neutral carrier abstraction. The dataset ties AS9009 to both commercial VPN routing and attacker IP concentration in the same investigative frame. [E1][E4][E8]

2. ServersFactory is the dangerous core inside the better-known M247 brand. The 185.255.100.x cluster contains the highest threat scores in the sample and aligns with a broader botnet campaign. [E1]

3. NordVPN's trust model depends on hidden third-party hosting decisions. Its 2018 Finland breach happened on M247 infrastructure, reportedly through an insecure remote management interface outside the customer's control. [E2]

4. Most "no-log" claims collapse under adversarial pressure. Five named VPN brands in the record produced logs, metadata, or other identifying traces for law enforcement. [E3]

5. Mullvad is the exception that proves the rule. The 2023 police raid produced no customer data, validating RAM-only design in a way few providers have endured. [E5][E10]

6. Kape's ownership structure corrupts the recommendation layer. A company descended from Crossrider's adware ecosystem now owns multiple flagship VPN brands and the review sites that steer customers toward them. [E6]

7. M247's geography is a product. Its geofeed maps infrastructure to 116 countries, including sanctioned jurisdictions, while earlier investigations documented "virtual locations" that are operationally real to customers but physically elsewhere. [E7]

---

Evidence Table: Infrastructure and Corporate Chokepoints

---

Chapter 1: The Pipe Is the Story

Most VPN analysis still treats network carriers as background scenery. The user sees the brand. The marketing copy emphasizes jurisdiction, encryption, audits, and slogans about freedom. The carrier disappears behind a polished app. The investigation data does the opposite. It brings the carrier back into frame and shows that M247 is not a passive dependency. It is one of the main industrial pipes through which privacy traffic and abusive traffic coexist. [E1][E4][E8]

M247's public profile is respectable enough to calm a customer who never looks past the landing page. It is a real carrier, not an obviously criminal shell. It is Romanian in operation, Australian in ownership through Macquarie, and broad in commercial reach. That is exactly why it matters. The internet's abuse layer increasingly depends not on cinematic bulletproof hosts, but on legitimate wholesale networks whose business incentives reward scale, churn, and geographic flexibility more than deep scrutiny. Earlier investigations already established that M247 had become backbone infrastructure for VPN providers. The current investigation extends the point: M247 is not merely adjacent to abuse. It is part of the same operational map. [E1][E8]

The numbers in the record are not abstract. Honeypot and Qdrant data place 47+ attacker IPs on M247-linked infrastructure. The subset attached to ServersFactory in 185.255.100.x reaches 95-100 on threat scoring and clusters into a large libssh2_1.11.0 campaign. That is not ambient internet noise. It is concentration. When the most toxic nodes sit in a recognizable bloc under a recognizable maintainer layer, the question stops being whether the provider has any bad customers. The question becomes whether the provider's commercial model structurally tolerates bad customers because the same flexibility that sells virtual privacy also sells operational cover. [E1]

This is the first hard lesson of the dossier: privacy is not an overlay sitting above the internet's dirtier layers. It is sold inside them. M247's network routes for premium privacy brands, but the same address space also appears in attack telemetry. The contradiction is only surprising if one still believes that privacy infrastructure and abuse infrastructure are different ecosystems. The evidence says they share the same pipes. [E1][E4]

Chapter 2: NordVPN, Mullvad, and the Same Backbone

The investigation data is unusually clear about the commercial relationships. Mullvad's own relay listings publicly identify M247 as a provider in more than 27 countries. Prior investigation data enumerated a country spread that includes AT, AU, BE, BR, CA, CH, CZ, DE, DK, ES, FI, FR, GB, HK, IE, IN, IT, JP, NL, NO, PL, PT, RO, RS, SE, SG, and US. In other words, M247 is not a marginal vendor buried in one market. It is built directly into Mullvad's global product. [E4]

The same is true for NordVPN, though the relationship comes into view through incident history as much as public routing. The investigation cites NordVPN's October 2019 disclosure that the 2018 server breach in Finland occurred on infrastructure tied to M247. The problem, according to the cited investigative trail, was not NordVPN's client app or WireGuard branding or PR language. It was a remote management interface on rented infrastructure. The customer bought a VPN brand. The risk sat inside a hoster dependency. [E2]

This is the operational meaning of the article's subtitle. When privacy is plumbing, the brand does not fully own the trust model. The brand leases it. NordVPN can market Panama jurisdiction, modern protocols, and independent assessments, but if the rented server is exposed through insecure out-of-band management at the datacenter level, the promise collapses below the marketing layer. The breach was important not just because a key was exposed, but because it demonstrated that VPN reputation is downstream from infrastructure discipline the customer never sees. [E2]

Mullvad sits in the same dependency chain, but its technical posture is different enough to matter. The investigation notes that Mullvad publicly names M247 rather than hiding the provider relationship, and that it built its service around cash or crypto payments, no email requirement, 16-digit account numbers, and RAM-only servers. The public relay list and the police-raid outcome put Mullvad in a peculiar position: it is both dependent on the same commercial backbone as other VPNs and one of the few providers in the evidence set that seems to have designed its internals for an actual seizure scenario instead of a marketing brochure. [E4][E5][E10]

That distinction matters because the VPN market often sells jurisdiction as if it were the decisive variable. It is not. The investigation data on NordVPN's corporate layers makes that clear. The brand is presented through a Panama -> Netherlands -> Lithuania corporate sequence, with operational ties to the Lithuanian Tesonet milieu and a public corporate evolution around Nord Security. Customers read "Panama" and infer insulation. The breach record says that a meaningful part of the risk sat elsewhere: in Finland, on M247 infrastructure, in the very physical and operational layer hidden beneath the brand abstraction. [E2][E9]

Chapter 3: The No-Log Market and Its Failure Record

The phrase "no logs" has become one of the most overused and least falsifiable claims in consumer security marketing. It works because the customer cannot directly inspect the provider's internal state. What the investigation data offers instead is a stress test history. Under pressure from law enforcement, what happened?

The answer, across the named cases, is blunt. PureVPN produced logs in an FBI investigation in 2017. IPVanish provided information to DHS/HSI in 2016. HideMyAss assisted in the 2011 LulzSec case. EarthVPN produced information for Dutch police in 2014. Windscribe produced identifying traces in 2021. The precise legal posture varies by case, and the exact data produced is not identical in all five examples, but the pattern is consistent enough that the investigation treats it as an empirical baseline: "no-log" is marketing until disproven under legal stress. [E3]

That does not mean every provider lies in the same way. It means the burden of proof is inverted. The industry asks the public to believe a negative proposition — that data does not exist, that correlation is impossible, that architecture makes retention infeasible. The historical record in the dataset says belief is cheap and court-tested design is rare. What usually exists is some combination of session metadata, temporary traces, account correlation, upstream logging, or recoverable infrastructure telemetry. [E3]

This is where Mullvad becomes analytically useful. On 18 April 2023, Swedish police executed a warrant at Mullvad's Gothenburg office. According to the investigation data, officers were shown that the relevant systems did not hold persistent customer data and left empty-handed. A subsequent letter connected the request to a German blackmail investigation involving institutions in Mecklenburg-Western Pomerania, with IPs traced to Mullvad. The point is not that Mullvad can never fail. The point is that its architecture faced the exact kind of event every VPN advertises readiness for, and the specific documented outcome favored Mullvad's claims. [E5][E10]

That is why the dossier calls Mullvad "the anomaly that proves the rule." If every provider behaved like Mullvad under seizure conditions, the result would not be exceptional enough to note. Instead, the industry record is dominated by services whose privacy claims either dissolved or narrowed sharply when tested. The exception highlights how weak the broader field is. [E3][E5]

The investigation adds one more Swedish point of comparison: OVPN, launched in 2014, also positions itself around RAM-only servers and an explicit post-Snowden rejection of tax-haven branding. OVPN matters less here as a major market force than as additional evidence that the Swedish privacy ecosystem did produce technically serious actors. The paradox is that these serious actors still buy, lease, or traverse the same wholesale network layers as everyone else. The ideals are real. The plumbing is still shared. [E11]

Chapter 4: The NordVPN Lesson — Corporate Layers Do Not Fix Physical Reality

NordVPN is a good case study because it combines every element the modern VPN market uses to build trust: scale, brand recognition, audit language, jurisdictional storytelling, and an increasingly complex corporate structure. The investigation data traces that structure through Panama, the Netherlands, and Lithuania, and ties the company's rise to the Tesonet founders' ecosystem. Those layers matter to investors, regulators, and lawyers. They matter less to a compromised server sitting in somebody else's rack. [E9]

The 2018 Finland breach is therefore more than a reputational scar. It is a map of the trust stack. At the top are brand and policy statements. Below that sit company registrations and holding entities. Below that sit datacenter contracts, remote-management surfaces, hosting operations, and carrier dependencies. The compromise happened at the lower layer. That is where the user's privacy promise actually had to hold. It did not. [E2]

This is not just NordVPN's problem. It is a structural problem for any large VPN service that relies on leased infrastructure across dozens of jurisdictions. Scale requires intermediaries. Intermediaries multiply hidden trust assumptions. A provider can be honest about not retaining user activity logs while still inheriting catastrophic exposure from a third-party interface it did not control or did not even know about. That is one reason the investigation treats the privacy market less as a moral category than as a supply chain. [E2][E4][E8]

Once viewed as supply chain rather than slogan, the series narrative becomes clearer. Parts A-C showed how Nordic privacy culture, Swedish hosting ideology, and Baltic address mobility create favorable conditions for ambiguous infrastructure. Part D shows that the same ambiguity persists at the backbone layer. The customer buying "Nordic privacy" may in practice be buying Romanian transit under Australian ownership, geofeeded into whichever country label the product requires that day. [E7][E8][E9]

Chapter 5: Kape and the Collapse of Editorial Independence

The VPN market does not only suffer from infrastructure opacity. It also suffers from recommendation capture. The investigation data identifies Kape Technologies as a company descended from Crossrider's adware and malware ecosystem that now owns ExpressVPN, Private Internet Access, CyberGhost, ZenMate, vpnMentor, and Wizcase. That is not just portfolio expansion. It is vertical integration across the entire consumer trust funnel. [E6]

A privacy customer usually arrives through one of three paths: search results, comparison sites, or "best VPN" recommendation lists. Kape's ownership map means that the same corporate family can increasingly own the product being sold and the review property recommending it. Even if individual editorial teams claim independence, the structural conflict is already present. The investigation does not need to prove daily manipulation of rankings to establish the problem. The ownership geometry is enough. [E6]

This matters inside The Nordic Paradox because the series is not merely about criminals using privacy infrastructure. It is about respectable institutions industrializing ambiguity. M247 sells the carrier layer. Kape consolidates the recommendation layer. NordVPN and similar providers sell the branded consumer layer. The result is an ecosystem where trust is manufactured at the top while opacity concentrates at the bottom. [E2][E6][E8]

The irony is that the industry's most convincing privacy evidence in the current dataset does not come from marketing awards, affiliate reviews, or jurisdictional slogans. It comes from a failed police seizure against Mullvad. The strongest proof is negative: they came, they looked, and there was nothing durable to take. That is what real technical credibility looks like. Everything else is copy until the warrant arrives. [E5][E10]

Chapter 6: M247's Geography Market

The geofeed issue deserves separate treatment because it reveals how commercial privacy infrastructure and compliance arbitrage intersect. The investigation data states that M247 geofeed data maps the company into 116 countries, including sanctioned jurisdictions such as Iran and Cuba through distinct RIPE entities. Earlier related investigation data also documented official M247 geofeed mappings to a long list of "exotic" virtual locations beyond the company's obvious physical footprint. [E7]

For the customer, this is a feature. A VPN endpoint that appears to be in Tehran, or Panama, or the Bahamas, or somewhere else, is part of the product catalog. For sanctions compliance, attribution, and fraud analysis, the same feature becomes a problem. It blurs the distinction between physical location, registration location, routing origin, and commercial label. That ambiguity is not incidental. It is what the customer is buying. [E7]

And again, the moral problem is not that M247 offers geography-flexible routing in itself. The problem is that the same network offering those virtual geographies also appears in attack telemetry with high-confidence threat scoring. Once a provider sells location as a service, it also sells friction against attribution. That friction benefits journalists and dissidents in some cases, but it also benefits fraud operators, credential thieves, botnet administrators, and anyone else who wants to stand one country away from where they really are. [E1][E7]

This is why the series keeps returning to the same conclusion from different angles: infrastructure does not inherit the ethics of its marketing copy. It inherits the incentives embedded in its business model. M247's model rewards scale, reach, and fungibility. Those same properties are attractive to privacy customers and abusive operators alike. [E1][E4][E7]

---

EVIDENCE

• [E1] M247 and ServersFactory attacker IP concentration — Cowrie honeypot + Qdrant honeypot_ips; reliability: high. Documents 47+ attacker IPs on M247-linked infrastructure and threat scores 95-100 in the 185.255.100.x ServersFactory subset.
• [E2] NordVPN confirmed 2018 breach on M247 Finland infrastructure — NordVPN official statement Oct 2019 + prior dossier evidence; reliability: high. Establishes the Finland breach as an M247-hosted incident.
• [E3] No-log VPN failures across multiple jurisdictions — court documents + tech press + prior dossier evidence; reliability: high. Documents the PureVPN, IPVanish, HideMyAss, EarthVPN, and Windscribe cases.
• [E4] Mullvad relay API names M247 in 27+ countries — Mullvad relay list API + prior dossier evidence; reliability: high. Makes the carrier relationship explicit, not inferred.
• [E5] Mullvad police raid validated RAM-only design — Mullvad official blog + Swedish press, April 2023; reliability: high. Documents the raid and the lack of seized customer data.
• [E6] Kape corporate lineage and portfolio — public filings + prior dossier evidence; reliability: high. Traces Crossrider -> Kape and the VPN/review-site ownership map.
• [E7] M247 geofeed spans sanctioned jurisdictions — M247 geofeed data + prior dossier work; reliability: high. Documents presence in 116 countries, including Iran and Cuba.
• [E8] Independent OSINT confirms M247 VPN provider role — prior dossier evidence; reliability: high. Corroborates M247 as infrastructure provider to major VPN brands.
• [E9] NordVPN corporate structure: Panama -> Netherlands -> Lithuania — Wikipedia/NordVPN + Wikipedia/Tesonet; reliability: high in the investigation record. Documents the corporate layering and Tesonet lineage.
• [E10] Mullvad 2023 raid details — Wikipedia/Mullvad in the investigation record; reliability: high. Adds case context, including the German blackmail investigation and subsequent port-forwarding decision.
• [E11] OVPN: Swedish no-log VPN, RAM-only since 2014 — OVPN About page; reliability: high. Confirms Sweden produced more than one technically serious RAM-only provider.

---

Questions That Remain

1. How much of M247's abuse exposure is known internally at the carrier level versus isolated at the reseller or sub-entity layer? The threat concentration around ServersFactory suggests the issue is structural, but the public record does not show what escalation thresholds exist inside the organization. [E1]

2. How much of NordVPN's and Mullvad's M247 reliance is optional versus unavoidable at current scale? The investigation proves dependency, but not the exact percentage of each fleet routed through M247 at the time of writing. [E4][E8]

3. How many "virtual location" endpoints marketed by major VPNs are materially just jurisdictional labels on shared European infrastructure? The geofeed record indicates the model; the full inventory is larger than the current dossier. [E7]

4. Can any major commercial VPN besides Mullvad produce a seizure-tested, architecture-level demonstration that user-identifying data truly does not exist? The historical record in this dataset suggests the answer is usually no. [E3][E5]

5. What due-diligence burden should apply when financially regulated owners such as Macquarie hold infrastructure that repeatedly appears in both privacy routing and attack telemetry? The commercial incentives are visible. The governance response is not. [E1][E8]

Conclusion

Part D makes the paradox more concrete. The problem is no longer just that Scandinavian privacy culture produced permissive hosting environments, or that Swedish ASNs and Baltic IP markets repeatedly surface in hostile telemetry. The problem is that the backbone itself is compromised by ambiguity.

M247 routes for services that market safety, anonymity, and civil-liberties credibility. The same network family hosts attacker IPs, virtual geographies, and high-threat sub-clusters. NordVPN's most important trust failure happened on M247 infrastructure. Kape demonstrates that even the recommendation layer is captured. Mullvad stands out because it is one of the few actors in the record that appears to have built its architecture for reality rather than advertising. [E1][E2][E5][E6]

The broader series question sharpens here. If privacy depends on shared industrial plumbing, then the real issue is not whether VPN branding sounds sincere. The issue is whether a market built on opaque carriers, virtual geography, and unverifiable retention claims can ever be meaningfully trusted without hostile testing.

By the end of this dossier, the answer is uncomfortable but clear: privacy, at scale, is not a sanctuary. It is a supply chain. And supply chains inherit the morals of whoever gets paid to keep them flowing.