14 October 2026

Our customer is not called Aeza

At the end of 2022, AEZA-AS (AS210644) announced just 25 IPv4 prefixes, covering 6,400 addresses. Four years later, Aeza International and the Aeza-linked NetCrafters network together originate 536 IPv4 prefixes covering roughly 135,000 addresses, more than twenty times their original IPv4 address space. The consolidation and expansion of these network resources has continued despite regulatory and law-enforcement pressure.

On 1 July 2025, the US Treasury’s Office of Foreign Assets Control (OFAC) designated the Russia-based Aeza Group LLC, its UK affiliate Aeza International Ltd, and the Russian subsidiaries Aeza Logistic LLC and Cloud Solutions LLC. However, the sanctions did not simply make the Aeza network disappear. Instead, the infrastructure persisted through a succession of new corporate identities, entities and jurisdictions.
In a second round of sanctions, OFAC identified Hypercore Ltd in the United Kingdom as an Aeza front company and stated that Smart Digital Ideas DOO in Serbia and Datavice MCHJ in Uzbekistan had been used by Aeza to evade sanctions and establish infrastructure no longer publicly associated with the Aeza brand.

The repeated creation of new legal entities also provides a convenient argument for infrastructure providers that continue carrying the associated network traffic. On LowEndTalk, Joseph Hofmann, director of Aurologic, has repeatedly framed the relationship around the “precise legal identity” of the contracting customer. In July 2025, when asked whether Aurologic would continue working with Aeza following the first OFAC designations, he responded that Aurologic would assess the situation with “our customer, which is not Aeza Group LLC”.
By November, his formulation had become even more explicit: “we don’t have an active customer called ‘Aeza’”. His position was that providing service to a non-sanctioned entity does not in itself amount to assisting sanctions evasion, even where an ASN and all its network resources are associated with a sanctioned entity!

Research approach: follow the internet resources

This article examines what happened after July 2024, when Qurium and EU DisinfoLab published a joint investigation into Aeza and the infrastructure supporting “Doppelganger”, the largest Russian disinformation campaign ever seen in Europe. Rather than looking only at company names, we have followed the infrastructure itself: autonomous systems, IP prefixes, routing relationships, upstream providers and the Local Internet Registries through which address space was allocated, transferred or reassigned. We looked into the most hidden fabric of the Internet.

This research approach is crucial because Internet infrastructure is generally less volatile than the legal entities built around it. A company can be renamed, its directors changed and its operations moved into another jurisdiction, while the underlying address space, routing relationships and hosting infrastructure remain substantially the same. In our forensic work, these technical assets therefore provide a more durable way of measuring whether a disruption has actually removed capacity or merely changed the name under which that capacity operates.

As of September 2026, AS210644 remains registered as Aeza International Limited and continues to originate hundreds of prefixes. AS30823 Aurologic remains one of its upstreams, carrying announcements visible through Equinix in Frankfurt and Hetzner Online in Helsinki. The same live routing data still contains numerous prefixes whose descriptions identify AEZA GROUP LLC, while NetCrafters OÜ registered in Estonia now appears across infrastructure that can be traced back through earlier Aeza-associated networks and address allocations. Combahton/Aurologic first began providing connectivity to Aeza in July 2022. By early August 2024 it had become Aeza’s principal replacement upstream, immediately after DataCamp/DataPacket terminated service on 31 July, only weeks after Qurium’s investigation was published.

The result is a pattern that is more difficult to see when following company registries alone. Corporate labels and jurisdictions change quickly, while ASNs, prefixes, LIR provenance and routing relationships provide a much longer historical trail. The same distinction is important when evaluating sanctions against hosting and network operators: removing or designating one legal entity does not necessarily remove the technical resources on which its operations depend.

This report therefore asks a broader question: how effective are sanctions against infrastructure operators when the underlying Internet resources can remain available through different companies, ASNs and jurisdictions? For the first time, we reconstruct Aeza’s network evolution since July 2024, following the origin and redistribution of its address space, and examine the comparatively persistent role of the LIRs and infrastructure providers behind it.

As of 22 September 2026, AEZA and NetCrafters together originated 536 IPv4 /24 networks, representing 137,216 addresses.
AEZA’s two ASNs accounted for 418 of those prefixes: 107,008 addresses, while NetCrafters originated another 118 prefixes, or 30,208 addresses.

Background – The Doppelganger influence operation

More than two years have passed since we back in July 2024 exposed Aeza and the large hosting ecosystem surrounding it, as the main actor behind the Russian influence operation commonly known as Doppelganger. Our work was built on a previous investigation between Qurium and EU DisinfoLab from 2022, when Doppelganger first appeared.

Aeza was then a rapidly expanding Russian hosting provider with infrastructure and corporate presence outside Russia, closely connected to a constellation of smaller hosting companies serving customers seeking so-called bulletproof hosting, infrastructure designed to remain available despite abuse complaints, sanctions pressure or other attempts at disruption.

In parallel with the technical investigation, Qurium shared its findings with the German investigative media CORRECTIV, which spent weeks investigating the companies and individuals behind the infrastructure, interviewing service providers, experts and public authorities. Together with the investigative media Investigace.cz and VSquare, CORRECTIV traced how Doppelganger’s traffic passed through European companies and data centres, including infrastructure in Germany, Finland and Estonia.

An early version of Qurium’s findings circulated among government officials for weeks before publication in 2024, in at least two EU countries, including within Germany’s foreign and interior ministries. Yet, at the time of the July 2024 investigation, the campaign and much of the infrastructure supporting it remained operational.

Our initial reporting was also an attempt to trigger an institutional and industry response, rather than simply document the infrastructure. CORRECTIV questioned hosting providers, software companies and authorities about why services continued to reach entities associated with a campaign whose operators were already subject to sanctions. Some authorities referred responsibility to one another, while Estonia’s sanctions-enforcement authority said the technical structure still required further investigation. Several private-sector responses were more immediate: after the reporting, Hetzner closed accounts used by Doppelganger, the Estonian developer of the Keitaro redirection software revoked relevant licenses, and other providers later terminated services after further inquiries by CORRECTIV. By November 2024, CORRECTIV reported that these interventions had significantly disrupted the Doppelgangers’s distribution infrastructure, even though the operation itself had not disappeared.

This report cicles back to Aeza more than two years after the exposure of their operations, and asks a different question: What actually changed?
The answer is less straightforward than the succession of new company names might suggest. While corporate wrappers, jurisdictions and ASNs have changed, much of the underlying operational infrastructure survived. As our evidence below shows, all IP address space can be followed from Aeza into successor and related networks, providing a measurable record of how the infrastructure was preserved, redistributed and rebranded rather than simply dismantled.

The evidence linking this infrastructure to cybercriminal activity was and remains overwhelming. The question for Qurium and other threat-intelligence researchers is no longer whether abuse is taking place, but why the response has been so limited.

Not just disinformation

The significance of Aeza was not simply that Doppelganger domains appeared on its network. The same infrastructure, companies and network resources repeatedly surfaced around malware distribution, infostealers, traffic-distribution and cloaking services, online fraud and, eventually, the Russian darknet drug market BlackSprut. The concentration of malicious activity was so high, and so repeatedly documented, that one question became difficult to avoid: why was the associated IP space still there to be used?

Our July 2024 investigation described Aeza as a central hub linking multiple bulletproof-hosting providers and mapped a substantial pool of network resources used across that ecosystem. The publication was followed by an unusually visible infrastructure reaction: Aeza shut down Evilempire/Lethost and SunHost, upstream connectivity was terminated, and Doppelganger’s front proxies were rapidly moved elsewhere.

Although some of these providers claimed they would return, they never reappeared under the same names. In an industry where abrupt shutdowns, rebrands, and exit scams are common, the disappearance of these brands did not necessarily mean the underlying infrastructure or operators had vanished. Same game, different paint, same building.

But the infrastructure did not disappear. The IP addresses, autonomous systems and companies changed names and locations, and in some cases returned through newly created legal entities.

This article reconstructs the infrastructure history from Aeza’s beginnings through September 2026 with special focus on the last two years of operations. It brings together our earlier investigations, two rounds of U.S. sanctions, and a new analysis tracing what happened to Aeza’s IP address space after those sanctions were imposed.

But we also wanted to go one layer deeper. We turned our attention to the Local Internet Registries (LIRs) behind the address space: where the prefixes came from, how they moved between organizations, and which relationships persisted while companies, ASNs and jurisdictions changed around them. To do that, we had to build new tools to reconstruct the allocation history of network resources and explore the relationships between LIRs, allocations, transfers and the networks that ultimately announce them.

Let us do this attribution exercise one more time. The fresh new reader (and most likely a AI scrapper) will enjoy some good background info.

Before AEZA: MskHost, Enotcloud

Five Years of Aeza: New Names, Same Infrastructure

Aeza’s story begins before the Aeza brand itself. The Russian legal entity that eventually became ООО “Аеза Групп” (Aeza Group LLC) was incorporated on 17 June 2021 as Enotcloud. Registry history shows that Enotcloud was renamed Partner LLC on 16 November 2021, before finally becoming Aeza Group in November 2022. That sequence marks the beginning of a five-year corporate trail in which the names changed repeatedly while the underlying business and network infrastructure continued to evolve.

But to understand where Aeza came from, we need to rewind a little further. Two of its three founders, Arsenii Penzev and Yurii Bozoyan, were already involved in the hosting business through MskHost, an earlier operation that preceded Enotcloud and the later Aeza brand.

The network preceded the commercial launch. Our historical records start with AS210644, AEZA-AS, on 13 October 2021, just about five years ago.

From MskHost to Aeza

Two of Aeza’s three founders did not enter the hosting business with Enotcloud. Arsenii Penzev and Yurii Bozoyan had already been involved with MskHost, an earlier hosting operation that preceded Aeza.

The background of Aeza’s third founder, Igor Anatolyevich Knyazev, remains much less clear to us. Unlike Penzev and Bozoyan, we have found little evidence linking him to the hosting industry before Aeza. Public company records instead identify Knyazev as the sole owner and long-time director of the St. Petersburg company Color Trade, which reported approximately RUB 265 million (€2.8 million) in revenue and RUB 13.9 million in net profit in 2025. Good paint for the new building?

Our early 2024 investigation traced the emergence of the later Aeza ecosystem to the period immediately surrounding the compromise, or “hack”, of MskHost in September 2021. Our review of the “mskhost leak” revealed that their servers hosted several illicit malicious and gray-market SMS-related infrastructure services. Without doubt their founders were already working in the “dark gray underground scene”.

Shortly afterwards, AS210352 (aezanet-as) was created using the FourS-mnt maintainer associated with 4Services / 4server, operated by Yevgeniy Valentinovich Marinko, known online as “dimetr50”. Our previous investigation had already connected Marinko’s infrastructure to the stolen-credentials ecosystem surrounding marketplaces associated with Igor Dekhtyarchuk, “Floraby”. AS210352 subsequently became infrastructure of Partner LLC and later appeared under the Aeza identity.

aut-num: AS210352
as-name: aezanet-as (was server4-as)
org: ORG-SER1-RIPE
sponsoring-org: ORG-IML25-RIPE
import: from AS210644 accept ANY
export: to AS210644 announce AS210352
import: from AS216246 accept ANY
export: to AS216246 announce AS210352
status: ASSIGNED
mnt-by: RIPE-NCC-END-MNT
mnt-by: FourS-mnt
created: 2021-12-16T14:22:25Z
last-modified: 2024-05-19T07:40:12Z
source: RIPE

That circumstantial relationship did not simply disappear as Aeza evolved. “Marinko” has remained active through Global Internet Solutions (GIR, AS207713) and Global Connectivity Solutions (GCS, AS215540), two closely connected networks that have repeatedly appeared around the same pool of address space and providers seen in the same Aeza ecosystem. Our historical routing analysis revealed numerous prefixes moving through GIR and GCS before or after appearing in Aeza and Aeza-linked networks, making them an important part of the infrastructure supply chain surrounding the group.

In order to gain a better understanding of the IP supply chain of Aeza, we analyzed thousands of network transfers and BGP announcements that took place in these last five years. We also traced a total of 1,000 network prefixes that has been directly or closely connected to Aeza and its satellite peers or downstreams. When we built a high level time-aggregated overview of all IP transfers we could easily spot the existing relationships with GCS/GIR, Stark Industries/The Hosting in Aeza, Hypercore and most recently NetCraft OU infrastructure.

Seen this way, the network told us more than the corporate records alone could. Company names changed, jurisdictions shifted and new entities appeared, but the movement of IP space preserved a much longer trail of relationships. The “fabric of allocations”, transfers and BGP announcements made those connections visible even when the legal identities around them had changed.

Just like an elite athletics relay, the prefixes are smoothly passed from one runner to the next, never breaking momentum as each teammate takes their turn to carry it across the finish line.

A bulletproof layer within the bulletproof

As Aeza grew, a cluster of smaller networks repeatedly appeared around it. Many of these smaller entities have been used for the most sensitive or abusive operations, effectively creating a “bulletproof layer within the bulletproof.” This nested structure also provided Aeza with a degree of insulation. When one network attracted too much attention, it could be cut away without dismantling the core operation. In that sense, the smaller networks functioned like branches of a tree: expendable, replaceable, and easier to sacrifice than the trunk itself. Aeza remained the mother-ship, while the surrounding entities could be renamed, transferred, abandoned, or replaced as circumstances required.

Examples of these satellite setups included:

• Shelter LLC, which operated AS211409 (Galaxy-AS) and was associated with the Zerohost and Areasoft hosting brands
• Chromis IT Ltd, which operated AS216319 (SUNHOST-AS) and the SunHost service
• TNSECURITY Ltd, which operated AS216309, an ASN that appeared under the names TNSECURITY-AS, LETHOST-AS, and later EVILEMPIRE-AS and was used by the Lethost hosting service.

A deep rabbit hole

After Qurium’s research (“How Russia uses EU companies for propaganda”) was published on 11 July 2024 a set of events triggered the movement of the front proxy infrastructure.

• 24 July 2024: Upstream provider Datapacket stops providing upstream connectivity to Aeza and associates.
• 31 July 2024: Aeza International decided to shut down the network of smaller bulletproof hosting providers operating downstream (Lethost and Sunhost).

The events during the last week of July 2024 also included Aeza’s hilarious attempt to create confusion around the sudden loss of their upstream infrastructure. Aeza presented LetHost and SunHost’s shutdown as an “FBI seizure” after LetHost warned users on Telegram that its locations were being disconnected and urged them to make backups. Both services displayed seizure-style pages carrying FBI and other law-enforcement branding, while the supposed takedown was amplified through Telegram and Russian-language forums.

Since many ASNs vanished, new front proxies were deployed and during August 2024, the front-end infrastructure moved from:

Trivia: It was Qurium’s investigation into the Doppelganger disinformation infrastructure that first led to LetHost (AS216309) and 185.172.128[.]161, where Doppelganger operated a private Kehr cloaking proxy. Looking at what else was being distributed through the very same infrastructure, we found that it was also being used to promote cryptocurrency and dating scams. Following those campaigns and their tracking links led us to LosPollos/Adspro and, with the help of previous research by Infoblox, ultimately revealed the overlap with the much wider VexTrio traffic-distribution ecosystem.

Following the IP supply chain machinery

To be completely transparent, the IP supply chain was one of areas where our first investigation did not go far enough. Properly reconstructing the history of thousands of allocations, transfers and BGP announcements was a much larger task than we appreciated at the time, and in 2024 we only scratched the surface.

Two years later, with better tooling, more historical data and a much clearer idea of what to look for, we went back and did the exercise properly. What emerged was not a random collection of prefixes, but a much more structured and persistent network of relationships behind Aeza’s address space.

We once again looked beyond the BGP origin and asked two different questions:

• Who supplied the underlying IP address space?
• What did those providers do after the sanctions?

Open Methodology

We wanted this part of the investigation to be as transparent and reproducible as possible. For this study, we took a snapshot on 22 September 2026 of the IPv4 space currently announced by:

• AS210644 — Aeza International Ltd
• AS216246 — Aeza Group LLC
• AS203273 — NetCrafters OÜ

We then traced every identified network through the registry hierarchy. This allows us to separate three layers that are often confused when looking at IP infrastructure:

1. ASN currently announcing the address space;
2. Organization to which the subnet is assigned to ; and
3. Local Internet Registry (LIR) controlling the parent allocation from which that subnet originated.

Rather than treating the current BGP origin as the complete history of an address block, we followed the allocation chain upwards. This makes it possible to see where the address space came from, which organizations sat between the original allocation and the current announcement, and whether the same suppliers repeatedly appear across different Aeza-linked networks.

Our analysis identified 42 verified LIR accounts connected to the address space currently announced by Aeza International, Aeza Group and NetCrafters. We then examined a selection of these providers in greater detail.

The concentration is striking. Just ten address-space providers account for more than 92,000 IPv4 addresses, representing more than two-thirds of all IPv4 space currently announced by the three networks.

Several of these providers also operate through corporate structures in offshore or international jurisdictions, including

• Oner Investments (Cyprus)
• Technology Enriched Company FZCO (UAE)
• Axiom Asia Services (Singapore)
• Andwase Limited (British Virgin Islands)
• Rapidseedbox (Seychelles)

Diving into the Local Internet Registries

The following table shows the 11 out 42 LIRs registries that account for 2/3 of the total IP space operated by Aeza and NetCrafters. We decided to focus our efforts on seven out of the eleven LIRs that operate in “offshore setups” and to try to identify their owners.

Case study 1: Plant Holding GmbH

One of the largest individual sources of address space in Aeza’s current network does not come from a conventional modern RIPE allocation. It comes from a legacy IPv4 block associated with Swiss company Plant Holding GmbH, Buchs ZH, Switzerland, and its owner, Willem William van Strij de Regt.

Van Strij de Regt is also the director and controlling shareholder of the UK company IPv4 Exchange International Limited, which operates IPv4XI, a broker specializing in the purchase, sale and leasing of IPv4 address space, including legacy resources. Historical WHOIS records for ipv4xi.com identify Plant Holding GmbH and van Strij de Regt directly as the domain registrant. Plant Holding is meanwhile the registry holder associated with the legacy 138.124.0.0/17 estate, portions of which are currently assigned to or announced by Aeza.

In our September 2026 snapshot, 44 /24 networks from the Plant legacy estate are currently used by Aeza or NetCrafters. The current RIPE objects for most Aeza assignments were modified in March 2026, with several Paris and Amsterdam-labelled objects changed again in June 2026. The two NetCrafters objects were modified in April 2026.

Examples include:

138.124.13.0/24   -> AEZA GROUP LLC -> AS216246
138.124.18.0/24   -> AEZA GROUP LLC -> AS210644
138.124.50.0/24   -> AEZA GROUP LLC -> AS210644
138.124.78.0/24   -> AEZA GROUP LLC -> AS210644
138.124.109.0/24  -> AEZA GROUP LLC -> AS210644
138.124.123.0/24  -> NetCrafters OU -> AS203273
138.124.127.0/24  -> AEZA GROUP LLC -> AS210644

The following table shows how Plant Holding space has been allocated:

Identifiers: WW-VAN-STRIJ-DE-REGT, AS15509-MNT, ORG-PA18-RIPE, ch.plant

Case study 2: Axiom Asia Services

Axiom (Asia) Services is a good example of why we decided to follow the allocation chain rather than stopping at the network currently announcing an IP address.

The story starts with a Singapore company called Axiom Services Pte. Ltd., UEN 202208052M, incorporated on 8 March 2022. That company operated in RIPE under the identifier sg.axiom-asia. It was subsequently struck off. But a second Singapore company, Axiom Asia Services Pte. Ltd., UEN 202341201H, was later incorporated on 16 October 2023. A few months later, on 29 January 2024, it became a RIPE LIR under ORG-ASPL7-RIPE.

The story behind Axiom Asia Services begins with the former Infobox hosting business. Infobox was operated by the Russian company ООО “National Telecommunications”. In 2020–2021, Rusonyx acquired control of that company and its hosting business, but National Telecommunications continued to exist as a separate legal entity for several more years. The final corporate step came only in June 2024, when National Telecommunications was formally merged into Rusonyx and ceased to exist as a separate company.

The IP history moved on a different timetable. By February 2024, several parts of the old Infobox address estate had already appeared under Axiom Asia Services, and by March some of that space was being assigned to Aeza. So the transfer of address space began before the legal merger of National Telecommunications into Rusonyx was completed. Axiom did not receive the entire Infobox estate: it received a substantial portion, while other address blocks remained with Rusonyx/Astra Cloud or moved elsewhere.

Case study 3: Prostie Reshenia LLC

Mikhail Mayorov has been associated with AS49037 for many years. RIPE community records from ENOG list him as representing Megalink / PG-19 Taganrog.

Today the identity attached to AS49037 is very different. The ASN is registered to Prostie Reshenia LLC, an Armenian RIPE Local Inernet Registry (LIR) operating as am.webrocket, but its public website is still pg19.ru. The RIPE organisation ORG-PRL15-RIPE was created on 28 April 2023, and AS49037 is maintained by WEBROCKET-MNT..

Our RIPE reconstruction finds, for example, that the parent allocation 46.226.160.0/21 belongs to Prostie Reshenia LLC, while subnets below it were registered to AEZA GROUP LLC beginning on 1 February 2024. The same pattern occurs with 92.246.132.0–92.246.143.255, with Aeza assignments created in January 2024, and with 89.169.52.0/22, where Aeza assignments were created in November 2024.

In our 22 September 2026 snapshot, Prostie Reshenia accounts for more than eight thousand IPv4 addresses or 32 /24-equivalents. Prostie Reshenia supplies almost 6% of the current Aeza/NetCrafters estate.

Identifiers: WEBROCKET-MNT, AS49037, am.webrocket, ru.megalink, ru.mayorov, ru.mayorov2, ru.mayorov3

Case study 4: Rapidseedbox

Rapidspeedbox is yet another LIR that built its large pool of IP addresses by merging several smaller LIRs, a known well trick among the IP harvesting “entrepreneurs”. In this case rapidseedbox built its pool using ghost companies in Russia and Israel. The company is run by Yuli Azarch and Eliran Mukdasi.

RapidSeedbox has supplied IP resources to Aeza since at least January 2022. As of September 2026, at least 17 RapidSeedbox IPv4 /24s are authorized/originated by Aeza’s AS210644 and AS216246, together with a RapidSeedbox IPv6 /29.

Identifiers: sc.radidseedbox

Case study 5: Technology Enriched Company FZCO

Technology Enriched Company is the most obscure LIR of our research. The main address block is 77.110.64.0/18 that originated as a legacy allocation to P-Group S.A.L. (OffShore) in Lebanon on 4 June 2007. By late 2024, control of the complete /18 had moved to the UAE-based Technology Enriched Company FZCO, whose RIPE operation was administered by Mohd Shiraz through lir-ae-technology-1-MNT.

Technology Enriched subsequently divided the /18 into two equal /19 pools, each containing 8,192 IPv4 addresses. The two halves developed very different usage patterns.

The lower half, 77.110.64.0/19, first appeared on 13 December 2024 under the netname CloudIPdenLLC (Wyoming), an IP-address brokerage and hosting business associated with Hasaan Ahmad. CloudIPden was acting as a downstream customer, broker or commercial user of the pool. On 8 July 2025, Technology Enriched reassigned the same /19 object from CloudIPdenLLC to Hong KongHGC Global Communications Limited. On 29 January 2026, the earlier sub-allocation object was removed.

The upper half, 77.110.96.0/19, followed a markedly different path. Technology Enriched created the parent object on 30 January 2025 and began carving it into individual /24 networks During May 2025, large batches of /24 route objects were created for AS210644 Aeza International and later AS216246 Aeza Group.

Historically, 27 of the 32 /24s in the upper /19 became associated with Aeza, After the July and November 2025 OFAC actions against Aeza and entities involved in its subsequent reorganization, ten of those historically Aeza-associated /24s later appeared under NetCrafters / AS203273, while seventeen remained directly originated by Aeza ASNs.

At the time of writing, Aeza/NetCrafters cluster occupies 84.4% of the entire upper /19, and 42.2% of Technology Enriched’s complete /18.

The strongest identified individual is Mohd Shiraz <mohdshiraz@techenrich.ae> and <ahussain@techenrich.ae> but unfortunately the nature of Technology Enriched Company is unknown to us.

RIPE records show:

role:       Mohd Shiraz
nic-hdl:    MS57568-RIPE
email:      mohdshiraz@techenrich.ae
phone:      +971 56 855 8356
address:    Ghayathi City
            Al Dhafra Region
            UAE

created:    2024-10-28
maintainer: lir-ae-technology-1-MNT

The Aeza relationship is explicit in RIPE, the strongest finding remains the upper half of the former P-Group /18.

Indicators: ORG-TECF2-RIPE, ae.technology

Case study 6: Oner Investments

Oner Investments (HE 275568) is company registered in 2010 at the “Pythagora 3 office” in Limassol, Cyprus. The company is run by Ivan Bulavkin. Current Cyprus open-registry data lists Igor Artemenko and Natalia Charalampous as directors.

Oner is associated with a cluster of online marketing and advertising platforms including SeoPult/PromoPult, Click.ru, PromoNavi/PromoNavigator, TrustLink, and Webartex. Company and service documents identify ONER as the owner or exclusive-rights holder for several of these systems, while Click.ru is described as part of the SeoPult ecosystem.

During our research we found a mail thread at RIPE from 2015 discussing the abusive practices of Bulavkin Ivan Aleksandrovitch. The behavior was noticed inside the RIPE community. Participants in the RIPE Address Policy Working Group discussed Bulavkin’s repeated /22 allocations in a thread explicitly titled “Hoarding /22 out of 185/8.“ Much of the space went to PROXY6 and INHOST, later appeared behind GIR and GCS, and a small surviving portion now appears directly under NetCrafters and Aeza.

Currently, Oner Investments is leasing out three prefixes to Netcrafters, the new online presence of Aeza. Several allocations of their pools go to Proxy6 LLC and Inhost MCHJ announced by SIA GOOD AS212496 (aka GOODTEC). Goodtec is also a provider that has received more than 25 prefixes previously routed by Marinko GIR and GCS.

Identifiers: OINT1-RIPE, noc@onerinvestments.com, TNM-MNT maintainer, ru.mainacc, ru.ibulavkinXX series and ru.srv2013, ORG-BIA108-RIPE

Case study 7: Andwase Limited

Qurium already encountered this supplier in our 2024 investigation but using yet another name.

In June 2025 a new British Virgin Islands LIR, Andwase Limited (vg.andwase), appeared in the RIPE database. On 4 July 2025, the large IPv4 estate previously registered to Network Management Ltd (sc.netman) began moving to the new LIR. The transfer included many of the same parent allocations from which Network Management had previously assigned address space to Aeza and other hosting networks. By 2026 Andwase controlled close to 90 thousand IPv4 addresses across 82 allocations.

During our early Doppelganger investigation we identified Network Management Ltd / IP4MARKET as an important source of address space used by Aeza. Qurium examined fifteen prefixes allocated through Network Management to Aeza Group and Aeza International and found that more than half had previously been used by NTX Technologies and FIRST SERVER LIMITED. Qurium identified both hosting operations with Iurii Bogdanov, who was also associated with the LIR infrastructure around IP4MARKET.

Iurii Bogdanov is notorious for using a myriad of entities to conduct his operations. Network Management formed part of the IP4Market infrastructure that earlier operated MediaServicePlus/NTX LIR identities ru.ntx and ru.msp2018.

As of September 2026, only 256 IPv4 addresses supplied through Andwase remain actively announced by the Aeza-linked network through NetCrafters OÜ. A second /24 remains registered to NetCrafters but is not currently announced. Historically, however, at least 4,864 Andwase-sourced addresses appeared across Aeza and related networks.

His latest move has been the migration from sc.netman to vg.andwase and the establishment of a new presence in Alicante, Spain in March 2026 (First Server, SL B26949230 / Artem Shcherbakov).

A simplified picture of Bogdanov LIRs and IP-resource transfer over the time follows:

Identifiers: ru.ntx, ru.msp2018, sc.netman, vg.andwase, ORG-FSSL4-RIPE

Conclusion

Aeza and its ecosystem remains having access to a large pool of IP space originating not less than 536 IPv4 prefixes covering roughly 135,000 addresses. Two rounds of sanctions have had no real impact oin their ability to operate and obtain IP space from prefix brokers and local internet registries (LIRs).

There is not a single hidden supplier behind Aeza sourcing of network addresses, but a relatively concentrated market of organisations capable of providing, leasing or redistributing large amounts of IPv4 and IPv6 space. In our September 2026 snapshot, 92,928 of the 137,216 IPv4 addresses currently originated by Aeza and NetCrafters are associated to just eleven allocation holders (local internet registries). They range from established Russian and Iranian LIRs to address brokers and companies operating through Singapore, Switzerland, Cyprus, the UAE, Seychelles and the British Virgin Islands.

Much of this address space is considerably older than the companies currently controlling or using it. Plant Holding provides access to a legacy address estate; Axiom received portions of the former Infobox-Rusonyx network after a succession of corporate changes; Prostie Reshenia preserves infrastructure associated with the older Megalink operation; RapidSeedbox accumulated resources through several LIR structures in Russia and Israel; Technology Enriched took control of a legacy Lebanese allocation; and Andwase inherited address space previously sitting behind Network Management and their IP4Market.

As in the case of Aeza’s legal setup, several of the historical LIRs part of this investigation were acquired, merged, struck off, renamed or moved between jurisdictions, while the underlying address space remained available for reassignment.

A hosting company can rename itself in a few minutes. A new UK, Serbian, Uzbek or Estonian company can be incorporated. An autonomous system can be transferred or renamed. But the movement of hundreds of network prefixes leaves a clear historical record that links the supply chain.

A timeline of AEZA, Doppelganger and the criminal infrastructure

The clearest way to understand Aeza is to place the infrastructure, cybercrime and enforcement events on the same timeline.

These categories describe observed infrastructure relationships and migrations.