📊 Exhibit A: The Two Faces of M247

Same ASN. Same company. The American half generates 42× more abuse reports per IP than the Romanian half. The Swiss IP alone — a single machine in Zurich — has 6,112 AbuseIPDB reports, more than all 19 Romanian IPs combined by a factor of 63.

📊 Exhibit B: The Naming Ceremony

Within a single autonomous system, M247 operates under at least 10 distinct organizational identities. Each RDAP registration tells a different story about who owns the IP space:

Every single "M247 Ltd [Country]" IP physically geolocates to Romania and uses the same abuse contact: abuse@m247.ro. The Venezuelan infrastructure is in Bucharest. The Bahamas infrastructure is in Bucharest. The Sri Lankan infrastructure is in Bucharest. The naming convention is the infrastructure equivalent of a passport forgery ring — except it's legal.

📊 Exhibit C: Servers Factory LLC — The Attack Arm

Of M247's 47 observed IPs, 20 are registered under Servers Factory LLC with the contact email iphostmaster@serversfactory.com and a Delaware phone number: +1(302) 327 4003.

Every Servers Factory IP has an abuse confidence of 100%. The AbuseIPDB categorization for IP 185.255.100.198 reads: DDoS (83 reports), SSH abuse (90 reports), Port Scanning (9 reports), Brute-Force (13 reports). A single IP, 114 distinct reporters, 371 total reports. This is not an outlier. This is the median.

Three Servers Factory IPs are registered to the UK but report zero abuse. The remaining 17, registered to the US, have an average threat score of 72.6. Same company, same IP block (185.255.100.0/24). The UK-registered ones are the showroom. The US-registered ones are the factory floor.

📊 Exhibit D: The Subsidiary Ecosystem

M247's AS9009 hosts IPs registered to entities that appear independent but route through the same autonomous system:

Count the jurisdictions: Romania, Austria, Seychelles, UK, Dubai, US, Switzerland. Count the abuse contacts: 7 different email domains. Count the underlying infrastructure: one autonomous system, one set of peering agreements, one routing table. The corporate complexity exists in the legal layer. The infrastructure is singular.

📊 Exhibit E: The Fingerprint — 628 Nodes, 48 Countries, One Tool

23 of M247's 47 IPs — 49% of the total — share the identical HASSH fingerprint 14b2ddda386a4d1006108ccd231b42fc, corresponding to libssh2 version 1.11.0. This fingerprint belongs to a global scanning campaign:

The campaign's top 5 ASNs tell the story of who provides infrastructure for mass scanning:

M247 ranks 7th globally in providing infrastructure for this campaign. The top providers are the same names that appear in our Kill Chain Economy series (TI-2026-035): OVH, SingleHop, Psychz, ColoCrossing, MULTACOM. These are not independent operations. They are the same ecosystem viewed through different corporate registrations.

📊 Exhibit F: The Tor Layer

Four M247 IPs in our dataset operate as Tor exit nodes or relay infrastructure:

Note the pattern: the Tor exits are not registered to M247 directly. They are registered to subsidiaries — OVO Systems (Seychelles), Virtono (Romania), Hosteroid (UK). If a Tor exit node gets seized, the trail leads to a subsidiary, not to M247 Europe SRL. If a law enforcement request arrives, it goes to a different abuse contact in a different jurisdiction. The parent company maintains plausible distance.

📊 Exhibit G: The SSH Key Bridge

Our SSH key analysis found two shared key fingerprints connecting M247/Servers Factory IPs to external infrastructure:

Additionally, the Servers Factory IP 185.255.100.198 shares SSH keys with:

• 198.46.134.148 — via key 7d:82:06:b9:52:f7:94:99:e7:a4:2f:1e:0e:77:b8:4d
• 45.142.3.73 — via key 77:60:de:e8:2f:d6:c7:97:6e:ad:96:a8:1d:fc:63:11

SSH key sharing across different ASNs and countries means the same private key was deployed on machines in different networks. Either the same operator controls both endpoints, or the same provisioning system deployed them. Neither explanation is innocent.

📊 Exhibit H: The Zurich Anomaly

One IP demands special attention: 37.120.213.13, registered to M247 LTD Zurich via SDAT-MNT (abuse@s-data.ro — note: a Romanian abuse contact for a Swiss IP).

• Threat score: 66.0
• Abuse confidence: 100%
• AbuseIPDB reports: 6,112
• OTX pulse count: 50 (highest in the dataset)
• Appears in honeypot feeds from: Australia, South Korea, US, Japan, Germany

Pulse names include: "PurpleSynapz," "SSH Brute-Force Honeypot Live," "T-Pot Sydney," "RaspiNAS SSH + Web Honeypot Live Feed." This single Swiss IP appears in 50 threat intelligence feeds simultaneously. It has been reported by honeypot operators on every inhabited continent. And it continues to operate.

6,112 abuse reports. 50 threat intelligence feeds. Still online. Still scanning. The abuse contact is a Romanian email address for a Swiss IP operated by a Romanian company through an Austrian registration. How many jurisdictions must you cross to file an effective complaint?