✂️ The Split — Registered Here, Routed There

The simplest move is to put the paperwork and the packets in different countries.

Data Campus Limited (AS215929) is a Hong-Kong-registered company. The attack block it runs — 62.164.177.0/24, home of the xmlrpc.php sweep pair from Letter B — is routed from the Netherlands. The whole segment is small and entirely hostile: three web-active IPs, and all three also appear in the SSH honeypot.

🌫️ The Scatter — One Network, Many Flags

The hyperscalers achieve the same effect without trying. Microsoft Azure is one US-registered network (AS8075, ARIN) — yet its abusing nodes geolocate to Switzerland, Britain, Singapore and Brazil. The empty-UA webshell node 172.161.73.175 reports CH while riding a US ASN.

This is not Microsoft lying; it is the structural consequence of global allocation. But the effect for a defender is identical to deliberate deception:

• You cannot country-block a hyperscaler — there are too many apparent countries.
• You cannot ASN-block it — too much legitimate traffic rides the same number.

🏛️ The Masterpiece — M247 and the Virtual Nations

Splitting and scattering are amateur next to what M247 Europe SRL has built. It does not merely route around the map — it edits the registry.

The web scanner 146.70.194.252 carries the signature contradiction in miniature: prefix-origin Romania, registrant Netherlands. And the backbone is owned by Macquarie Group, an Australian listed financial conglomerate — so the ownership has its own fourth and fifth flags.

⚖️ Why It Matters — Location Is Jurisdiction

This would all be trivia if location were cosmetic. It is not. Where an address "is" decides which law can reach it — who may subpoena the host, whose sanctions apply, which court can order a takedown, which police force even has standing to knock.

FATF's virtual-asset guidance and the US Treasury's 2024 proliferation-financing assessment both document jurisdiction-shopping as a deliberate sanctions-evasion technique in finance. The same logic governs infrastructure: a negotiable location is a negotiable set of laws. The attacker is not hiding where they are so much as choosing whose rules apply.

🧠 Reading Between the Lines

1. Geography is a UI, not a fact

The flag next to an IP is the output of a guess, dressed up as a measurement. Treating it as ground truth — for blocking, for attribution, for blame — is the original sin that every other deception here exploits.

2. The map is chosen, not measured

From the five competing signals, the operator arranges the ones they control (incorporation, transit purchase, RDAP declaration) to land on the most convenient answer. They are not evading the map; they are drawing it.

3. The flag is the easiest thing to change — so stop trusting it

IPs rotate; countries are negotiable; ownership hides behind shells. What does not change cheaply are the durable behavioural signals — the 170-path dictionary (Letter C), the shared SSH key, the HASSH fingerprint, the reused webshell filename. Fingerprint those. Treat country as a claim to be corroborated, never a fact to be trusted.

4. The registry is a soft target

M247's virtual nations show the deepest layer: when self-declared RDAP fields are taken as authoritative, the registry itself becomes an attack surface. The fix is not technical but governance — and that gap is a documented-negative finding about RIR verification.