🌐 TI-2026-021E · The Architecture of Impunity · Part 5 of 10

📡 The Upstream Enablers: Transit Providers Who Carry Criminal Traffic

Every criminal network needs one thing that money alone cannot synthesize offshore: reachability. Domains can be registered through shells. companies can be formed through nominees. servers can be leased under aliases. Abuse desks can be ignored. None of that matters if the prefixes never make it into the global routing table. A botnet control host, a scanner node, a phishing platform, a proxy marketplace, or an abuse-tolerant VPS brand only becomes operational when someone announces its routes and carries its packets to the rest of the internet. That “someone” is usually described in sanitized language as an upstream carrier, a transit supplier, or a connectivity provider. The euphemism matters because it hides the political question inside a technical function.

Transit providers like to present themselves as neutral infrastructure. In one narrow sense that is true. They move traffic; they do not author every payload that crosses their links. But neutrality becomes harder to defend when the downstream is persistently abuse-tolerant, repeatedly listed, publicly reported, and still fully reachable because the mesh above it stays intact. At that point the issue is no longer whether a carrier wrote the malware or launched the scan. The issue is whether it continues to preserve availability for networks that have accumulated enough evidence to make “we had no reason to know” increasingly implausible.

The evidence gathered for this article points toward that uncomfortable conclusion. M247 Europe SRL, operating AS9009, appears repeatedly in bulletproof-hosting chains. Specific addresses on M247 space—45.151.73.144, 185.255.100.242, and 95.181.238.191—surface with direct threat relevance, including honeypot interaction and a threat score of 100. Cogent Communications, a major U.S. backbone name, appears in attack telemetry and downstream chains that keep malicious infrastructure routable. BGP analysis for AS210558 showed 11 upstream-facing relationships, including links involving OVH and DE-CIX, illustrating that resilient criminal reachability does not rely on a single benevolent carrier. It relies on a mesh.

The actors in this layer are not all identical. M247 is a repeat enabler in the data set. Stark Industries Solutions has already attracted public scrutiny through reporting by Brian Krebs. Cogent appears as a major U.S. transit presence in attack-related chains. GTT, OVH SAS, Comcast, Macquarie Group, and other components of the wider transit fabric occupy different positions, but the outcome is the same when no one disconnects the abusive downstream: reachability is preserved. That is the upstream problem.

This article argues that the relevant question is not whether transit providers love crime. They do not need to. The relevant question is whether the combined legal and economic structure allows them to carry criminally useful downstream traffic with little cost and little scrutiny. The evidence suggests it does. The internet’s most durable abuse is not built only from shell companies and bad servers. It is built from normal-looking connectivity contracts that keep bad networks alive.

1. How BGP transit works: the brief technical primer the legal system keeps ignoring

To understand the upstream problem, one needs only the bare minimum of routing theory. The internet is not one network. It is an agreement system between many autonomous systems, each identified by an ASN. A downstream customer originates or controls IP prefixes. An upstream provider announces reachability to those prefixes so that the rest of the world knows which path to use. BGP does not inspect intent; it distributes path information. If an upstream accepts and propagates the route, the downstream becomes reachable. That is the operational hinge on which everything else turns.

In practice this means a criminally useful network can be small at the edge yet globally effective if larger carriers continue to carry its announcements. It does not need to own transoceanic cables or data-center campuses. It only needs purchased adjacency to suppliers willing to move its routes into the wider system. When defenders talk about “taking down” a malicious host, they often imagine the server or the domain as the key object. But the route is equally important. A host that remains reachable through multiple upstreams can survive listings, re-IP, or customer churn. Transit is therefore not an abstract background service. It is one of the core conditions of operational survival.

This also clarifies why blocklists are limited. Spamhaus may identify a network as abusive. Security teams may implement DROP-style rejection. But if the routes remain accepted by mainstream carriers, the network continues to exist as a first-class participant in the broader internet. Some defenders will refuse it. Others will not. The carrier’s role is not to endorse every packet, but its decision to continue announcing the downstream ensures that the downstream’s problem remains everyone else’s problem too.

The legal and policy conversation often fails here because it treats transit as too low-level to matter or too neutral to question. But neutrality is a spectrum shaped by knowledge, repetition, and alternatives. A carrier that unknowingly carries a newly abusive customer is in a different position from a carrier that repeatedly carries networks already recognized as abuse-tolerant across multiple investigations. Once repetition enters the picture, “mere carriage” becomes a thinner defense. The packets are still just packets. The commercial relationship is not just physics.

2. M247 Europe SRL: AS9009 and the scale advantage of a transit fabric

M247 Europe SRL is not a boutique operator at the margin of the internet. It is a substantial connectivity company with a large routing footprint, multiple geographies, and enough scale to function as a serious transit and hosting platform. That scale is exactly what makes its appearance in abuse chains important. Small disposable bulletproof brands often lack durable infrastructure of their own. They survive by plugging into bigger, more normalized fabrics. When a larger carrier’s platform repeatedly appears beneath malicious or abuse-tolerant downstream activity, it grants those downstreams something they cannot easily self-manufacture: resilient legitimacy of connection.

The evidence set here places M247 in that role more than once. 45.151.73.144 on AS9009 appears as a scanner node in honeypot data. 185.255.100.242, also on AS9009, carries a threat score of 100. 95.181.238.191 on AS9009 geolocates to the Bahamas while routing through M247, demonstrating the kind of geographic and commercial plasticity that makes attribution and accountability harder. None of these observations proves that every M247 customer is abusive. That is not the claim. The claim is narrower and stronger: M247 repeatedly appears where abuse-tolerant and offshore-style infrastructure needs a durable path to the internet.

That repeat appearance matters because transit is a force multiplier. Once a provider like M247 carries the routes, downstream customers inherit the benefits of a professionally maintained network. They gain the resilience, performance, and routing legitimacy associated with the larger carrier’s footprint. They can look like ordinary internet tenants even when their operational behavior is anything but ordinary. This is why the phrase “repeat enabler” is more accurate than “bad neighbor.” It names a recurring infrastructural role, not a one-off coincidence.

The Romanian identity of M247 is not the accusation. It is part of the topology. The issue is the service model at scale. Large carriers possess the operational leverage smaller actors do not: they can terminate relationships, price them differently, demand stronger verification, or create routing friction for repeat-abuse downstreams. When they do not, their infrastructure becomes a stabilizer for networks whose own business depends on being difficult to extinguish. M247 matters here because it shows how mainstream transit capacity can become a quiet dependency of the offshore abuse economy.

3. M247's downstream problem: when the honeypot sees the same platform again and again

The phrase “downstream problem” is deliberately chosen. It describes the standard defense used by carriers: we are only transporting traffic for customers further down the chain. Technically that may be correct. Investigatively it is insufficient. When the same platform keeps surfacing in telemetry from scanner nodes, threat-score-maxed addresses, and geodiscrepant routing arrangements, the question stops being whether the carrier authored the behavior. The question becomes whether it has become a preferred substrate for those who need reachability with minimal friction.

The honeypot observation of 45.151.73.144 is useful precisely because honeypot data strips away a great deal of narrative ambiguity. A host hit the sensor. The source address belonged to AS9009. The event joins other indicators that point in the same direction. Meanwhile 185.255.100.242 carries the strongest possible reputation marker in the provided data set: threat score 100. Such a score does not by itself explain intent, but it is a blunt warning that this is not ordinary customer exhaust. Add 95.181.238.191 with Bahamas geolocation and M247 routing, and a pattern emerges: the platform is not just hosting random noise. It is attractive to actors who benefit from ambiguity.

Ambiguity matters because it buys time. A scanner on Swedish-labeled space, a high-risk node on Romanian-labeled space, and a Bahamas-geolocated address on the same transit fabric do not create a single clean story for investigators or abuse desks. They create friction. Which regulator cares first? Which provider owns the rack? Which customer bought the block? Which contact has authority? By the time those questions are answered, the campaign may have finished. This is why repeat downstream ambiguity is not harmless background variance. In abuse ecosystems it becomes a service property.

There is also a reputational asymmetry at work. A carrier can point to the huge number of legitimate customers on its platform and say that a handful of malicious hosts should not define the whole network. That is fair as far as it goes. The problem is not isolated contamination. The problem is recurrence. A repeated role in bulletproof chains suggests not universal guilt but insufficient friction. In threat intelligence, recurrence changes the meaning of coincidence. It is what turns scattered facts into a pattern worthy of naming.

4. Stark Industries Solutions: the public reporting already exists

Stark Industries Solutions occupies a different symbolic role in this discussion because it is already publicly recognizable. Brian Krebs has reported on it. That matters not because journalism substitutes for evidence, but because it shows this conversation has already crossed the threshold from obscure routing trivia into broader public accountability. When a name becomes widely associated with abuse-tolerant or suspicious connectivity patterns and still retains its operational usefulness, one sees the architecture at work in plain view: exposure alone does not sever reachability.

The Moldova/UK framing attached to Stark in the data matters for the same reason cross-border corporate wrappers matter elsewhere in this series. Connectivity brands can present one jurisdictional face while operating through a more complex geographic and commercial reality. That complexity can be legitimate. It can also be instrumental. The investigative question is not whether multinational structure exists. It is whether the structure correlates with persistent availability for actors other networks increasingly refuse to host. In the Stark case, public scrutiny has not erased the relevance of the network from abuse conversations. That persistence is itself evidence of structural tolerance higher in the stack.

Stark’s significance here is therefore comparative. It shows that even when a downstream name becomes notorious enough to attract mainstream reporting, the internet does not automatically isolate it. Transit, peering, and commercial relationships can remain sufficiently intact that the network continues to matter. The myth that publicity alone fixes abuse collapses at this layer. Upstreams do not automatically disconnect a controversial customer simply because investigators and reporters have named it. The incentives and liability shields still point toward continuity unless something more coercive intervenes.

The broader lesson is uncomfortable for defenders who rely on naming-and-shaming. Public exposure is necessary but insufficient. If transit remains available, the network remains a participant. That is why the upstream layer deserves separate scrutiny. Journalism can identify. Blocklists can warn. Threat intelligence can correlate. Yet if the carriers above the downstream continue to carry the routes, the operational life of the network continues too.

5. Cogent Communications: when a tier-1 name appears in attack chains

Cogent Communications is useful in this article because it breaks the comfortable story that only obscure offshore brands matter. Cogent is a major U.S. connectivity name. When such a carrier appears in direct attack telemetry or in the upstream paths that preserve abusive downstream availability, the problem can no longer be confined to the shadows of the internet. The mainstream fabric itself is implicated. That does not mean Cogent deliberately endorses malicious use. It means that the hierarchy of internet infrastructure allows even highly visible operators to become routine carriers for lower-tier abuse ecosystems without bearing commensurate accountability.

The evidence here states that Cogent appears in direct attack telemetry—honeypot hits originating from Cogent-transited networks—and in chains that keep bulletproof environments reachable. This is exactly the sort of fact that defense narratives try to neutralize by invoking scale. A large carrier moves enormous volumes of legitimate traffic; therefore its appearance alongside some malicious events should not surprise anyone. Again, that is fair at a superficial level. The issue is not mere appearance. The issue is whether large transit names remain part of repeated reachability solutions for networks already associated with abuse tolerance. Scale does not erase pattern; sometimes it stabilizes it.

Tier-1 or near-tier-1 presence matters because it normalizes the downstream. A smaller abuse-tolerant network can survive far longer when it is carried through major global backbones. Attackers gain lower latency, broader route propagation, and institutional insulation. Victims face a harder problem because the upstream’s own legitimacy becomes part of the downstream’s protective shell. The malicious node does not look like a fringe island. It looks like just another endpoint reachable through the same planetary plumbing everyone else uses.

This is one reason the legal doctrine of simple neutrality feels increasingly inadequate in the abuse context. The carrier may not know every packet’s meaning, but it does know its customers, contractual history, and repeated complaint patterns far better than outsiders do. When a major carrier continues to support connectivity for repeatedly problematic downstreams, the question is no longer about omniscience. It is about tolerance thresholds. Cogent matters because it demonstrates that upstream enablement is not a fringe-only phenomenon. The core of the internet participates too.

6. The legal shield: Article 12 and the doctrine of mere conduit

The legal protection that makes all this economically comfortable is often summarized through the EU E-Commerce Directive’s Article 12, the doctrine of mere conduit. In broad terms, an intermediary that simply transmits information without initiating the transmission, selecting the receiver, or modifying the content is shielded from liability for that content. The doctrine had a sensible original rationale: keep carriers from becoming universal censors and prevent the communications layer from collapsing under impossible monitoring obligations. But what is reasonable for ordinary carriage becomes morally unstable when applied to repeated commercial relationships with known abuse-tolerant downstreams.

The doctrine does not require carriers to understand every packet. That is not the criticism. The criticism is that mere conduit can be interpreted so broadly that it dissolves responsibility even after patterns become obvious. A transit provider can say: we are not the content originator, not the host of the website, not the controller of the malware, not the registrar of the domain. All true. Yet the carrier is still the entity preserving the downstream’s participation in the wider network. Without that path, many forms of abuse become dramatically less effective or disappear entirely.

In other words, the law distinguishes cleanly between authorship and carriage, while abuse ecosystems exploit the fact that carriage itself has operational value. The bulletproof-hosting customer does not need the carrier to send the phishing email. It needs the carrier to keep the server reachable, the proxy alive, and the scanner connected. Mere conduit doctrine therefore protects a layer that may be central to the attacker’s continuity even if it is not central to the attacker’s creativity.

This shield is one of the reasons tier-2 providers face little legal downside for carrying criminally useful downstream traffic. Unless law, regulator, or contract creates a higher duty, the default posture is comfort. Carriers can continue to route for controversial customers while treating the issue as someone else’s responsibility. That legal architecture may protect legitimate speech and commerce at scale, but it also creates a broad safe zone for commercial passivity around known abusive infrastructure. The result is not accidental. It is exactly the kind of liability distribution on which the architecture of impunity depends.

7. The economic calculus: why transit customers are worth more than reputational discomfort

Legal insulation matters because it changes the economics. Transit customers pay. Investigating them costs money. Dropping them costs more if the decision is disputed, if the revenue is meaningful, or if the customer is part of a wider downstream cluster. Reputational damage, by contrast, is often diffuse and survivable. Outside security circles, very few people know which carriers repeatedly appear beneath bulletproof networks. Even within security circles, repeated mention rarely translates into immediate financial punishment. The result is predictable: for many carriers the expected value of keeping the customer exceeds the expected value of dropping them.

This is particularly true when the abuse-tolerant customer is only one layer removed. The upstream can tell itself that the real problem lies with the hoster, reseller, or end-user, not with transit. That narrative reduces moral urgency while preserving revenue. Meanwhile the abusive downstream may itself be valuable precisely because it is sticky. Customers who cannot easily obtain permissive transit elsewhere may pay well for continuity. That means the very clients who create the most reputational discomfort can also be the clients least likely to churn voluntarily.

The economics are even more forgiving when the network is meshed. If one carrier threatens action, the downstream may shift volume or routes elsewhere while preserving part of the relationship. This reduces the coercive credibility of any one provider’s warning and makes partial tolerance easier. In such an environment, responsibility diffuses just as profits aggregate. Everyone can carry a little. No one feels singularly decisive. The abusive network remains alive because the market has split the burden of conscience into commercially tolerable slices.

This is why reputational argument alone rarely suffices. Carriers operate under competitive pressure. If there is no shared rule that raises the cost of carrying repeat-abuse downstreams, then any one carrier that acts alone sacrifices revenue while others quietly inherit the customer. The market punishes conscience unless responsibility is collectivized. That is one reason the architecture persists so stubbornly. It is not just legally shielded. It is economically rational.

8. The mesh architecture: multiple upstreams, no single point of failure

The phrase transit mesh captures the most important technical fact in this layer: abusive or abuse-tolerant downstreams are rarely dependent on a single path. BGP analysis for AS210558 showed 11 upstream-facing relationships, including ties involving OVH and DE-CIX. Whether one describes all of them strictly as transit or as a mix of upstream and exchange relationships, the strategic meaning is clear. The network is not hanging from one cable. It is embedded in a web. That makes unilateral disconnection much less decisive and lets every participant minimize their own sense of responsibility.

This is what mature resilience looks like on the hostile side. Multiple paths ensure that no single carrier, peer, or exchange becomes an absolute chokepoint. A route withdrawn here may still propagate there. A commercial dispute with one supplier does not automatically erase the network. An abuse desk complaint that persuades one actor but not others may change traffic shape without killing the platform. The mesh therefore acts as an insurance policy against accountability. It transforms what should be a single vulnerability—dependence on connectivity—into a distributed robustness advantage.

The mesh also helps explain why defenders often experience “partial wins” that do not actually matter. A provider may respond. One route may disappear. One host may move. But the network remains reachable because the architecture was designed to survive component loss. This mirrors the logic seen elsewhere in the series: abuse ecosystems do not aim for perfect invisibility. They aim for enough redundancy that ordinary accountability mechanisms never hit the true center of gravity. In transit, redundancy is that center of gravity.

The involvement of mixed providers—OVH hosting both legitimate and problematic tenants, major carriers like Cogent, broader fabrics touching GTT, Comcast, or Macquarie-linked assets in the larger mesh—underscores the difficulty. The same network ecology that makes the internet resilient for everyone also makes it resilient for actors operating in bad faith. The question is not how to abolish that resilience. It is how to attach consequence to its repeated abuse.

9. What would fix this: from passive knowledge to upstream responsibility

If the problem is structural, the remedies must also be structural. The first and most obvious reform is automatic de-peering or transit review triggers for networks that cross clear abuse thresholds. Not every complaint should cause disconnection; that would be reckless. But repeated validated appearances on high-confidence blocklists, repeated intelligence correlation, and repeated failure of downstream remediation should trigger mandatory review by upstream carriers. Today, nothing consistently forces that review. The burden falls on individual victims or researchers to persuade providers one by one.

A second reform is reputation-based transit pricing. If a carrier continues to serve repeat-abuse downstreams, the cost should not be socialized onto everyone else while the revenue remains private. Insurance, finance, and shipping all understand risk-weighted pricing. Internet transit largely pretends the same logic is impossible. It is not impossible; it is merely inconvenient. A network with repeated high-confidence abuse indicators should face higher compliance burden, shorter review cycles, stronger identity verification, and ultimately higher prices or reduced service options if the pattern persists.

Third, upstream responsibility needs to be formalized in policy. Spamhaus and similar organizations already document downstream abuse with far greater operational seriousness than many contract layers do. Yet upstream carriers are not generally required to treat repeated listing as a governance event. That has to change. A modernized framework would not make carriers absolute censors. It would require them to confront a question they now evade too easily: if you keep selling reachability to a network that repeatedly appears in validated abuse datasets and public investigations, what duties attach to that decision?

There is no perfect fix. False positives exist. Complex supply chains complicate attribution. Legitimate customers share infrastructure with bad ones. But none of those difficulties justify the current asymmetry in which carriers preserve the upside of transit sales while disclaiming most of the downside of repeated downstream abuse. The point of reform is not perfection. It is cost redistribution. As long as the victims bear the investigation burden and the carriers bear little of the persistence burden, the market will continue to route around conscience.

10. Conclusion: reachability is not innocent when it is repeatedly sold to the same problem

The upstream layer is easy to ignore because it speaks the language of plumbing. Routes, peers, uplinks, and exchanges sound impersonal. But the politics are hidden in that impersonality. 45.151.73.144 from AS9009 hitting the honeypot, 185.255.100.242 carrying a threat score of 100, 95.181.238.191 using offshore-flavored geography through mainstream routing, 92.118.39.73 and 91.92.243.49 illustrating adjacent hostile environments—these are not isolated curiosities. They are evidence that the path layer matters every bit as much as the host layer. Someone keeps these networks connected.

The carriers involved do not need to be cartoon villains for the conclusion to hold. M247 appears repeatedly as a repeat enabler. Cogent shows that mainstream backbones are part of the picture. Stark Industries Solutions shows that even public notoriety does not automatically destroy routing viability. The wider mesh involving names like OVH, GTT, Comcast, and Macquarie-linked transit assets demonstrates that resiliency in the abuse ecosystem is purchased through multiplicity, not secrecy alone.

The legal shield of mere conduit and the economic comfort of transit revenue together explain why the system persists. Upstream providers can carry problematic downstreams with limited liability and tolerable reputational cost. Meanwhile defenders are left blocking, documenting, correlating, and warning at the edges. Reachability survives. The abuse economy adapts. The architecture of impunity continues to function exactly where it is least visible: in the ordinary commercial contracts that decide whose routes remain on the internet tomorrow.

That is the upstream problem in its plainest form. Criminal networks do not need the whole internet to like them. They only need enough of it to carry them. Today, enough of it does.