14 October 2026
A new investigation by Qurium Media Foundation finds that the Internet infrastructure associated with the Russian hosting provider Aeza has not disappeared following exposure, service terminations and U.S. sanctions. Instead, much of the underlying network capacity has survived by transferring Internet resources to new legal entities controlled by the same people or closely connected partners.
Qurium has identified eleven legal entities that account for more than 2/3 of the IP space operated by Aeza and NetCrafters, the latest reincarnation of Azea. Qurium focused its efforts on exposing the owners of seven of those entities, all operating under “offshore setups” to obfuscate their operations.
- Plant Holding GmbH (Switzerland, United Arab Emirates)
- Axiom Asia Services (Singapore)
- Prostie Reshenia LLC (Armenia, Russia)
- Rapidseedbox (Hong Kong, Seychelles,Serbia)
- Technology Enriched Company FZCO (United Arab Emirates)
- Oner Investments (Russia, Cyprus)
- Andwase Limited (Russia, British Virgin Islands)
The investigation builds on Qurium’s and EU DisinfoLab’s July 2024 research into the infrastructure supporting the Russian influence operation known as Doppelganger. That reporting, conducted alongside investigations by CORRECTIV, Investigace.cz and VSquare, contributed to several service providers terminating infrastructure used by the disinformation operation.
Aeza-linked infrastructure has also repeatedly appeared in investigations involving malware distribution, infostealers, traffic-distribution and cloaking services, online fraud and the Russian darknet marketplace BlackSprut.
At the end of 2022, Aeza’s AS210644 announced around 6,400 IPv4 addresses. Four years later, Aeza International and the Aeza-linked NetCrafters network together originated 536 IPv4 /24 networks, representing more than 137,000 IPv4 addresses, more than over twenty times Aeza’s original address space.
The findings come after the US Treasury’s Office of Foreign Assets Control (OFAC) designated the Russia-based Aeza Group LLC on 1 July 2025. A subsequent sanctions action identified UK-based Hypercore Ltd as an Aeza front company and said Smart Digital Ideas DOO in Serbia and Datavice MCHJ in Uzbekistan had been used to evade sanctions and establish infrastructure no longer publicly associated with the Aeza brand.
For the first time, Aeza’s network evolution since July 2024 has been reconstructed following the origin and redistribution of its address space, and examine the comparatively persistent role of the LIRs and infrastructure providers behind it. Qurium’s investigation follows the Internet resources themselves, such as autonomous systems (ASN), IP prefixes, routing relationships, upstream providers and Local Internet Registry (LIR) records, rather than relying only on company names which can be changed quickly.
Instead of showing that Aeza disappeared after exposure and sanctions, the network history illustrates a process of preservation, redistribution, rebranding and, ultimately, growth in Internet resources. Just like an elite athletics relay, Internet prefixes are smoothly passed from one runner to the next, never breaking momentum as each teammate takes their turn to carry it across the finish line.
Why it matters? Qurium’s findings raise a broader question about the effectiveness of sanctions against infrastructure operators when the technical resources underpinning their activities can remain operational under different companies, ASNs and jurisdictions.
How is it related to Qurium’s work? Aeza was exposed by Qurium in 2022 as a key infrastructure provider behind Doppelganger, one of the largest Russian online disinformation campaigns targeting European audiences. Reporting by Qurium and other investigative media contributed to the disruption of Aeza’s services and was followed by sanctions against the company and related entities.
Read the full report: Sanctioned, Still Connected: How AEZA’s Infrastructure Supply Chain Survived
More on Doppelganger and Aeza:
Qurium Media Foundation is an international non-profit organization that provides secure hosting, digital forensics, incident response, and infrastructure protection for journalists, human rights defenders, and public-interest media organizations worldwide. Its investigations focus on censorship, surveillance, digital attacks, and the infrastructures that enable them. Learn more at qurium.org.
Press Contacts
Digital Forensics
Tord Lundström <t at virtualroad.org>
Technical Director
Media Contact
ClaraZid <info at virtualroad.org>
Outreach and Media manager