🇸🇪 TI-2026-044G — The Other Nordics: Norway, Denmark, Finland and the Quiet Attack Surface

I. The Other Nordics

Parts A through F were about Sweden because Sweden is where the Nordic paradox becomes visible enough to force attention. PRQ, Bahnhof, DFRI, Njalla, Internet Vikings, and FRA produce a usable storyline: privacy hosting, gambling infrastructure, Tor exits, and SIGINT all sharing one legal and physical ecosystem. That story is true. It is also incomplete. The moment the Swedish case is understood as a regional architecture rather than a national morality play, three quieter jurisdictions come into focus. Norway, Denmark, and Finland host their own attack surfaces. Iceland supplies one of the region's most important legal and branding shelters. None of them attract even a fraction of the scrutiny Sweden receives.

The effect of that silence is practical. A jurisdiction under scrutiny accumulates journalists, parliamentary questions, activist attention, and at least some compliance pressure. A jurisdiction outside the headlines accumulates cover. That is the gap this dossier closes. The other Nordics are not empty space around Sweden. They are overflow lanes, redundancy lanes, and legitimacy lanes. Their infrastructure is smaller, quieter, and in some cases even more paradoxical than Sweden's. A Norwegian host dominates national scanner telemetry from one ASN. A Danish education and research organization runs Tor exits from a /24 in which multiple addresses sit at or near abuse=100. A Danish security firm produces stronger attack scores than many providers that would openly be called suspicious. Finland absorbs diverse, hot, and often foreign-controlled infrastructure that looks like hosting too risky, too noisy, or too politically awkward to leave in Germany proper.

The numbers are blunt. The Sweden-focused phases of this series documented roughly 30 Swedish IPs across 12 ASNs in direct hostile or enabling roles. Investigation TI-2026-044G identifies 50-plus IPs across the rest of the Nordic space, with Norway alone showing a single-provider concentration that Sweden does not match. The pattern is not that every Nordic country reproduces the same ecology. The pattern is that every one of them contributes a distinct function. Norway concentrates. Denmark legitimizes. Finland overflows. Iceland shelters. Together they turn the phrase “Nordic privacy exceptionalism” into the wrong analytical frame. The better frame is Nordic infrastructure pluralism: multiple national brands, different legal cultures, one regional role in the same anonymity and attack economy.

II. Norway — Gigahost and the Arithmetic of Concentration

Norway's signal is so concentrated that it almost looks synthetic. Fifteen of the eighteen investigation-scoped Norwegian IPs sit on one provider: Gigahost AS56655. That is 83 percent of the entire Norwegian set. Twelve of those addresses carry abuse scores of 100, while the remaining Gigahost satellites still cluster high enough to show the same underlying posture. In ordinary hosting analysis, one abusive customer or even several abusive servers can distort a provider's image. In Norway's case the distortion argument collapses because the concentration is too broad, too consistent across prefixes, and too internally coherent. This is not one bad box. It is a hosting environment whose Norwegian attack surface is functionally synonymous with one ASN.

The top end of the Norwegian table is extreme enough to stand on its own. 193.200.229.243 and 185.243.218.225 both score 78 with abuse=100. 185.243.218.229 follows at 67. 185.243.218.226 and 185.243.218.230 sit at 63. 185.243.218.231 through 185.243.218.233 sit at 60. Other Gigahost nodes on separate prefixes — 194.32.107.14, 185.181.60.204, 185.181.61.201, 194.32.107.172 — extend the same signature beyond one convenient /24. The significance is not merely that the scores are high. It is that the same institutional anchor persists across multiple nets and multiple score bands. The Norwegian market is not generating random diversity. It is generating one dominant operational gravity well.

That gravity well is not hermetically Norwegian. The investigation explicitly links Gigahost to GmhostGrupp OU in Estonia. That matters because Estonia has already appeared elsewhere in this series as part of the Baltic corridor — the same geography where IP reputation laundering, shell-company formations, and low-friction corporate wrappers reappear. The Norway-Estonia linkage turns Gigahost from a national hosting anomaly into a cross-border pattern. Norway supplies the clean brand: stable, wealthy, low-drama, high-trust. Estonia supplies the corridor logic already familiar from Part C. When those two qualities meet in one provider ecosystem, the result is infrastructure that looks local, normal, and Nordic while being structurally connected to the wider Baltic anonymity market.

This is why Norway matters. Sweden's paradox is broad and ideological. Norway's is narrow and statistical. One host dominates the country's observed attack surface so thoroughly that the only honest description is concentration risk. The headline is not “Norway has scanners.” Every country has scanners. The headline is that Norway's set collapses into one provider story quickly enough to support inference about systemic posture. A diversified national hosting market with normal abuse distribution does not produce fifteen of eighteen investigation-scoped IPs on one ASN by accident. That is why Gigahost belongs in the same conversation as the series' Swedish brands even though it is smaller and quieter. It performs the same regional function with less scrutiny.

The tail of the table matters too. 109.247.227.170 on Lyse/Altibox generated a single session with a lower threat score. 84.212.130.191 on Telia Norway sits near baseline noise. 185.35.202.222 on Blix Solutions is similarly marginal. These addresses are analytically useful because they show what normal variation looks like. The moment they are placed next to Gigahost, the Norwegian picture stops looking like a generic country sample and starts looking like a host-dominance problem. The peripheral addresses are thin, sporadic, and mixed. The Gigahost addresses are repeated, systematic, and overwhelmingly maxed on abuse. The contrast strengthens the case rather than weakening it.

III. Denmark — DotSrc, Zencurity, and the Institutional Paradox

Denmark produces a different kind of paradox. Norway's signal is concentration inside a conventional host. Denmark's signal is institutional inversion. The core cluster is split across two entities that, on paper, should reduce risk rather than amplify it. DotSrc is a research and education association. Zencurity is a security company. Yet the Danish telemetry set is led by 185.129.62.64 on Zencurity at threat=58, abuse=100, followed immediately by DotSrc Tor-exit addresses inside 185.129.61.0/24. If Sweden gave us privacy hosting that also appeared in abuse data, Denmark gives us the sharper contradiction: a civil-society infrastructure actor and a cybersecurity company sharing a namespace neighborhood that behaves like attack-classified infrastructure.

DotSrc is not hiding what it is. The ASN dossier for AS210731 shows the announced v4 prefix 185.129.61.0/24 and identifies multiple Tor exits explicitly named as tor-project-exit*.dotsrc.org. The abuse text tied to several of these IPs openly says, in effect, that this network includes Tor servers and apologizes for the inconvenience. That declared function matters because it means the Danish operator is not covertly misrepresenting its traffic. The question is not secrecy. The question is whether a research/education legitimacy layer should immunize infrastructure from the same scrutiny applied elsewhere when five addresses in one /24 sit at abuse levels between 99 and 100. The answer is no. Declared purpose explains the pattern. It does not neutralize the operational consequences of that pattern.

Zencurity is the sharper problem. AS57860's own PeeringDB note says: “Used for penetration testing, scanning and yes a Tor server.” That is an extraordinary sentence in this context because it collapses the usual defensive distinction between security work and attack-like traffic. There are legitimate reasons a security firm may scan or operate test infrastructure. There are not legitimate reasons for outside observers to simply stop asking questions when the same infrastructure appears in abuse-maxed public telemetry. 185.129.62.64 scores 58 with abuse=100. 185.129.62.63 follows at 45 with abuse=100. The lowest-score address in the tiny AS57860 set is still a Tor-linked relay. Denmark is therefore not merely hosting attack-like traffic next to a security company. A security company is itself part of the attack-classified cluster. That is the ultimate institutional paradox.

The two ASNs are also tightly adjacent in function and registration texture. DotSrc nodes repeatedly show the RDAP org dk-zencurity-1-mnt in the supporting data. The investigation records this as co-location rather than hidden ownership, and that distinction matters. We do not need to claim a secret merger or covert control to understand the significance. The significance is that Denmark's quiet attack surface is not scattered. It is organized around a small neighborhood in which research, Tor infrastructure, and security-company scanning are all normal enough to coexist. In a less trusted jurisdiction this would already be called a cluster. In Denmark it remains mostly invisible because the institutions involved sound respectable before anyone looks at the scores.

The rest of Denmark's table shows why the dual-entity core matters. Norlys contributes four honeypot hits from a low-score residential/telecom address. Materialism and Global Connectivity Solutions add peripheral noise. Those are ordinary country-background artifacts. The decisive Danish signal is still the DotSrc/Zencurity pair. Eight-plus high-salience Tor-exit and scanner-class IPs in one narrow neighborhood tell us that Denmark's contribution to the regional architecture is not raw volume. It is normative laundering. If Sweden launders abuse through privacy ideals, Denmark launders it through institutional respectability.

IV. Finland — The Quiet Overflow

Finland is the most diverse of the non-Swedish Nordics, and that diversity is precisely the point. The investigation summary describes eighteen Finnish IPs across twelve ASNs, with Hetzner Finland, AS215590, and FlokiNET-linked AS200651 as the most important clusters. Live country telemetry is even broader, but the investigation's scoped set already tells the story: Finland is where hot infrastructure can accumulate without inheriting Germany's brand. The country is not defined by one provider, the way Norway is. It is defined by overflow. German hosters, British-registered cloud labels, Iceland-linked bulletproof brands, consumer ISPs, and smaller Finnish operators all appear on the same map. Finland is quiet not because it is clean, but because its diversity prevents any one label from owning the narrative.

Hetzner is the first layer. The investigation summary names 135.181.160.223 at threat 53 and abuse 100, but the broader Finnish country dossier shows the pattern is much larger. 46.62.157.119 scores 89 with 12 honeypot hits. 46.62.239.90 scores 86 with 18 hits. 89.167.124.202 sits at 63. 135.181.67.10 sits at 62. Multiple 37.27.x, 46.62.x, 65.108.x, 65.109.x, 95.217.x, 135.181.x, and 204.168.x addresses keep repeating. That is not a single compromised tenant. It is a Finnish-hosted extension of a German cloud brand whose local geography absorbs attack-classified infrastructure at scale. When a provider is too large to narrate as “bulletproof,” the abuse signal hides inside volume. Finland lets that hiding happen with very little public attention.

AS215590 is the second layer and the cleaner investigation case. The evidence names exactly three Finnish IPs: 2.27.53.96 at 30.8, 144.31.152.46 at 51, and 2.27.53.183 at 61. The live country dossier confirms the higher two and shows Xorek.Cloud Helsinki as the abuse label. That matters because it demonstrates a repeatable secondary cluster outside Hetzner. If the Finnish story were only “German host with Finnish datacenter,” the analysis would stop there. Instead we see additional foreign-registered operators using Finnish geography for similar scanner-class behavior. Overflow is therefore not incidental. It is a hosting role the country repeatedly serves.

The third layer is FlokiNET. 37.228.129.189 and its adjacent 37.228.129.190-191 satellites are geolocated to Finland while their Cymru organization remains FlokiNET ehf in Iceland. The 37.228.129.189 dossier explicitly labels the network FlokiNET-Finland and marks the IP as a Tor exit. This is one of the cleanest examples in the series of why country labels alone are inadequate. Is the infrastructure Finnish? Physically, yes. Is the provider Finnish? No. Is the corporate and political reputation Icelandic? Yes. Finland here functions as substrate while Iceland supplies the bulletproof brand and historical anti-takedown identity. That is why the Iceland section belongs in an article that otherwise focuses on Norway, Denmark, and Finland. Iceland appears not primarily as a large standalone country cluster, but as a corporate anchor for infrastructure sitting elsewhere in the region.

Even Finland's residential and smaller-provider signals reinforce the overflow reading rather than contradicting it. Elisa Oyj appears through 88.113.147.204 at threat 65 and abuse 100. Crea Nova contributes 185.204.1.76 at 61 and 91.233.116.74 at 60. Cinia contributes 185.67.82.114 at 49.2 and abuse 98. These are not all the same kind of actor, and that is exactly why Finland matters. The country can host hyperscale cloud overflow, boutique foreign labels, Tor-exit infrastructure under Icelandic branding, and domestic ISP noise in one compact geography. That diversity is operationally useful. It lets hostile traffic blend into normal market heterogeneity.

The quietness is the strategic asset. Germany produces headlines when Hetzner is discussed. Iceland produces headlines when FlokiNET is discussed. Sweden produces headlines because the paradox is already culturally legible. Finland produces almost none, even when the telemetry says the country is carrying the same kinds of traffic through a more diverse and therefore less narratively convenient host mix. Quiet geographies are not passive backgrounds. They are part of how reputational risk is managed across a region.

V. Iceland — FlokiNET as the Regional Brand Shelter

Iceland's role in this dossier is narrower than Norway's or Finland's, but it is structurally important. FlokiNET ehf is one of the rare Nordic brands that openly markets the political value of resistance to takedowns and has a long public association with WikiLeaks mirrors and hostile-to-law-enforcement posture. That history matters because it gives the company an ideological wrapper very similar to the Swedish privacy hosts discussed earlier in the series. The difference is that in TI-2026-044G the Icelandic signal appears through Finnish-hosted infrastructure and cross-border identity, not through a huge native Icelandic country table. Iceland is the flag. Finland is one of the grounds on which that flag is planted.

That distinction matters analytically because it shows how regional infrastructure can split its functions. Corporate identity, political mythology, and press reputation do not need to live in the same jurisdiction as physical equipment. An operator can keep the anti-censorship brand in Iceland, the cheaper or quieter hosting footprint in Finland, the traffic exits in Denmark, the concentration host in Norway, and the iconic paradox narrative in Sweden. Once that possibility is seen, the whole region stops looking like separate national stories and starts looking like a menu of legal and reputational functions. FlokiNET is the clearest Icelandic entry on that menu.

VI. Combined Analysis — Fifty Plus IPs, Zero Headlines

Put the three quiet Nordics together and the comparison with Sweden becomes unavoidable. Norway's investigation-scoped table is eighteen IPs, fifteen of them on Gigahost. Denmark's is eighteen IPs dominated by DotSrc and Zencurity. Finland's scoped investigation set is eighteen IPs across a much more diverse host mix, with the live country dossier expanding far beyond that baseline. Even using the conservative scoped tables alone, the non-Swedish Nordic set reaches the same order of magnitude as Sweden's own thirty-IP series footprint. Add the broader live country data and the rest of the region actually exceeds Sweden comfortably. The phrase “the Nordic paradox” therefore remains correct only if Sweden is treated as the door into the architecture, not the architecture itself.

The functional split is what makes the regional pattern compelling. Sweden contributes the ideological paradox: privacy rhetoric, civil-liberties brands, and state interception on the same wires. Norway contributes concentrated host risk under a clean national brand. Denmark contributes institutional laundering through a research NGO and a security company. Finland contributes overflow capacity and cross-border substrate. Iceland contributes bulletproof mythology and political shelter. None of those roles requires a secret cartel. They require only market incentives, legal asymmetries, and the fact that different Nordic reputations solve different problems for the same kind of operator. That is why zero headlines is itself a finding. Silence is not absence. Silence is one more infrastructure property.

A final point matters for attribution discipline. The data in this article does not prove that Norway, Denmark, Finland, or Iceland are uniquely criminal places, nor that every operator discussed is malicious by design. What it proves is narrower and more damaging: the region repeatedly produces infrastructure that is simultaneously legitimate enough to avoid stigma and noisy enough to appear in abuse-maxed telemetry. That combination is the operational sweet spot. If defenders only look for obviously dirty jurisdictions, they miss precisely the places where high-trust branding lowers attention. The other Nordics are the quiet attack surface because they are trusted enough to be underestimated.