1. The Lie — When an IP Says New York But the Story Says Somewhere Else

The investigation starts with a simple operational question: when an attacking IP says it is in one country, what exactly is making that claim? Most operators assume the answer is singular. It is not. “Country” can come from a geofeed, a commercial GeoIP vendor, a regional registry object, an abuse contact, a BGP origin inference, a PeeringDB hint, a customer marketing page, or a reseller’s public promise. The internet does not have one map. It has layers of mutually dependent approximations.

In normal networks those approximations drift a little. A block may still point to an old city after a migration. A route may originate elsewhere for traffic engineering. A hosting company may use a legal entity in one country and datacenter space in another. None of that is inherently scandalous. What is scandalous is the pattern we saw around M247-linked space: contradiction was not occasional. It was structural. In our corpus of 47 M247-associated IPs, 21 disagreed materially with themselves about where they were. Not where we thought they were. Where they said they were.

The phrase “The Geographic Liar” is not a poetic insult. It is a technical description of an address space whose location claims are self-conflicting and whose conflicts repeatedly benefit actors who need jurisdictional blur. A packet can cross an ocean in 80ms. A law enforcement request takes 180 days. In between those timelines sits a provider able to say, in effect, “that server is there, that route is here, the customer is elsewhere, and the abuse question belongs to someone else.”

3. The /24 That Shouldn’t Exist — 185.255.100.0/24 as a Geographic Crime Scene

If the broader M247 discrepancy picture is statistical, 185.255.100.0/24 is cinematic. This is the block that makes abstraction impossible. The IPs inside it are not merely a little stale or slightly mislabeled. They are high-threat, consistently contradictory, and strangely organized. They present as United States geolocation, sit in a story whose BGP context points to Britain, and carry RDAP signals that still help the American fiction. The result is a three-layer illusion: U.S. enough for geolocation, British enough for route complexity, and detached enough from Romanian accountability to slow any clean escalation path.

These are not quiet addresses. The lead node, 185.255.100.196, is maximum-threat in our corpus. In operational terms that means repeated hostile or suspicious behavior, not merely presence on a large network. The other top nodes are not far behind. The block behaves like a pocket of infrastructure optimized for geographic confidence in one direction and accountability diffusion in another. The more malicious the node, the cleaner the American costume appears to be.

This is where the investigation turned. One contradictory IP can be dismissed. Nine high-threat IPs in one block, all repeating the same U.S./GB/U.S. pattern, cannot. This looks less like random drift and more like a template: pick a geography that reassures automated systems, route through a corridor that complicates legal ownership, and rely on registry fragmentation to absorb the first wave of complaints.

The reason this /24 matters so much is that it turns a theory into an architecture. The block is a working model of the larger M247 problem: geography is not being reported as a neutral fact. It is being composed.

5. The Geofeed Problem — RFC 8805 Turned from Accuracy Tool into Opacity Tool

RFC 8805 geofeeds were designed to solve a genuine problem: how can IP address holders publish location data in a standardized format so geolocation vendors can be more accurate? The logic was elegant. Instead of guesswork, let the people closest to the network publish authoritative mappings. But the standard contains a structural vulnerability that this dossier cannot ignore: the data is self-reported. There is no global verification body. No regulator checks whether a block labeled “Tehran” is physically in Tehran. No automated sanity check asks whether a provider that is Romanian, routing through Britain, and selling VPN inventory has suddenly acquired lawful operational presence inside every country it claims.

That is the trust chain failure. Vendors ingest because the format is standardized. Downstream products trust vendors because the vendors are established. Fraud teams trust the products because they are licensed. Internal legal teams trust fraud teams because the process is documented. By the time a bad geofeed becomes a business decision, nobody remembers it started as a CSV file that the network owner wrote about itself.

RFC 8805 was designed for accuracy. M247 uses it for opacity. That sentence should be read carefully. The standard itself is not the villain. The villain is unverified authority in a market where authority can be monetized. A VPN provider wants “Pakistan” inventory without building in Pakistan. A streaming circumvention user wants a flag, not a legal opinion. A sanctioned intermediary wants distance between operational reality and public record. An abuse-heavy cluster wants the first complaint to go somewhere slow. The same geofeed mechanism can serve all of them.

The critical question is whether M247’s published geography reflects the physical and legal truth of its infrastructure or whether it reflects what customers want geography to do. The evidence in this dossier points toward the second answer far too often to be dismissed as accident.

6. The Sanctioned Geofeeds — Why Would a Romanian Network Claim Iran, Cuba, Belarus, or Russia?

This is the chapter where the “maybe it is just sloppy” defense begins to collapse. Among the published geofeed patterns tied to M247 research are blocks that present as politically sensitive jurisdictions: Iran, Cuba, Belarus, Russia, and other locations with heightened sanctions, compliance, or reputational implications. One documented example is 62.133.46.0/24, where geofeed claims Iran while BGP context points British and the corporate anchor is Romanian. That is not merely a bad city label. It is a sanctioned-state claim attached to a network path that tells a different story.

Why would a provider do this? There are only a few plausible answers. One: the company actually operates lawful, auditable infrastructure in each claimed jurisdiction and has simply documented it unevenly. Two: the labels are meant to support “virtual location” services for VPNs and similar products, where the commercial value lies in the flag, not the territory. Three: the ambiguity itself is a feature for actors needing sanctions blur, local-content appearance, or abuse-routing confusion. The evidence in this dossier cannot fully prove which customer stood behind which claim. But it can show that the published system is compatible with all three and that the burden of proof should be on the publisher, not on every downstream victim of the ambiguity.

This is where sanctioned-state exposure becomes more than a rhetorical flourish. If a provider can self-label infrastructure as being in a sanctioned or high-risk geography while the operational chain sits elsewhere, then compliance systems are forced into absurd questions. Is the provider selling access to a location? Is it representing a legal presence? Is it fronting a reseller? Is it bridging a state network? Or is it simply teaching every vendor to misclassify sensitive traffic? In practice, no one downstream gets enough evidence to answer quickly.

8. The Botnet Highway — Twenty libssh2 Nodes, One Corridor of Ambiguity

In our honeypot’s detected libssh2 campaign, 20 nodes traced back into the M247 story. The signature was coherent: a specific client banner family, a recognizable credential set, and the kind of coordinated probing that tells you the scanners are not independent hobbyists. These were not poetic abstractions. They were live machines behaving as a campaign. And they appeared from addresses that public systems wanted to read as “United States” even while BGP context and provider structure pointed elsewhere.

That is the operational benefit of geographic instability. If a scanning wave appears American, one class of investigator routes it toward the FBI, U.S. abuse channels, or U.S.-based fraud assumptions. If the upstream carriage suggests Britain, another investigator treats it as NCA-adjacent or European transit complexity. If the commercial anchor is Romanian, yet another person assumes the complaint belongs in Bucharest. By the time any one authority sees the full picture, the botnet has moved on.

The deeper problem is not only who launched the probes. It is who built the environment in which those probes become harder to attribute in real time. A provider does not have to run the botnet to make the botnet more survivable. It only has to sell location confidence in one direction and responsibility confusion in another.

There is a phrase operators use loosely — “abuse-tolerant.” Usually it refers to response behavior. In this case the phrase may need expansion. Abuse tolerance can be architectural. A network can tolerate abuse not only by ignoring tickets, but by arranging tickets to arrive in the wrong country first.

9. The Jurisdiction Void — When Three Countries Each Say “Not Our Problem”

The most destructive feature of geographic deception is not that one person is fooled. It is that institutions are fooled in different directions. In the scenario documented by this dossier, an investigator looking at a hostile M247-linked IP might reasonably conclude the address is American. Another investigator following BGP context might conclude the relevant routing corridor is British. A third following the legal entity sees Romania. The result is the worst possible outcome for public safety: not one wrong answer, but three partial answers that cancel one another’s urgency.

When three jurisdictions each say “not our problem,” the problem becomes permanent. That is not rhetoric. It is an engineering description of governance failure. Attackers measure windows in minutes. International cooperation measures them in paperwork. A packet can cross an ocean in 80ms. A law enforcement request takes 180 days. Geographic ambiguity does not have to stop prosecution forever. It only has to stop it until the logs roll off and the campaign infrastructure rotates.

This is why the M247 pattern deserves attention even from people who do not care about VPNs or geofeeds. It shows how administrative delay can be manufactured without any overtly illegal routing trick. The provider can maintain plausible commercial explanations for each layer. The geolocation vendor can say the provider published the feed. The customer can say the provider sold the location. The police can say another country appears closer. The corridor survives because every actor has a locally rational excuse.

10. 44.7 Percent — Nearly Half of the Sampled M247 IPs Disagree With Themselves

The number matters because it forces discipline. Anecdotes can be argued forever. Rates are harder to sentimentalize. Out of 47 M247-linked IPs in our honeypot database, 21 displayed material geographic discrepancy. That is 44.7%. Internet-wide background discrepancy exists, but it is usually estimated around 3% to 5% for ordinary cases depending on method and data source. Even if you double or triple that tolerance to be charitable, M247’s observed rate in this corpus is still an order of magnitude too high. Nine to fifteen times higher than normal is not background noise. It is a pattern.

The most uncomfortable sub-finding is correlation. The more an IP lies about where it is, the more malicious it tends to look in our corpus. Correlation is not causation, but it is not nothing either. If a provider’s most suspicious nodes are also the most geographically unstable, then “location flexibility” is not randomly distributed across the network. It is clustering where it is useful.

There is a temptation in internet infrastructure analysis to hide behind philosophical humility: geography is hard, everything is dynamic, the cloud is abstract, networks are layered, the world is messy. All true. None of it explains why one provider’s abuse-relevant sample should blow past baseline discrepancy so dramatically. At some point humility becomes an alibi for refusing to count.

12. The Trust Infrastructure — How the Whole Internet Ends Up Believing a CSV File

The final scandal is not M247 alone. It is the amount of civilization built on soft location truth. MaxMind consumes feeds. IP2Location consumes feeds. IPinfo consumes feeds. Fraud engines consume vendors. Streaming platforms consume fraud engines. Corporate firewalls consume threat intel. Threat intel consumes provider metadata. Government workflows consume all of the above indirectly. By the time a location error reaches the end user, it is wearing six layers of institutional clothing.

This is why geofeed abuse matters more than a single deceptive provider. It reveals a hidden constitutional weakness of the modern internet. Too many consequential systems treat “country” as if it were a fact with chain-of-custody. In reality it is often an assertion with brand credibility. The trust chain is dense enough that nobody feels individually responsible for verification. The provider says “our feed is correct.” The vendor says “we use authoritative sources.” The customer says “we license a reputable database.” The auditor says “industry standard.” The standard says “self-published.” The circle closes.

The broader TI-2026-027 series maps corridors, pipelines, Russian hands, and German gateways. This installment supplies the missing mechanism. Geography itself can be laundered. Once that is understood, the rest of the corridor architecture makes more sense. The provider does not have to move a server into every politically useful jurisdiction. It only has to move belief.

Accountability starts with demands that are surprisingly modest: distinguish physical hosting from virtual exit geography; distinguish corporate jurisdiction from customer-facing label; document resellers clearly; provide auditable explanations for sanctioned-state or politically sensitive geofeed claims; and stop letting hostile high-threat clusters wear the same trusted-country masks month after month. If a provider cannot do those things, then regulators, vendors, and customers should stop treating self-published location as authoritative.

Appendix A — Snapshot of the Investigative Record

This appendix is included because the scandal can otherwise sound abstract. It is not abstract. It is measurable.

• 47 M247-linked IPs appeared in the honeypot corpus reviewed for this article.
• 21 of those IPs had material geographic discrepancy.
• 44.7% is therefore the observed discrepancy rate.
• The country distribution within the sample was 22 RO, 19 US, 3 GB, 2 NL, 1 DE.
• The US-claimed subset had an average threat score of 69.9, higher than the broader sample tendency.
• The 185.255.100.0/24 cluster contained multiple top-threat nodes and repeated U.S./GB/U.S. contradiction.
• The block was maintained under serversf-mnt, not M247’s primary maintainer identity.
• Public geofeed patterns associated with M247 research included sensitive or exotic geographies such as Iran, Cuba, Belarus, Russia, and other commercially useful “virtual” locations.
• The historical NordVPN breach demonstrated that VPN trust in third-party hosting geography can fail catastrophically.
• A detected libssh2 campaign included 20 M247-context nodes operating through the same ambiguity corridor.