How Russia’s “Media Land” Kept Routing After Sanctions
by Robin Dost
In light of drone attacks on German airports and the direct threats against our own country on Russian television, we should probably focus on other important issues besides malware.
Namely, money, sanctions and how they are being circumvented or avoided.
But also how organizations, individuals and service providers are responding to the sanctions.
This will be our first article of its kind, but there are several more prepared and in work.
So let’s shed some light on these situations 🙂
Key findings
After the 19 November 2025 US, UK and Australian sanctions against Russian bulletproof hoster Media Land, a dormant Montenegrin ASN, AS202799 (SYSECT D.O.O.), was brought back into use.
It received an additional maintainer on 20 November at 21:00 UTC, was added to Media Lands as-set on 21 November at 10:32 UTC and made its first observed BGP announcements on 25 November.
Public reporting treats SYSECT as Media Lands only European upstream and therefore as a pressure point.
RIPE Database records show that SYSECTs ASN lists Media Lands own contact handle and that Media Lands maintainer has created routing objects naming SYSECTs ASN as origin.
- Reactivation timed to the sanctions.
AS202799 sat unchanged from November 2022.
On 20 November 2025 at 21:00 UTC a new maintainer was attached; the next morning AS202799 was added to Media Lands as-set and 2 minutes 50 seconds later SYSECTs aut-num declared the matching import/export with AS206728. - Media Land identity on SYSECTs ASN.
Admin-c and tech-c of AS202799 is AV11916-RIPE, the same handle that is admin-c of Media Land LLCs own organisation object and was created together with Media Lands maintainer in 2019. - Media Lands maintainer declares SYSECT origins.
On 24 November 2025, mnt-ru-media-land-1 created route objects for 45.141.85.128/25 and 194.26.25.0/24 with origin AS202799. The /24 still carries RIPE NCCs EU sanctions remark as a Media Land resource. - Prefix hand-over and later abuse.
Two /24s previously visible under AS212165 (kvmka) moved to AS202799 in late November 2025.
Third-party research later documented Kimwolf C2 infrastructure in one and an Aisuru sample contacting the other. - A Latvian thread and renamed objects.
GOODTEC (SIA GOOD) announces a Media Land IPv6 /48 maintained by Media Lands maintainer and two ML Cloud organisation objects were renamed and handed to other maintainers after the sanctions. - Filter gap.
Spamhaus ASN-DROP lists AS206728 and AS215376 but not AS202799.
Media Lands own data
ML Clouds still-live storefront publishes a geofeed that lists seven of the nine prefixes AS202799 announces as ML Cloud locations.
One of them is placed in Ludwigsfelde, Germany, while latency measurements put its hosts in Saint Petersburg.
Botnet backends beyond SYSECT
Two Aisuru/Kimwolf proxy C2 addresses documented by Bitsight sit in /24s that ML Clouds geofeed claims as its Riga and Warsaw locations, routed via a Latvian and a Lithuanian company.
A second Balkan vehicle
AS198855, registered in April 2026 to an individual in Albania and sponsored by a St Petersburg LIR, declares only Media Lands two sanctioned ASNs as routing neighbours.
Its maintainer also runs a network that uses SYSECTs abuse contact and on 3 August 2026 it took over a prefix from SYSECT.
It routes the botnet C2 address from Finding 8 through a Lithuanian carrier.
A shared administrative layer
One maintainer, created six days after the sanctions, administers the organisation or abuse objects behind four SYSECT-announced prefixes, ML Clouds former Latvian organisation object and the address space the Latvian network originates.
Its abuse domain resolves, by DNS, to an address in SYSECT-routed space.
A Hong Kong company on the storefront.
ML Clouds website, the one OFAC lists in its SDN entry for ML.Cloud LLC, still names ML Cloud Limited in Hong Kong as contracting party and publishes an HSBC Hong Kong account in its name.
A register aggregator lists that company as dissolved in April 2026.
The storefront also claims an active site in a named data centre in Brandenburg, which the available measurements do not support.
The sanctioned company changed hands before the sanctions.
According to the US Department of Justice, ML.Cloud was owned by Yulia Pankova when the sealed indictment was returned in December 2024.
The Russian company register shows a new sole owner from 15 January 2025 and the same person as director from 5 February 2025.
That person does not appear on the OFAC SDN list, the EU consolidated sanctions list or the UK sanctions list (searched 29 September 2026).
The company’s own filings show a small business with no fixed assets.
Background
Media Land LLC, run by Aleksandr Volosovik (“Yalishanda”), is one of the longest-running Russian bulletproof hosting providers.
Its principal networks are AS206728 (MEDIALAND-AS) and AS215376 (ML Cloud).
| Date | Action |
|---|---|
| 14 Jul 2026 | US indictment against Volosovik, Zatolokin, Pankova, Media Land LLC and ML.Cloud LLC unsealed (N.D. Ohio) |
| 13 Jul 2026 | EU lists Media Land LLC, ML.Cloud and Volosovik under the cyber sanctions regime |
| 19 Nov 2025 | OFAC, UK and Australia sanction Media Land, its affiliates and four individuals |
RIPE NCC now marks AS206728, AS215376 and Media Land address blocks as held by an EU-sanctioned party and restricted from transfer.
Prior public reporting.
The Reno Projects Media Land profile (v2.2, stated as current to 27 July 2026) lists SYSECT D.O.O. as one of four upstream peers of AS206728.
It assesses SYSECT as “the only peer plausibly subject to European pressure” and it flags the name on the AV11916 handle as an unexploited lead attached to two Media Land prefixes.
BIRNs September 2026 investigation into disposable IP firms in Serbia and Montenegro mentions Media Land once, via ranges advertised by the kvmka operator and does not name SYSECT.
Neither source examines who administrates AS202799.
Finding 1: AS202799 woke up the day after the sanctions
AS202799 was created on 20 September 2022 and left untouched from 16 November 2022 until the evening of 20 November 2025.
All 40 versions of the aut-num, eight versions of Media Lands as-set and the maintainer history were retrieved directly from the RIPE Database.
| Time (UTC) | Change | RIPE evidence |
|---|---|---|
| 29 Nov 2025 08:40:49 | Direct AS206728 import/export lines removed again | aut-num v11 -> v12 |
| 27 Nov 2025 | AS20632 (MegaFon) and AS35000 (Severen-Telecom) added as upstreams | aut-num v8 -> v11 |
| 24 Nov 2025 15:13:24 | AS49531 (NetCom-R) added as upstream | aut-num v7 -> v8 |
| 24 Nov 2025 13:48:14 | Route 194.26.25.0/24, origin AS202799, created by mnt-ru-media-land-1 | route object |
| 24 Nov 2025 13:47:21 | Route 45.141.85.128/25, origin AS202799, created by mnt-ru-media-land-1 | route object |
| 21 Nov 2025 10:35:40 | AS202799 declares import from and export to AS206728 | aut-num v6 -> v7 |
| 21 Nov 2025 10:32:50 | AS202799 added to AS206728:AS-MEDIALANDTECHNOLOGY | as-set v7 -> v8 |
| 20 Nov 2025 21:00:38 | SYSTECH-MNT added as maintainer of AS202799 | aut-num v5 -> v6 |
| 20 Nov 2025 20:59:39 | Maintainer SYSTECH-MNT created | mntner v1 |
| 19 Nov 2025 | OFAC, UK and Australia sanction Media Land | Treasury sb0319 |
The two sides were configured 2 minutes 50 seconds apart: first Media Lands as-set accepted AS202799, then SYSECTs aut-num mirrored the relationship.
Three days later Media Lands own maintainer declared two Media Land blocks as originating from AS202799.
First BGP announcements by AS202799 appear in RIPEstat from 25 November 2025.
SYSTECH-MNTs role object is named only “Startup maintainer” and discloses no identity.
Finding 2: Media Lands handle and maintainer sit on SYSECTs objects
Four kinds of RIPE objects link SYSECT to Media Lands own administrative identity.
None depends on the shared LIR service provider both parties use.
They are contact references and objects maintained by Media Lands maintainer, which is different from write access to SYSECTs own objects.
The aut-num of AS202799 is maintained by RIPE-NCC-END-MNT, MNT-DGTL and SYSTECH-MNT, not by Media Land.
RIPE also does not require authorisation from the origin ASN to create a route object, so the route objects below show what Media Lands maintainer declared, not that it holds rights over AS202799.
That Media Land controls SYSECT remains an inference.
| Object | Link to Media Land |
|---|---|
| aut-num AS202799 | admin-c and tech-c = AV11916-RIPE |
| person AV11916-RIPE | created 13 Aug 2019 12:06:56, one second before mnt-ru-media-land-1; maintained by mnt-ru-media-land-1; admin-c of Media Land LLC (ORG-MLL13-RIPE) and of Media Land blocks 45.141.85.0/24 and 194.26.29.0/24 |
| as-set AS202799:AS-MDLD | created 5 Dec 2025, maintained by mnt-ru-media-land-1; members AS202799, AS203142, AS215376 (ML Cloud) and AS51538 |
| route 194.26.25.0/24 and 45.141.85.128/25 | origin AS202799, maintained by mnt-ru-media-land-1 |
An as-set named after SYSECTs ASN is maintained by Media Lands maintainer and includes the sanctioned ML Cloud ASN.
Its admin contact, LG10684-RIPE, is the same role that administers SYSECTs organisation object.
What the timing does not show.
Historical RIPE responses omit admin-c and tech-c. Todays record shows AV11916 on AS202799 and third-party mirrors show it by May 2026, but the exact date it was set cannot be proven from public history.
Shared service provider.
SYSECTs organisation and aut-num are also maintained by MNT-DGTL, the maintainer of a London-registered LIR service (“DGTL LIR GROUP“, operated by DGTL TECH UK LLP) that also maintains objects for unrelated networks.
UK Companies House lists two designated members of DGTL TECH UK LLP since its incorporation on 24 December 2020, both resident in Montenegro: Dmitry Shcherbakov and Alexander Shadrin (Companies House, OC434843).
SYSECTs registered owner and director, below, has the same name and country of residence and in 2022 SYSECTs organisation object listed the London phone number used by the DGTL service.
Registry data therefore indicate a closer tie than a customer relationship.
The person registered as SYSECTs owner is likely also a member of the LLP that maintains its RIPE objects.
The identity match rests on name, residence and these registry links.
No document with a date of birth from the Montenegrin register was obtained.
Neither person is named in the US, UK or EU designations of Media Land and nothing here suggests that either knew of the activity described in this article.
SYSECT D.O.O. is registered in Herceg Novi, Montenegro (reg. no. 03420388).
According to the register data shown by a commercial aggregator, Dmitry Shcherbakov has been its sole owner (100 percent) and executive director since its incorporation on 29 March 2022.
A commercial registry aggregator lists its activity as a travel agency (NACE 7911) with EUR 1,700 revenue in 2025 and negative equity and its registered address and contact e-mail belong to a local bookkeeping agency that also advertises help with residence permits for foreigners.
The mismatch with operating a transit ASN is notable but not proof of a front company.
Small Montenegrin companies are also set up to support residence status and an ASN may have been attached to an existing company for convenience.
An official CRPS extract has not been obtained.
Finding 3: What AS202799 announces
AS202799 currently originates nine IPv4 prefixes and acts as IPv4 upstream of AS206728.
Its address space combines Media Land blocks, prefixes that moved over from the kvmka network and leased /24s from small Russian holders with valid RPKI ROAs for AS202799.
| Prefix | Current holder / note | Via AS202799 (RIPEstat) |
|---|---|---|
| 194.26.25.0/24 | Media Land block, carries RIPE NCC sanctions remark; netname RU-MEDIA-LAND-20191120 | since 25 Nov 2025 |
| 91.220.163.0/24 | Media Land; on Spamhaus DROP (SBL690067). Historical, no longer announced by AS202799 | 25 Nov to 5 Dec 2025 |
| 212.193.31.0/24 | leased (baza-llc-spb); previously under AS212165 | since 29 Nov 2025 |
| 147.45.44.0/24 | leased (Green Dom LLC); previously under AS212165 | since 1 Dec 2025 |
| 89.19.220.0/24 | leased (IP-PARK-KAZAN) | since 4 Dec 2025 |
| 89.19.222.0/24 | leased (Kalmykia-NET); geofeed on servercheap.ru | since 29 Jan 2026 |
| 89.19.223.0/24 | leased (baza-llc-spb) | since 13 Feb 2026 |
| 89.19.221.0/24 | leased. Historical, no longer announced by AS202799 | 4 Dec 2025 to 1 Apr 2026 |
| 176.98.182.0/24 | leased (org maintained by green-dom-llc-mnt). Historical, moved to AS198855 (Finding 9) | 23 Dec 2025 to 3 Aug 2026 |
| 72.56.54.0/24 | GOODTEC client lease; route origin AS202799 | since 17 Apr 2026 |
| 109.237.98.0/23 | leased (Interlan Communications) | since 7 May 2026 |
| 78.17.25.0/24 | leased (RCS Technologies FZE) | since 11 Sep 2026 |
The route object for 45.141.85.128/25 has not been seen as a separate BGP announcement in RIPEstats default view, the covering /24 remains announced by AS206728.
Hand-over from the kvmka network
Two /24s changed origin from AS212165 (kvmka, ORG-AGL35-RIPE) to AS202799 in the same week:
| Prefix | Last seen under AS212165 | First seen under AS202799 |
|---|---|---|
| 212.193.31.0/24 | 29 Nov 2025 | 29 Nov 2025 (overlap) |
| 147.45.44.0/24 | 29 Nov 2025 | 1 Dec 2025 |
These are RIPEstat windows with eight-hour granularity, not exact BGP update times.
AS212165 has been a member of Media Lands as-set since 24 January 2024.
BIRN has reported that the operator of kvmka advertises ranges previously held by Media Land.
Routing data alone does not identify who instructed these origin changes.
Finding 4: A Latvian thread and renamed ML Cloud objects
A second European network, GOODTEC (SIA GOOD, Riga, reg. no. 43603067005), is tied to Media Lands address space by both registry and routing data and the tie predates SYSECTs reactivation.
- 2a0b:88c0:48::/48 (NET6-RIGA) is part of Media Lands allocation 2a0b:88c0::/29, which now carries RIPE NCCs sanctions remark. Its route6 object names origin AS39900 (SIA GOOD) and was created by mnt-ru-media-land-1 on 22 August 2025. RIPEstat shows AS39900 announcing exactly this /48 from late October 2025 to today.
- AS203142 (SIA GOOD) was assigned on 5 December 2025, the day Media Lands maintainer created AS202799:AS-MDLD with AS203142 as a member.
- 72.56.54.0/24 and 72.56.55.0/24 are both CLIENT-LEASE objects maintained by GOODTEC-MNT with a goodtec.lv geofeed. Their route objects name AS202799 and AS203142 respectively.
GOODTEC publicly advertises ASN rental (EUR 100/month), /24 rental (EUR 150/month) and /24 announcement (EUR 50/month).
A commercial leasing relationship is therefore a plausible explanation and nothing here shows GOODTEC knew of criminal use.
SIA GOOD was asked about any customer relationship with Media Land or ML.Cloud, its sanctions screening and its awareness of the botnet reporting discussed in Finding 8.
No response was received by the requested deadline of 30 September 2026, 18:00 CEST.
The full questions and response status are reproduced below.
Renamed organisation objects
Two ML Cloud organisation objects were renamed and handed to other maintainers after the sanctions:
| Object | Before | After |
|---|---|---|
| ORG-MA2343-RIPE (LV) | ml-cloud-llc-lv, Media Land maintainer | 16 Dec 2025, within 2 min 10 s: renamed Riga-Riga-LV, maintainer and abuse contact switched to green-dom-llc-mnt / freedom-network.ru |
| ORG-MCL145-RIPE (NL) | ML CLOUD LLC (NL), Media Land maintainer | 29 Nov 2025 renamed F-O-F-NET 19 Jun 2026 renamed to an individuals name, country RU, new maintainer |
ORG-MA2343-RIPE is referenced by the NET6-RIGA /48 above.
A stable RIPE handle does not prove the same legal person sits behind it.
Transfer, reuse or management on someones behalf are all possible.
The new names are not treated as attribution.
The organisations new maintainer also administers several SYSECT-announced prefixes and the Latvian networks address space; see Finding 11.
Finding 5: Malicious activity in SYSECT-routed space
Published third-party research places malware infrastructure in two SYSECT-routed prefixes during the period AS202799 announced them. These observations belong to the prefixes users.
They do not show that SYSECT or Media Land operated the malware.
| Prefix | Observation | Period | Source |
|---|---|---|---|
| 212.193.31.0/24 | Kimwolf v7 C2 endpoints (.119, .122, .92, .158); a shared SSH host key found on 22 addresses in the /24 | 18 Dec 2025 to 3 Feb 2026 | Unit 42 |
| 147.45.44.0/24 | Sandbox sample with Aisuru YARA match contacting 147.45.44.34:8001 | 20 Jun 2026 | Joe Sandbox 1931383 |
| 89.19.220.0/24 | 89.19.220.70:4443 listed as Sliver C2, 75% confidence (ThreatFox IOC 1902083, via rule mirror) | first seen 6 Sep 2026 | ThreatFox |
The Kimwolf host-key correlation is Unit 42’s work, no scanning was performed for this article.
The Aisuru label is a sandbox detection and has not been independently verified.
Sliver can also be used in authorised testing.
Earlier malware activity in 147.45.44.0/24 (a Lumma loader in July 2024) predates SYSECTs announcements and is not attributed to this period.
Finding 6: ASN-based blocking misses AS202799
Spamhaus ASN-DROP (retrieved 26 September 2026) lists AS206728 and AS215376 but not AS202799.
None of SYSECTs nine current IPv4 prefixes appears in Spamhaus IPv4-DROP.
Only 91.220.163.0/24, announced by SYSECT for ten days in 2025, is listed.
A defender filtering on Media Lands two known ASNs therefore does not catch Media Land blocks or Media Land-transited traffic originated by AS202799.
Just an observation about filter coverage, Spamhaus is still great 🙂
Finding 7: Media Lands own geofeed claims SYSECTs address space
ML Clouds public storefront, ml.cloud (Russian-language footer “© 2015 – 2026 ООО «МЛ Клауд»”), was live on 26 September 2026 despite the companys EU listing in July.
It sells VPS, dedicated and GPU servers and an “IP announcement” service, setting up and maintaining BGP sessions for customer IPv4 and IPv6 networks.
The site advertises ten data centre locations, including Riga, Amsterdam, Warsaw and Ludwigsfelde in Germany.
The geofeed referenced from the Media Land-maintained object NET6-RIGA, ml.cloud/prefix-geo.csv, lists seven of the nine IPv4 prefixes AS202799 currently announces as ML Cloud locations:
| Prefix | ML Cloud geofeed location | Via AS202799 since |
|---|---|---|
| 78.17.25.0/24 | Ludwigsfelde, DE | 11 Sep 2026 |
| 109.237.98.0/23 | Moscow | 7 May 2026 |
| 89.19.223.0/24 | Saint Petersburg | Feb 2026 |
| 89.19.220.0/24 | Kazan | Dec 2025 |
| 147.45.44.0/24 | Moscow | 1 Dec 2025 |
| 212.193.31.0/24 | Saint Petersburg | 29 Nov 2025 |
| 194.26.25.0/24 | Moscow | 25 Nov 2025 |
The same file also lists 45.141.85.128/25 (the route object with origin AS202799), 89.19.221.0/24, 176.98.182.0/24 and 72.56.52.0/24 and 72.56.53.0/24 next to the GOODTEC blocks.
A sanctioned company thus publishes, in its own machine-readable data, that the address space SYSECT announces belongs to its service.
The German location does not seem to hold up
The geofeed places 78.17.25.0/24 in Ludwigsfelde, Brandenburg.
IPinfo ProbeNet measured 78.17.25.6 at 0.85 ms from Saint Petersburg and a traceroute on 17 September 2026 reached 78.17.25.2 in 1.16 ms from the same city (IPinfo).
Ludwigsfelde is about 1,300 km from Saint Petersburg, which requires roughly 13 ms round-trip at minimum over optical fibre (signal speed about 200,000 km/s).
The measured hosts sit in or near Saint Petersburg, this does not exclude equipment elsewhere.
Geolocation databases nevertheless show Germany for parts of the range, for example Frankfurt for 78.17.25.3.
The /24 is held by RCS Technologies FZE LLC (UAE, allocated 17 March 2026).
Its route object for origin AS202799 was created on 10 September 2026 by interlir-mnt, the maintainer of an IP leasing broker (bgp.tools).
A single IPinfo traceroute from Warsaw to the geofeeds “Warsaw” range 91.108.249.0/24 (origin AS198855) reached it in 18 ms via AS28917 (Fiord Networks UAB), this is indicative only.
The storefront names a German facility.
On its data centre map, ml.cloud lists Ludwigsfelde as “Vantage (BER1), Brandenburg Park, Uferring 5, 14974 Ludwigsfelde, Germany”, status “active”, “put into operation in 2022”.
This one goes beyond a geofeed entry: the EU-listed company publicly claims an active site in a German colocation facility.
The measurements above do not support it for the only prefix ML Cloud places in Ludwigsfelde and none of the Media Land ASNs or AS202799 has a facility entry in PeeringDB.
Whether ML Cloud has any equipment at that site cannot be determined from public data.
The facility operator is not suggested to be aware of or involved in anything described here.
Vantage Data Centers was asked whether ML.Cloud, Media Land or a company acting for them was a customer at BER1, directly or through a reseller and whether it was aware of ML.Cloud using the facility name in its marketing.
No response was received by the requested deadline of 30 September 2026, 18:00 CEST.
The claimed presence at BER1 therefore remains unconfirmed.
See the full questions and response status below.
Interpretation
Publishing EU locations for Russian-hosted address space lets customers present Russian infrastructure as European to geolocation-based filters.
For Ludwigsfelde the storefront names a specific facility, but no measurement or registry record found for this article places ML Cloud infrastructure there.
The EU relevance lies in the address brokers, holders and transit networks involved.
Finding 8: Botnet infrastructure in ML Cloud-declared networks outside SYSECT
Two IP addresses that Bitsight TRACE documented as Aisuru/Kimwolf proxy infrastructure in August 2026 sit in /24s that ML Clouds geofeed lists as its own Riga and Warsaw locations.
Neither network is announced by AS202799 and both are routed by companies registered in the EU.
| IP | Role per Bitsight | Observed | ML Cloud geofeed | Origin / upstream |
|---|---|---|---|---|
| 72.56.52.158 | ADB exploitation payload host (port 8002) and proxybot C2 in the operators’ ENS record | 29 to 30 Jun 2026 (Aisuru), 7 Jul 2026 (Kimwolf), ENS record reported 18 Aug 2026 | 72.56.52.0/24, Riga | AS39900, SIA GOOD (Latvia) |
| 91.108.249.19 | Proxybot C2 in the operators’ ENS record | reported 18 Aug 2026 | 91.108.249.0/24, Warsaw | AS198855; sole upstream AS28917, Fiord Networks UAB (Lithuania) |
Routing at the time
RIPEstat shows AS39900 as the only origin of 72.56.52.0/24 continuously from 13 January 2026 to 26 September 2026, which covers Bitsights June and July observations (RIPEstat). 91.108.249.0/24 is registered to KVANTA LLC (PL, created 17 April 2026) with a route object for AS198855 by interlir-mnt (bgp.tools). RIPEstat shows AS198855 as its only origin from 21 April to 26 September 2026 (see Finding 9).
What is new
Bitsight published the IPs but does not connect them to Media Land or ML Cloud.
The link comes from ML Clouds own geofeed.
It shows that botnet backend infrastructure sat in address space the sanctioned company describes as its own and that SIA GOOD originated that space before and after the EU listing of 13 July 2026.
The geofeed was retrieved in September 2026.
Without an archived version it documents ML Clouds claim at that time, not necessarily during the June and July observations.
Limits
Presence in a hosting providers address space does not show that the provider knew of or operated the botnet; ML Cloud sells VPS to anyone.
91.108.249.0/24 also hosts many unrelated VPN, casino and panel domains, consistent with a public VPS range.
A geofeed entry is ML Clouds claim and not proof of a contract between ML Cloud and SIA GOOD, KVANTA or Fiord Networks.
Latency data places the “Warsaw” range behind a Lithuanian-registered carrier with Russian roots at 18 ms from Warsaw, its physical location is unresolved.
Finding 9: A second Balkan ASN declares only Media Land as neighbours
AS198855 was assigned on 16 April 2026 to an organisation object in the name of an individual in Durrës, Albania (ORG-PG326-RIPE, created 13 April 2026).
Its aut-num declares exactly two routing neighbours: AS206728 (Media Land LLC) and AS211805 (MediaLandLLC-RU).
Both carry RIPE NCCs EU sanctions remark.
The sponsoring LIR is KVANTA LLC (ORG-KL395-RIPE), St Petersburg, an LIR since 4 January 2026.
| Object | Link to Media Land or SYSECT |
|---|---|
| aut-num AS198855 | import from and export to AS206728 and AS211805 only; created 16 Apr 2026 09:06:06 |
| organisation KVANTA LLC (RU, sponsoring LIR) | mnt-ref includes the maintainer that took over ML Clouds Dutch organisation object ORG-MCL145-RIPE on 19 Jun 2026 (Finding 4) |
| AS198855’s maintainer (created 13 Apr 2026) | also maintains Kubit DC (ORG-KD127-RIPE, Rostov-on-Don) and KVANTA LLC (ORG-KL398-RIPE, PL), registered holder of 91.108.249.0/24 |
| Kubit DC | abuse-c ACRO62605-RIPE (abuse@servercheap.ru), the abuse role SYSECTs ASN and organisation use |
| 176.98.182.0/24 | via AS202799 from late Dec 2025 to 3 Aug 2026 15:59; via AS198855 from 3 Aug 2026 16:00 (RIPEstat 8-hour windows). Route objects for both origins by the same maintainer; the AS198855 object was created 31 Jul 2026 |
Routing in practice
bgp.tools sees a single upstream for AS198855: AS28917, Fiord Networks UAB (Vilnius, Lithuania).
Media Land does not appear as an observed neighbour.
Tthe declared policy and the real path differ.
AS198855 announces 91.108.249.0/24 and 176.98.182.0/24, which ML Clouds geofeed lists as Warsaw and Amsterdam.
RIPEstat shows AS198855 as the only origin of 91.108.249.0/24 from 21 April to 26 September 2026, so Bitsights C2 address 91.108.249.19 (Finding 8) was routed by AS198855 when it was reported.
Fiord Networks was asked whether and since when it provided transit to AS198855, whether its customer screening considered the declared routing policy or links to Media Land and whether it knew of the botnet reporting concerning 91.108.249.0/24. No response was received by the requested deadline of 30 September 2026, 18:00 CEST.
See the full questions and response status below.
Why it matters
The pattern repeats:
An ASN registered in a Western Balkan country, administered from Russia, named in its own routing policy as Media Lands neighbour, taking over address space from the previous vehicle.
AS198855 went live three months before the EU listing and carried a SYSECT prefix after it.
Limits
Registry names may belong to nominees or be false and the objects do not identify who pays for or controls AS198855.
A shared abuse role and shared maintainers show common administration and not ownership.
The Media Land link rests on the declared policy, ML Clouds geofeed, the hand-over of 176.98.182.0/24 from SYSECT and the shared abuse contact.
As of 26 September 2026, neither the Reno Project profile, BIRN, Bitsight nor a web search mentions AS198855, KVANTA or Kubit DC in connection with Media Land.
Finding 10: KVANTA’s second ASN and an earlier Latvian takeover
AS201097 (kvanta-llc). Created 13 February 2026 by the same Russian LIR.
Its aut-num declares AS49531 (NetCom-R) and AS31500 as upstreams, the same two networks named in SYSECTs policy, bgp.tools observes AS28917, AS35000 and AS51200.
It originates two more prefixes from ML Clouds geofeed:
| Prefix | ML Cloud geofeed | Origin history (RIPEstat) | Registry |
|---|---|---|---|
| 132.243.199.0/24 | Krasnodar | AS57043 (HOSTKEY) Apr to 23 Jun 2026; AS201097 from 24 Jun 2026 | inetnum KVANTA / “Ubilink DC” and route object, both by interlir-mnt on 24 Jun 2026 |
| 78.153.136.0/24 | Rostov-on-Don | AS210644 (AEZA-AS) until early Feb 2026; AS201097 from 19 to 21 Apr 2026 | Kubit DC, Rostov-on-Don |
The gap of about ten weeks on 78.153.136.0/24 means no direct hand-over from Aeza is implied.
193.124.254.0/24 moved from Media Land to SIA GOOD in June 2025
The block is held by Reliable Communications s.r.o. (CZ) with interlir-mnt as mnt-lower. AS206728 originated it from 18 September 2024 until about 12 June 2025.
On 16 June 2025 at 15:29:43 interlir-mnt created a route object for AS39900 (SIA GOOD) and AS39900 has originated it from 17 June 2025 to 26 September 2026.
ML Clouds geofeed lists it as Riga. This dates the GOODTEC thread to five months before the November 2025 sanctions, two months before the NET6-RIGA route6 object.
Its two /25 sub-assignments are registered to ORG-MA2343-RIPE, ML Clouds former Latvian organisation object (Finding 11).
109.120.136.0/24.
Originated by AS206728 until August 2025 and by AS215376 (ML Cloud) from September 2025 to early April 2026, with no visible origin since.
Its inetnum has been co-maintained since 21 July 2026 by the maintainer that took over ORG-MCL145-RIPE.
Negative checks.
interlir-mnt, an IP leasing broker used by many unrelated networks, appears on 78.17.25.0/24, 91.108.249.0/24, 132.243.199.0/24 and 193.124.254.0/24.
That is treated as a shared broker, not common control.
Bitsights published Aisuru IOC repository holds only hashes and dead-drop domains, no IPs.
The other proxy C2 addresses in Bitsights report (87.121.79.9, 83.243.86.127, 89.36.161.192, 212.192.12.168, 89.125.138.217) are not in ML Clouds geofeed or in any ASN named here.
Finding 11: One maintainer behind SYSECT leases and ML Clouds Latvian object
The abuse address on 147.45.44.0/24, abuse@freedom-network.ru, leads to a further maintainer. green-dom-llc-mnt, the organisation Green Dom LLC and the abuse role ACRO62545-RIPE were all created on 25 November 2025 between 16:48:30 and 16:52:56 UTC.
RIPEstat shows AS202799’s first announcements on the same day.
| Object maintained by green-dom-llc-mnt | Connection |
|---|---|
| ORG-GDL5-RIPE, Green Dom LLC | Holder organisation of 147.45.44.0/24, announced by AS202799 (Aisuru sample, Finding 5) |
| ORG-KA1137-RIPE, Kalmykia-NET | Organisation of 89.19.222.0/24, announced by AS202799 (geofeed on servercheap.ru). Organisation created 28 Jan 2026 14:41; route object for AS202799 created 16:11 the same day |
| ORG-AK282-RIPE | Organisation of 176.98.182.0/24, created 23 Dec 2025 11:35. AS202799 starts announcing the block the same day; since 3 Aug 2026 it runs via AS198855 (Finding 9) |
| inetnum 109.237.98.0/23 | abuse-c ACRO62545-RIPE; announced by AS202799 |
| ORG-MA2343-RIPE (formerly ml-cloud-llc-lv) | Taken over on 16 Dec 2025 (Finding 4) |
| inetnums 193.124.254.0/25 (RIGA-LV) and 193.124.254.128/25 (RIGA-RIGA-LV) | Assigned to ORG-MA2343-RIPE, co-maintained with Renets-mnt. The .128/25 was last modified on 16 Dec 2025 at 12:44:37, under three minutes after the organisations rename. The covering /24 is originated by AS39900, SIA GOOD (Finding 10) |
The abuse domain points into SYSECT space
On 27 September 2026, freedom-network.ru resolved to 212.193.31.74 and a wildcard record resolves every subdomain to the same address. The zone, served by reg.ru, has no MX or TXT record, so under RFC 5321 mail to abuse@freedom-network.ru is directed to that A record.
212.193.31.74 lies in 212.193.31.0/24, announced by AS202799, the /24 in which Unit 42 documented Kimwolf C2 infrastructure.
IPinfo places the address in Saint Petersburg (0.925 ms) with holder baza-llc-spb and abuse contact servercheap.ru.
Abuse reports about Green Dom-administered blocks are therefore addressed to a host in SYSECT-routed space, whether a mail server accepts them there was not tested.
Why it matters.
Green Dom connects registry objects this article otherwise treats as separate threads: leased SYSECT prefixes, ML Clouds former Latvian organisation, the address space SIA GOOD originates and, through 176.98.182.0/24, AS198855.
For two SYSECT prefixes the organisation object and the first announcement fall on the same day.
193.124.254.0/24 is now tied to ML Cloud by registry data as well as by routing history and the geofeed.
Limits.
Renets-mnt appears on many of these objects but also maintains hundreds of unrelated networks, including Timeweb ranges and is treated as a service provider.
A shared maintainer only shows us common administration.
The abuse contacts on these resources are either freemail addresses (ACRO62903-RIPE on 176.98.182.0/24, ACRO64224-RIPE on AS198855) or domains hosted in SYSECT-routed space.
None sits on infrastructure of the registered holders themselves.
Such addresses often carry invented or unrelated names, so they are not used to identify anyone.
Person objects under green-dom-llc-mnt name individuals, they are not published here.
212.193.31.74 is not among the addresses Unit 42 named and no link to the Kimwolf host-key cluster is claimed.
The DNS data reflects 27 September 2026.
A web search found no public mention of freedom-network.ru or green-dom-llc-mnt in connection with Media Land.
Finding 12: A Hong Kong company on the storefront
ML Clouds storefront does not name the sanctioned Russian company as the party customers contract with or pay.
It names a Hong Kong company. The storefront is the same website OFAC lists in the SDN entry for ML.Cloud LLC.
| Item | As published or registered |
|---|---|
| Contract party | “ML Cloud Limited provides its services based on a public offer” (documents page) |
| Terms of Service | ML Cloud Limited, 15F Radio City, 505 Hennessy Road, Causeway Bay; Hong Kong law and courts; last updated 1 November 2022 (PDF) |
| Payment details | HSBC Hong Kong (bank code 004), beneficiary ML Cloud Limited, multi-currency account 582-XXXXXX-761; address Suite 1802, Lippo Centre Tower One, 89 Queensway (contacts page) |
| Footer | English pages: “© 2014 – 2026 ML Cloud LLC. Company №3234023”. Russian pages: “© 2015 – 2026 ООО «МЛ Клауд»”, the sanctioned Russian company |
| Hong Kong register | ML Cloud Limited, CR No. 3234023, incorporated 17 February 2023 (Companies Registry, new incorporations 13 to 19 Feb 2023). The register aggregator 86HC (retrieved 27 Sep 2026) lists BRN 74863989 and dissolution by Gazette notice on 17 April 2026; not confirmed against the official register |
| OFAC SDN entry | ML.CLOUD, LLC, website ml.cloud, established 27 January 2022, Russian tax ID 7810938831 (OFAC, 19 Nov 2025); no Hong Kong entity listed |
Timeline
Archived copies show the HSBC details on the contacts page before the November 2025 sanctions. They stayed through the US, UK and Australian designations, past the April 2026 date on which the Hong Kong company is listed as dissolved and through the EU listing in July 2026.
On 27 September 2026 the page still showed them.
What it shows
The published contracting and billing details for the sanctioned service name a Hong Kong company instead of the Russian entities named in the designations.
However, it does not tell us how payment screening would treat such payments and no payments are documented here.
Limits
If the Hong Kong company was dissolved, its bank account is unlikely to remain in normal use and nothing here shows that payments were made to it after the sanctions. The page may simply be out of date, or payments may now go elsewhere. Ownership of ML Cloud Limited is not public in the sources used.
Whether ML.Cloud LLC or other blocked persons own 50 percent or more of it, the test under OFACs 50 percent rule, or whether it is owned or controlled within the meaning of EU guidance, is not established.
The dissolution date comes from the register aggregator 86HC and has not been confirmed against the Companies Registry or the Gazette. The Terms of Service are dated 1 November 2022, before the companys incorporation.
Tthe reason is unknown and the full account number is withheld.
Finding 13: ML.Cloud changed owner six weeks after the sealed indictment
The Russian company behind ML.Cloud is ML Cloud LLC (ООО <<МЛ КЛАУД>>), OGRN 1227800008182, tax ID 7810938831, incorporated on 27 January 2022 in Saint Petersburg.
These are the identifiers OFAC lists for ML.CLOUD, LLC.
Its registered address, Tsvetochnaya ul. 16, Litera P, room 28.2, has not changed since incorporation, an entry dated 14 February 2025 only records a renaming of the address object.
| Date | Event | Source |
|---|---|---|
| December 2024 | A US grand jury returns the indictment (sealed). ML.Cloud is described as “at the time of investigation and indictment, owned by Pankova” | US DOJ, 14 Jul 2026 |
| 15 January 2025 | New sole participant (100 percent) of ML Cloud LLC entered in the register: Nikolay L. Popov | EGRUL record 2257800734563 |
| 5 February 2025 | The same person is entered as general director | EGRUL record 2257803042033 |
| 19 November 2025 | OFAC, UK and Australia sanction ML.Cloud LLC and Pankova | Treasury sb0319 |
| 13 July 2026 | EU lists ML.Cloud | Council of the EU |
| 14 July 2026 | Indictment unsealed | US DOJ |
| 27 September 2026 | ML Cloud LLC still active in the register, same owner and director | EGRUL extract of this date |
A small company on paper. Annual accounts filed with the Russian tax service describe a small business without fixed assets:
| RUB | 2022 | 2023 | 2024 |
|---|---|---|---|
| Revenue (line 2110) | n/a | 15.4 m | 10.1 m |
| Net result (2400) | n/a | −1.26 m | +1.09 m |
| Total assets (1600) | 1.70 m | 4.64 m | 5.33 m |
| Equity (1300) | 1.54 m | 0.29 m | 1.37 m |
| Fixed assets (1150) | none | none | none |
Revenue of RUB 10.1 million in 2024 is roughly EUR 110,000.
The company reports no fixed assets on its balance sheet.
This fits the picture from the other findings: customer contracts and payment details on the storefront point to a Hong Kong company (Finding 12) and the network runs on leased prefixes and third-party ASNs.
What it shows
The person the DOJ names as ML.Clouds owner at the time of the indictment left the company within weeks of the sealed indictment, before any sanctions and the company passed to a person who is not listed.
The designated entity itself remains blocked: OFAC lists ML.CLOUD, LLC with its registration and tax numbers, which does not depend on who owns it.
Limits
Nothing here shows that anyone knew of the sealed indictment, the change may have other reasons.
The register does not show whether the new owner acts independently or on someones behalf and no such claim is made.
The new owner is named only in his registered role.
The EGRUL extract shows the current state and the dates of changes, not the names of previous owners, the prior owner comes from the DOJ statement.
The accounts are the companys own filings as published by the tax service.
Sources
EGRUL extract No. ЮЭ9965-26-194496875 of 27 September 2026, signed by the Federal Tax Service (egrul.nalog.ru, search by OGRN 1227800008182).
Annual accounts 2024 with prior-year figures, export of 27 September 2026 (bo.nalog.gov.ru, search by tax ID 7810938831).
DOJ press release of 14 July 2026 (justice.gov).
OFAC SDN entry (OFAC, 19 Nov 2025).
What it shows and what it does not
The record supports one core statement:
Immediately after the sanctions, AS202799 was brought under an additional maintainer, integrated into Media Lands routing declarations by Media Lands own maintainer and used to announce Media Land address space and prefixes previously visible under a network in Media Lands as-set.
The record does not establish:
- that Media Land owns or controls SYSECT D.O.O. as a company;
- who personally edited the objects (RIPE SSO identities are not public);
- that SYSECT, GOODTEC or the LIR service provider knew of criminal use;
- that the renamed organisation objects reflect economic transfers;
- that any specific sanctions prohibition was breached.
Alternative explanations to test.
SYSECT could be a commercially rented ASN managed by a third party on Media Lands behalf.
Media Lands maintainer could hold delegated rights on SYSECT objects as part of a transit arrangement.
GOODTECs public rental offers make a leasing relationship plausible for the Latvian thread.
A correction to earlier interpretations.
The import/export lines of AS202799 were removed on 24 September 2026, but the same lines were removed and restored repeatedly since April 2026, including four cycles within one minute on 25 May.
This pattern is consistent with concurrent edits or administrative resets and should not be read as evidence clean-up.
Implications and recommendations
The peer that public analysis treats as Media Lands European pressure point lists Media Lands own contact handle as admin-c and tech-c and Media Lands maintainer has created route objects and an as-set naming it.
SYSECT is also an observed upstream of AS206728, so pressure on SYSECT affects Media Lands routing and blocking by ASN needs to include AS202799.
- Defenders:
Add AS202799, AS198855 and AS201097 alongside AS206728 and AS215376 to BPH watchlists.
Track new origins of 194.26.25.0/24 and 45.141.85.128/25.
Monitor members of AS202799:AS-MDLD and AS206728:AS-MEDIALANDTECHNOLOGY for new additions. - RIPE NCC:
Review how mnt-ru-media-land-1, a maintainer of a sanctioned holder, creates and maintains route objects and an as-set referencing a third-party ASN and whether sanctioned resources such as 194.26.25.0/24 may be declared under another origin. - Upstreams and IXPs:
AS202799’s current upstreams (AS49531, AS35000, AS31500) and its IXP presence are the practical levers.
European peers should assess AS202799 and AS198855 against their sanctions screening.
AS198855’s only observed upstream is Fiord Networks UAB in Lithuania. - Blocklist operators:
Evaluate AS202799 for ASN-DROP nomination on the basis of the registry evidence. - Authorities:
The EU-listed status of Media Land and the Montenegrin registration of SYSECT raise questions for competent authorities.
Legal assessment must tie specific resources to contracting parties, beneficiaries and dates.
Evidence table
| # | Claim | Rating | Basis |
|---|---|---|---|
| 1 | AS202799 dormant Nov 2022 to 20 Nov 2025, maintainer added 20 Nov 2025 21:00:38 | Verified | RIPE aut-num versions |
| 2 | AS202799 added to Media Lands as-set 21 Nov 2025 10:32:50, mirrored 10:35:40 | Verified | as-set and aut-num versions |
| 3 | admin-c/tech-c of AS202799 = AV11916, Media Land LLCs contact handle | Verified (current state) | RIPE aut-num, person, organisation |
| 4 | AV11916 set at reactivation | Timing unknown | present by May 2026 in mirrors; exact date not provable |
| 5 | Route objects for two Media Land blocks with origin AS202799, by Media Lands maintainer | Verified | RIPE route objects |
| 6 | AS202799:AS-MDLD controlled by Media Lands maintainer, includes ML Cloud ASN | Verified | RIPE as-set |
| 7 | 212.193.31.0/24 and 147.45.44.0/24 moved from AS212165 to AS202799 | Verified (8-hour windows) | RIPEstat routing history |
| 8 | Kimwolf C2 in 212.193.31.0/24 during SYSECT routing | Verified (third party) | Unit 42 |
| 9 | Aisuru sample contacting 147.45.44.34 | Likely (sandbox detection) | Joe Sandbox |
| 10 | GOODTEC /48 from Media Land allocation, route6 by Media Land maintainer | Verified | RIPE route6, RIPEstat |
| 11 | ML Cloud org objects renamed after sanctions | Verified | RIPE organisation versions |
| 12 | AS202799 absent from ASN-DROP | Verified (26 Sep 2026) | Spamhaus files |
| 13 | SYSECT is a front company | Hypothesis | registry mismatch only; address and contact belong to a bookkeeping agency offering residence-permit support, which allows other explanations |
| 14 | Media Land controls SYSECT | Hypothesis, strongly supported administratively | claims 1 to 6 |
| 15 | ML Clouds geofeed lists 7 of 9 SYSECT-announced IPv4 prefixes as ML Cloud locations | Verified (26 Sep 2026) | ml.cloud/prefix-geo.csv |
| 16 | The measured hosts in 78.17.25.0/24 (78.17.25.2 and 78.17.25.6) are physically near Saint Petersburg despite a Ludwigsfelde geofeed entry; the rest of the /24 was not measured | Likely (third-party latency data) | IPinfo ProbeNet ping and traceroute |
| 17 | Aisuru/Kimwolf payload host and C2 72.56.52.158 in ML Cloud-declared 72.56.52.0/24, originated by AS39900 (SIA GOOD, LV) during the observations | Verified (third-party IOC + RIPEstat) | Bitsight, RIPEstat, ML Cloud geofeed |
| 18 | Proxybot C2 91.108.249.19 in ML Cloud-declared 91.108.249.0/24, upstream Fiord Networks UAB (LT) | Verified (third-party IOC + RIPEstat) | Bitsight, bgp.tools, ML Cloud geofeed |
| 19 | AS198855 (AL, created 16 Apr 2026) declares only AS206728 and AS211805, both EU-sanctioned Media Land ASNs, as routing neighbours | Verified (current state) | RIPE aut-num |
| 20 | AS198855’s maintainer also runs Kubit DC, whose abuse contact is SYSECTs ACRO62605-RIPE and KVANTA LLC (PL), holder of 91.108.249.0/24 | Verified (registry) | RIPE inverse maintainer query, organisation and role objects |
| 21 | 176.98.182.0/24 moved from AS202799 to AS198855 on 3 Aug 2026 | Verified (8-hour windows) | RIPEstat, RIPE route objects |
| 22 | 91.108.249.0/24 originated by AS198855 from 21 Apr to 26 Sep 2026 | Verified | RIPEstat routing history |
| 23 | 193.124.254.0/24 changed origin from AS206728 (Media Land) to AS39900 (SIA GOOD) in June 2025 | Verified (daily windows) | RIPEstat, RIPE route object |
| 24 | KVANTA’s AS201097 originates two further ML Cloud geofeed prefixes (Krasnodar, Rostov-on-Don) | Verified (26 Sep 2026) | bgp.tools, RIPEstat, ML Cloud geofeed |
| 25 | AS198855 is a Media Land successor vehicle comparable to SYSECT | Hypothesis, supported by claims 19 to 22 | registry and routing only |
| 26 | green-dom-llc-mnt, Green Dom LLC and abuse role ACRO62545 created 25 Nov 2025; the maintainer administers organisation or abuse objects of four SYSECT-announced prefixes and ORG-MA2343-RIPE | Verified (registry) | RIPE inverse query, organisation and role objects |
| 27 | 193.124.254.0/24, originated by SIA GOOD, is sub-assigned to ORG-MA2343-RIPE (formerly ml-cloud-llc-lv) | Verified (current state) | RIPE inetnum objects |
| 28 | freedom-network.ru (wildcard, no MX) resolves to 212.193.31.74 in SYSECT-routed 212.193.31.0/24; mail delivery there not tested | Verified (27 Sep 2026) | DNS, IPinfo |
| 29 | ML Clouds storefront names ML Cloud Limited (Hong Kong) as contracting party and HSBC Hong Kong account holder | Verified (27 Sep 2026) | ml.cloud contacts, documents and Terms of Service |
| 30 | ML Cloud Limited (CR 3234023), incorporated 17 Feb 2023, listed as dissolved on 17 April 2026 | Incorporation verified; dissolution reported by aggregator only | Companies Registry list; 86HC |
| 31 | ML Clouds storefront claims an active site at Vantage BER1, Ludwigsfelde | Verified (claim published); not supported by measurements | ml.cloud data centre map, IPinfo, PeeringDB |
| 32 | ML.Cloud was owned by Yulia Pankova at the time of the December 2024 indictment | Verified (DOJ statement) | US DOJ press release, 14 Jul 2026 |
| 33 | ML Cloud LLC has a new sole owner since 15 Jan 2025 and the same person as director since 5 Feb 2025; company still active | Verified (official register) | EGRUL extract, 27 Sep 2026 |
| 34 | ML Cloud LLC reported RUB 10.1 m revenue for 2024 and no fixed assets | Verified (official filings) | GIR BO annual accounts 2024 |
| 35 | The ownership change was a response to the indictment | Hypothesis | timing only |
| 36 | SYSECTs registered owner and director has the same name and country of residence as a designated member of DGTL TECH UK LLP, whose maintainer MNT-DGTL maintains SYSECTs RIPE objects | Likely (name, residence and registry links; no date of birth from the Montenegrin register) | CompanyWall (SYSECT), UK Companies House (OC434843), RIPE DB |
Methodology and open questions
All data comes from public RIPE Database and RIPEstat queries, public blocklists, published research and vendor websites.
No purchases, logins or host/port scans were made. Requests for comment were sent to SIA GOOD (GOODTEC), Fiord Networks and Vantage Data Centers.
The questions and response status are documented below.
Limits. Historical RIPE versions omit personal contact attributes. RIPEstat routing windows are aggregated and exclude routes seen by fewer than ten full-feed peers.
Company data for SYSECT comes from a commercial aggregator, not the official register.
Requests for comment and responses
Requests for comment were sent by email to SIA GOOD (GOODTEC), Fiord Networks and Vantage Data Centers, setting out the findings relevant to each company and inviting a response before publication.
The questions below reproduce those sent.
The requests to SIA GOOD and Fiord Networks expressly stated that the article did not claim either company knew of or was involved in criminal activity.
The request to Vantage stated that the article did not suggest its involvement and sought clarification of ML.Cloud’s website claim.
A lack of response does not establish a customer relationship, knowledge of abuse or a sanctions violation.
SIA GOOD (GOODTEC)
Findings put to the company: The request described the June 2025 move of 193.124.254.0/24 from Media Lands AS206728 to AS39900 and its two /25 sub-assignments to ORG-MA2343-RIPE, formerly named “ml-cloud-llc-lv”; the route6 object for 2a0b:88c0:48::/48 naming AS39900 and maintained by mnt-ru-media-land-1; AS203142’s membership of AS202799:AS-MDLD; and Bitsight’s reporting on Aisuru/Kimwolf infrastructure in 72.56.52.0/24.
See Findings 4, 8 and 10.
Questions sent:
- Is Media Land LLC, ML.Cloud or a related company a customer of SIA GOOD and if so, since when and is the relationship ongoing?
- How do you screen customers of IP leasing and announcement services against sanctions lists?
- Were you aware of the botnet reports concerning 72.56.52.0/24?
Requested response deadline: 30 September 2026, 18:00 CEST.
Response:
No response was received by the requested deadline.
All three questions remained unanswered.
Fiord Networks
Findings put to the company: The request described AS28917 as the only observed upstream of AS198855 in public routing data; AS198855’s declared routing neighbours AS206728 and AS211805, both carrying RIPE NCCs EU sanctions remark for Media Land; and Bitsights reporting on Aisuru/Kimwolf infrastructure in 91.108.249.0/24.
See Findings 8 and 9.
Questions sent:
- Do you provide transit to AS198855 and since when?
- Did your customer screening consider the routing policy of AS198855 or any link to Media Land?
- Were you aware of the botnet reports concerning 91.108.249.0/24?
Requested response deadline: 30 September 2026, 18:00 CEST.
Response:
No response was received by the requested deadline.
All three questions remained unanswered.
Vantage Data Centers
Findings put to the company: The request described ML.Clouds website listing “Vantage (BER1), Brandenburg Park, Uferring 5, 14974 Ludwigsfelde” as an active data centre location.
It also explained that latency measurements placed the tested hosts from the only range ML.Cloud attributes to Ludwigsfelde near Saint Petersburg and that no technical evidence of ML.Cloud equipment at BER1 had been found. See Finding 7.
Questions sent:
- Is ML.Cloud, Media Land LLC, or a company acting for them, a customer at BER1, directly or through a reseller?
- Are you aware of ML.Cloud using your facility name in its marketing?
Requested response deadline: 30 September 2026, 18:00 CEST.
Response:
No response was received by the requested deadline.
Both questions remained unanswered.
Sources I Used
- RIPE DB: AS202799 versions
- RIPE DB: AS206728:AS-MEDIALANDTECHNOLOGY versions
- RIPE DB: AS202799:AS-MDLD
- RIPE DB: SYSTECH-MNT versions
- RIPE DB: person AV11916-RIPE
- RIPE DB: inverse query mnt-ru-media-land-1
- RIPE DB: ORG-MA2343-RIPE versions
- RIPE DB: ORG-MCL145-RIPE versions
- RIPEstat: announced prefixes AS202799
- US Treasury press release sb0319
- Council of the EU, 13 July 2026
- US DOJ, indictment unsealed 14 July 2026
- The Reno Project: Media Land profile v2.2
- BIRN: Disposable IP firms in Serbia, Montenegro
- Unit 42: Kimwolf v7
- Joe Sandbox analysis 1931383
- ThreatFox IOC 1902083
- Spamhaus ASN-DROP
- GOODTEC colocation offer
- CompanyWall: SYSECT
- UK Companies House: DGTL TECH UK LLP (OC434843), officers
- ML Cloud storefront
- ML Cloud geofeed prefix-geo.csv
- IPinfo: 78.17.25.0/24
- bgp.tools: 78.17.25.0/24
- IPinfo: 91.108.249.0/24
- Bitsight TRACE: Who Invited Aisuru to the LAN Party?
- RIPEstat: routing history 72.56.52.0/24
- bgp.tools: 91.108.249.0/24
- RIPE DB: aut-num AS198855
- RIPE DB: aut-num AS211805
- RIPE DB: organisation ORG-KL395-RIPE (KVANTA LLC)
- RIPE DB: organisation ORG-KD127-RIPE (Kubit DC)
- RIPE DB: role ACRO62605-RIPE
- RIPE DB: aut-num AS201097
- bgp.tools: AS198855
- bgp.tools: AS201097
- RIPEstat: routing history 176.98.182.0/24
- RIPEstat: routing history 91.108.249.0/24
- RIPEstat: routing history 193.124.254.0/24
- RIPEstat: routing history 132.243.199.0/24
- RIPEstat: routing history 78.153.136.0/24
- Bitsight research IOC repository (Aisuru)
- RIPE DB: inverse query green-dom-llc-mnt
- RIPE DB: role ACRO62545-RIPE
- RIPE DB: inetnum 193.124.254.128/25
- IPinfo: 212.193.31.74
- ML Cloud: contacts and requisites
- ML Cloud: documents
- ML Cloud: Terms of Service (PDF)
- ML Cloud: data centres
- OFAC recent actions, 19 November 2025 (SDN entries)
- Hong Kong Companies Registry
- Hong Kong Companies Registry: new incorporations, 13 to 19 February 2023
- RIPE Database: protection of route object space
- OFAC FAQ 398 (50 percent rule)
- FNS: EGRUL extract ML Cloud LLC (OGRN 1227800008182), 27 Sep 2026
- FNS GIR BO: annual accounts ML Cloud LLC (INN 7810938831), 2024
- tagesschau: Russia blamed for attempted drone attack at Leipzig/Halle Airport
- Kölner Stadt-Anzeiger: threats against Germany on Russian state television
- RIPE DB: aut-num AS202799
- RIPE DB: mntner mnt-ru-media-land-1
- Google Public DNS: freedom-network.ru A query (live)
- 86HC: ML Cloud Limited (Hong Kong)
- RIPE DB: 194.26.25.0/24AS202799
- RIPE DB: 45.141.85.128/25AS202799
- RIPE DB: mntner SYSTECH-MNT
- RIPE DB: mntner MNT-DGTL
- RIPE DB: aut-num AS203142
- RIPE DB: organisation ORG-SD317-RIPE
- RIPE Database: historical queries and filtered attributes
- IPIP.NET: AS202799 and ORG-SD317-RIPE Whois mirror (2022 record)
- Birius: bookkeeping and residence-permit services
- bgp.tools: AS206728
- bgp.tools: AS202799
- RIPEstat: routing history 194.26.25.0/24
- RIPEstat: routing history 91.220.163.0/24
- RIPEstat: routing history 212.193.31.0/24
- RIPEstat: routing history 147.45.44.0/24
- RIPEstat: routing history 89.19.220.0/24
- RIPEstat: routing history 89.19.222.0/24
- RIPEstat: routing history 89.19.223.0/24
- RIPEstat: routing history 89.19.221.0/24
- RIPEstat: routing history 72.56.54.0/24
- RIPEstat: routing history 109.237.98.0/23
- RIPEstat: routing history 78.17.25.0/24
- RIPEstat: routing history 45.141.85.128/25
- RIPEstat: routing history 45.141.85.0/24
- RIPEstat: Routing History API and visibility threshold
- RIPE DB: aut-num AS39900
- RIPE DB: 2a0b:88c0:48::/48
- RIPEstat: routing history 2a0b:88c0:48::/48
- Spamhaus IPv4-DROP
- PeeringDB: Media Land and SYSECT network/facility records
- RIPE NCC: Fiord Networks, UAB member entry
- RIPE DB: 132.243.199.0/24
- RIPE DB: 78.153.136.0/24
- RIPE DB: 193.124.254.0/24AS39900
- RIPE DB: 109.120.136.0/24
- RIPEstat: routing history 109.120.136.0/24
- Google Public DNS: freedom-network.ru NS query (live)
- Google Public DNS: freedom-network.ru MX query (live)
- Google Public DNS: freedom-network.ru TXT query (live)
- IETF RFC 5321, section 5.1: implicit MX
- RIPE DB: inverse query Renets-mnt
- Internet Archive: capture index for ML Cloud contacts (exact historical captures not supplied)
- European Commission: control and making funds or economic resources available
- RIPE Database web query
- RIPEstat
- ANY.RUN: 147.45.44.131/files/ftp.exe, 31 July 2024
- Joe Sandbox 1584679: additional Lumma-related analysis for 147.45.44.131 (undated)
- DNSlytics: AS202799 Whois mirror
- IPinfo: 78.17.0.0/16, geolocation entry for 78.17.25.3
