Autonomous system
AS9009 M247
Hosting DROP-listed space RIPE
Summary
M247 Europe SRL
hosting vps transit vpn
An Autonomous System of M247, a Manchester-headquartered hosting and network provider (this entity is its Romania-based operation). Addresses here carry M247 hosting, colocation, transit, and a large amount of commercial VPN exit traffic.
What it's used for
- Dedicated servers, VPS, colocation, and IP transit across many global locations; also widely used as VPN infrastructure.
Notable
- One of the most commonly-seen commercial-VPN egress networks. An IP here identifies M247 as the host, not the tenant — a large share of this space is rented to VPN providers, so a hit on this ASN is very often a VPN exit rather than a server or a real end user.
- Long used as infrastructure for major consumer VPNs (e.g. NordVPN, HideMyAss) as well as smaller ones, which is why it turns up so frequently in IP lookups.
- M247 runs multiple ASNs — see sibling AS9316.
Interesting
- M247 leases IP space and servers to many downstream VPN and hosting brands, so the geolocation of an M247 IP usually reflects the chosen exit city, not where the user actually is.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 52 exchanges in 26 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| IX.br (PTT.br) São Paulo | São Paulo, Brazil | 187.16.223.37 |
| DE-CIX Frankfurt | Frankfurt, Germany | 80.81.192.165 |
| LINX LON1 | London, United Kingdom | 195.66.224.231 |
| AMS-IX Amsterdam | Amsterdam, Netherlands | 80.249.208.63 |
| Neutral Internet Exchange | Amsterdam, Netherlands | 193.239.118.114 |
| Equinix Internet Exchange Singapore | Singapore, Singapore | 27.111.229.235 |
| Milan Internet Exchange | Milan, Italy | 217.29.67.64 |
| BroadBand Internet eXchange Tokyo | Tokyo, Japan | 101.203.89.101 |
Transit providers
90 upstream, 143 downstream and 324 adjacent networks observed; most-used upstreams first.
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-10, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 2,690 prefixes · 1.60M addresses IPv6 405 prefixes
| Country | Name | Prefixes |
|---|---|---|
| RO | Romania | 3,095 |
Registry
Allocation record
- Registry
- RIPE
- Handle
AS9009- Registry name
- M247
- Registrant
- M247-EU-MNT
- Abuse contact
- abuse@m247.ro
- Registered
- 2011-04-11
- Last changed
- 2023-03-15
- Allocation
- allocated
Routing security
RPKI and IRR
- RPKI
- 56% valid · 2,948 valid, 2,245 with no ROA 40 RPKI-invalid
- ROAs
- 3,204 authorising AS9009
- ASPA
- no ASPA record
- IRR
- 96% registered · 5,029 of 5,233 announcements 48 other origin
- Route objects
- 7,479 naming AS9009
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
51 DROP matches Announced space overlapping the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 431 networks and 1,775 prefixes, as published 2026-10-11. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
42 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.
| Prefix | Advisory | Published |
|---|---|---|
45.12.206.12 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.12.206.234 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.12.206.26 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.12.206.72 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.12.206.76 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.12.206.87 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.82.167.112 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.82.167.115 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.82.167.121 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.82.167.22 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
Showing the first 10 of 42.
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere