Executive Summary
Under Romanian law, a Societate cu Rฤspundere Limitatฤ (SRL) can be formed with a minimum capital of 1 RON โ approximately โฌ0.20. Registration takes days. A single person can be the sole shareholder, sole director, and sole employee. No proof of business activity is required at formation. No physical office is mandatory beyond a registered address.
This is not a bug. It's not even a feature. It's a manufacturing process. In our honeypot dataset, we identified 8 Romanian-registered ASNs involved in malicious activity. Behind them sit SRLs that share a pattern: recent registration, immediate RIPE NCC LIR membership, rapid IP allocation, and threat scores that climb within months of the ASN going live.
Romania doesn't just host cybercrime infrastructure. Romania manufactures the corporate vehicles that make it possible.
๐ญ Key Finding: The Assembly Line
The lifecycle of a Romanian bulletproof hosting SRL follows a repeatable pattern:
- Form SRL โ 1 RON capital, single shareholder, registered address at a formation agent
- Apply for RIPE NCC LIR membership โ โฌ1,400/year fee, Romanian SRL satisfies legal entity requirement
- Receive ASN and initial IP allocation โ /22 or /23 IPv4 block from RIPE's remaining pool or via transfer market
- Announce prefixes via upstream transit โ Often through M247 (AS9009) or other Romanian transit providers
- Begin operations โ Threat scores reach critical levels within weeks
- When burned: Abandon SRL, form new one, transfer IP allocations, restart
Total cost to launch: approximately โฌ2,000 (SRL formation + first year LIR membership). Total time: 2-4 weeks. The result: a fully operational autonomous system with globally routable IP space, registered to a legal entity that can be abandoned without personal liability.
๐ Exhibit A: The Romanian ASN Registry
Every ASN in our dataset with Romanian registration, ordered by risk score:
| ASN | Name | Entity | Risk | Threat Class | Allocated | Spamhaus |
|---|---|---|---|---|---|---|
| AS205275 | ROMARG | ROMARG SRL | 96.0 | CRITICAL | Oct 2017 | โ |
| AS62390 | NEXONHOST | NexonHost Srl | 93.3 | CRITICAL | Nov 2021 | โ |
| AS200651 | FlokiNET | FlokiNET ehf (IS) | 50.5 | MEDIUM | May 2015 | โ |
| AS9009 | M247 | M247 Europe SRL | 44.0 | MEDIUM | Jun 2005 | โ |
| AS215659 | MOEMOEKYUN | Aokigahara SRL | 40.5 | LOW | Jan 2024 | โ |
| AS208137 | FPS12 | Feo Prest SRL | 4.2 | LOW | Aug 2025 | ASN-DROP โ |
| AS35478 | DATACENTER | Bunea TELECOM SRL | 0.0 | DEAD | โ | ASN-DROP โ |
| AS42397 | HIGH-VOLUME | Bunea TELECOM SRL | 0.0 | DEAD | โ | ASN-DROP โ |
| AS62380 | HIGH-PEER | Bunea TELECOM SRL | 0.0 | DEAD | โ | ASN-DROP โ |
Read the ASN names that Bunea TELECOM chose for itself: "DATACENTER," "HIGH-VOLUME-NETWORK," "HIGH-PEER-NETWORK." Three ASNs, all Spamhaus ASN-DROP, all dead. This is a company that named its networks after their function โ bulk traffic, high-volume, high-peering โ and used them until the industry blocked them entirely. Then silence. The SRL remains registered. The damage is done.
๐ Exhibit B: NexonHost โ The Anatomy of a Bulletproof SRL
NexonHost Srl (AS62390) is the purest example of the Romanian SRL-to-bulletproof pipeline:
| Metric | Value |
|---|---|
| ASN Allocation | November 2, 2021 |
| IPs in Dataset | 13 (all Romanian) |
| Risk Score | 93.3 (CRITICAL) |
| Average Threat | 77.6 โ every IP rated critical or high |
| Abuse Confidence | 100% โ every single IP |
| Honeypot Sessions | 432 attempts, 0 successful logins |
| Bulletproof Assessment | TRUE โ flagged by automated analysis |
| RDAP Contact | ab@vpz.ro (TENNET-MNT) |
| Phone | +40 723 996 387 |
| HASSH Fingerprint | 100% libssh2_1.11.0 (same as M247 campaign) |
The RDAP registrant is particularly instructive. The abuse contact ab@vpz.ro maps to TENNET-MNT, a RIPE maintainer object. The phone number +40 723 996 387 appears in two formats across different NexonHost registrations. This is a single individual operating a bulletproof hosting network through a Romanian SRL.
But the subsidiary structure goes deeper. NexonHost's 13 IPs are registered to three different entities:
| Entity | Abuse Contact | IPs | Jurisdiction |
|---|---|---|---|
| TENNET-MNT / NexonHost | ab@vpz.ro | 10 | Romania |
| Internet Utilities Africa (PTY) LTD | accounts@ipxo.com | 2 | South Africa |
| Internet Utilities LATAM LTD | report@abuseradar.com | 1 | Latin America (UK reg) |
A Romanian SRL that leases IP space from a South African company and a UK-registered Latin American entity, all routing through the same ASN from Romania. The IPs came via IPXO โ a Lithuanian IP address marketplace where organizations can lease unused IP blocks. NexonHost didn't need to wait for RIPE allocation. It rented IP space on the open market and pointed it at bulletproof infrastructure.
๐ Exhibit C: Feo Prest SRL โ Born Yesterday, Already Dead
AS208137 (FPS12) tells the lifecycle in fast-forward:
| Event | Date | Time from Registration |
|---|---|---|
| ASN Allocated by RIPE NCC | August 5, 2025 | Day 0 |
| Spamhaus ASN-DROP listing | ~Late 2025 | ~3-4 months |
| Current status | Listed on ASN-DROP | ~10 months |
Contact: admin@feoprest.life โ note the TLD: .life. The RDAP organizations are listed as "DWCI NET" and "FeoPrest-MNT." Two IPs observed. One used PuTTY (manual access), one used libssh2_1.11.1 (automated scanning).
Allocated in August 2025. Spamhaus-listed by late 2025. The SRL still exists. Under Romanian law, a Spamhaus listing carries no regulatory consequence. The ASN is dead, but the corporate vehicle persists โ ready to be reused, transferred, or abandoned.
๐ Exhibit D: The Aokigahara Anomaly
AS215659 (MOEMOEKYUN), registered to Aokigahara SRL, allocated January 23, 2024. The name references the Aokigahara forest in Japan โ known as the "Suicide Forest." The ASN name is "MOEMOEKYUN" โ Japanese anime slang. The website: kyun.sh.
| Metric | Value |
|---|---|
| IPs in Dataset | 11 |
| Risk Score | 40.5 |
| Threat Class | LOW (avg 28.9, max 61.0) |
| RDAP Contact | report@abuseradar.com / abuse@kyun.sh |
| RDAP Organization | "Private Customer" / SIMPLIQ-MNT |
| Spamhaus | Not listed |
The abuse contact report@abuseradar.com is notable โ it's the same email that appears in NexonHost's IPXO-leased IP registrations. AbuseRadar is a service that acts as an intermediary for abuse complaints, adding another layer between the operator and the complainant.
A Romanian SRL named after a Japanese suicide forest, operating under an anime-slang ASN name, hosting on a .sh domain, using an abuse intermediary service, with RDAP entries listing the registrant as "Private Customer." Every layer is designed to slow down investigation. Not to prevent it โ just to make it take longer than the attention span of enforcement.
๐ Exhibit E: The RIPE NCC Pipeline
RIPE NCC (Rรฉseaux IP Europรฉens Network Coordination Centre) is the Regional Internet Registry for Europe, the Middle East, and parts of Central Asia. To receive an ASN and IP allocations, an organization must become a Local Internet Registry (LIR). The requirements:
| Requirement | Difficulty for an SRL |
|---|---|
| Legal entity in RIPE service region | โ SRL qualifies (1 RON to form) |
| Annual membership fee (~โฌ1,400) | โ Trivial cost for hosting operation |
| Justified need for resources | โ "We are starting a hosting company" |
| Technical contact with valid email | โ Any email address |
| Abuse contact | โ Can use intermediaries like AbuseRadar |
| Background check | โ Not performed |
| Verification of business activity | โ Not performed |
| Historical abuse record check | โ Not performed |
The process is designed for legitimate operators. But the verification gap means that a newly formed SRL, with โฌ0.20 in capital and no employees, can obtain globally routable IP space within weeks. When that IP space gets burned, the operator forms a new SRL and applies again.
Bunea TELECOM SRL did this three times. Three ASNs (35478, 42397, 62380), all eventually Spamhaus ASN-DROP. The same Romanian SRL, three separate LIR memberships, three separate IP allocations. Each burned. Each replaced. The RIPE NCC pipeline has no mechanism to connect the three applications to the same beneficial owner.
๐ Exhibit F: The Fingerprint Convergence
The most damning evidence that these SRLs are not independent operations is the HASSH fingerprint data:
| ASN | Entity | Primary HASSH | Tool | % of IPs |
|---|---|---|---|---|
| AS9009 | M247 / Servers Factory | 14b2ddda386a4d10 | libssh2_1.11.0 | 49% |
| AS62390 | NexonHost SRL | 14b2ddda386a4d10 | libssh2_1.11.0 | 100% |
| AS205275 | ROMARG SRL | f555226df1963d1d | libssh_0.9.6 | 50% |
| AS208137 | Feo Prest SRL | (varied) | libssh2_1.11.1 / PuTTY | 50% each |
M247's Servers Factory IPs and NexonHost's entire fleet share the identical HASSH fingerprint. They participate in the same 628-node global campaign. Same scanning tool, same SSH library version, same behavioral pattern โ deployed across legally separate Romanian SRLs.
If these were independent companies running independent hosting operations, the probability of 100% HASSH fingerprint overlap with a specific global scanning campaign would be approximately zero. These SRLs may be legally separate. Operationally, they are the same infrastructure wearing different corporate masks.
โ The Questions That Build the Case
The combination is unique in the EU: minimal capital requirements (1 RON), EU membership (critical for RIPE NCC access), relatively low enforcement capacity for hosting-related offenses, and an existing ecosystem of transit providers (M247) that peer at 60 IXPs globally. Romania offers the legal legitimacy of the EU with the regulatory enforcement of a country that prosecutes hackers, not hosters.
DIICOT (Direcศia de Investigare a Infracศiunilor de Criminalitate Organizatฤ ศi Terorism) investigates cybercrime โ when that crime is committed by Romanians targeting victims. Hosting infrastructure for foreign actors falls into a regulatory gap between DIICOT's mandate and ANCOM's (telecom regulator) capabilities.
Bunea TELECOM SRL registered AS35478 (DATACENTER), AS42397 (HIGH-VOLUME-NETWORK), and AS62380 (HIGH-PEER-NETWORK). All three are now on the Spamhaus ASN-DROP list. The RIPE NCC allows multiple ASN allocations to the same LIR. There is no mechanism that flags "this entity already had two ASNs blocked by Spamhaus" when the third application arrives.
After the ASN-DROP listing, the SRL's IP space becomes unroutable by most transit providers. But the SRL itself persists. Its beneficial owner can form a new SRL โ different name, same person โ and apply for LIR membership again. The cycle restarts.
NexonHost leases IP space through IPXO (Lithuania). Aokigahara SRL uses SIMPLIQ-MNT (another intermediary). Feo Prest SRL routes through DWCI NET. These aren't RIPE-allocated IPs โ they're marketplace IPs, leased from organizations that acquired them years ago when IPv4 space was plentiful.
The transfer market creates a second pipeline: even if RIPE NCC tightens allocation rules, SRLs can lease IP blocks from third parties and announce them under their ASN. The regulatory authority (RIPE NCC) monitors allocations, not leases. A bulletproof SRL that can't get new IP space from RIPE simply rents it from a broker in Lithuania.
Estonia offers similar ease of company formation (โฌ0.01 minimum capital, fully online registration). The Netherlands has BV formation at โฌ0.01. But Romania's combination of low formation cost, RIPE NCC region access, existing bulletproof transit infrastructure, and enforcement gaps creates a unique convergence.
The EU's freedom of establishment means a Romanian SRL has the same legal standing as a German GmbH. A Spamhaus listing has no effect on the SRL's legal status. RIPE NCC membership continues even when every IP is blocked. The corporate vehicle was designed for commerce. It's being used as ammunition.
โ๏ธ Assessment
Confidence: HIGH โ Direct evidence from RIPE NCC allocation records, Spamhaus ASN-DROP data, RDAP registrations, honeypot telemetry, HASSH fingerprint correlation, and IPXO marketplace records.
The Romanian SRL is the cheapest, fastest, and most consequence-free method of acquiring globally routable IP space in the European Union. Formation: โฌ0.20. LIR membership: โฌ1,400/year. Total investment to control an autonomous system: under โฌ2,000. When the ASN gets burned, the SRL has no assets to seize, no employees to arrest, no real capital to forfeit.
This is not about Romania being corrupt. Romania's company law is standard EU-aligned legislation. The problem is structural: the internet's routing system trusts legal entities, and legal entities are trivially cheap to manufacture. Romania happens to sit at the intersection where corporate simplicity meets transit availability meets enforcement gaps. If Romania tightened its SRL requirements tomorrow, the pipeline would shift to Estonia, Bulgaria, or the Netherlands within weeks.
The factory isn't Romanian. Romania is just where the factory is currently located.
๐ Cross-Investigation Links
- TI-2026-036A "The Romanian Corridor" โ Overview of all 8 Romanian ASNs and the corridor's structure
- TI-2026-036B "The M247 Empire" โ How M247's 5,000-prefix network provides transit for these SRLs
- TI-2026-035E "The Geography of Impunity" โ The jurisdictional arbitrage pattern that Romanian SRLs exploit
- TI-2026-036D "Hackerville to Hosting" (forthcoming) โ How Romania's hacker talent pipeline became its infrastructure advantage