AS210644

AS210644 is AEZA's largest ASN, registered under RIPE to AEZA GROUP LLC / Aéza International Limited, with a Russian operator base in St. Petersburg and a UK branch entity registered in Sheffield — registration country is reported inconsistently across sources (Cloudflare Radar lists UK, ip2location lists RU), and both are noted rather than resolved here. It is a hosting/VPS network characterized as "bulletproof" in the US Treasury designation, ranking #1 for estimated eyeballs in the Russian Federation per bgp.tools, announcing roughly 299–315 IPv4 prefixes (~93,700 addresses) and ~46–53 IPv6 prefixes across about 5 IXes, and — unlike Stark's AS44477 — it remains actively announced as of mid-2026. On 1 July 2025 the US Treasury's OFAC designated Aeza Group LLC pursuant to E.O. 13694, stating it provided bulletproof-hosting services to ransomware and malware groups including the Meduza and Lumma infostealer operators, and also naming affiliates (Aeza International Ltd, Aeza Logistic, Cloud Solutions) and four individuals. A second wave on 19 November 2025 designated the UK front company Hypercore Ltd, described as registered and used by Aeza after its designation to move IP infrastructure and evade sanctions. An analyst seeing AS210644 IPs is triaging Russia-based hosting subject to US and UK sanctions; activity attaches to specific tenants and dated incidents, and US persons are prohibited from transacting with the designated entities.

Operator

AEZA GROUP LLC / Aéza International Ltd (RIPE org ORG-AIL64-RIPE → ORG-AGL50-RIPE; mnt lir-ru-aezagroup-1-MNT) [Confirmed] — RIPE WHOIS

Country / RIR

ambiguous — RU operator (St. Petersburg) + UK branch (Sheffield); Cloudflare lists UK, ip2location lists RU; RIPE [Confirmed — conflicting, noted]

Allocated

2021-10-13 [Confirmed] — RIPE

Org status

sanctioned (OFAC 2025-07-01; UK NCA coordinated); core ASNs still active/announced mid-2026; post-sanctions rebranding via new shell ASNs documented [Confirmed]

Security/abuse context (NEUTRAL, DATED, SOURCED)

OFAC designation 2025-07-01 (E.O. 13694, as amended): Treasury press release SB0185 stated Aeza provided bulletproof-hosting to ransomware/malware groups incl. Meduza and Lumma infostealer operators (used to target the US defense industrial base and technology companies), and hosted BianLian, RedLine panels, and the BlackSprut darknet market; also designated affiliates Aeza International Ltd (UK, with UK NCA), Aeza Logistic LLC, Cloud Solutions LLC, and individuals Arsenii Penzev (CEO), Yurii Bozoyan (GD), Vladimir Gast (Technical Director), Igor Knyazev; one TRON address listed (TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F) [Confirmed — treasury.gov SB0185]. Second wave 2025-11-19 (Treasury SB0319; UK OFSI; Australia DFAT) designated Hypercore Ltd as a UK company used by Aeza post-designation to move IP infrastructure and evade sanctions, plus director Maksim Makarov, Ilya Zakirov, and shells Smart Digital Ideas DOO (Serbia), Datavice MCHJ (Uzbekistan) [Confirmed — Federal Register]. Silent Push (July 2025) reported >2,100 IPs migrating from AS210644 to AS211522 (Hypercore) within days [attributed]. Tenant/incident-level attribution — treasury.gov/news/press-releases/sb0185, treasury.gov/news/press-releases/sb0319

Network & routing

Network type

hosting-VPS / "bulletproof hosting" (per OFAC designation) [Confirmed]

Size

~299–315 IPv4 prefixes (~93,700 addrs), ~46–53 IPv6; RIPEstat May 2026: 312 v4 / 46 v6 — still actively announced — bgp.he.net, bgpview.io

Routing/peering

~52–105 peers, 3 upstreams incl. aurologic GmbH (AS30823), Hurricane Electric (AS6939), Cogent (AS174); 5 IXes; RPKI partial (~354 valid, ~8 invalid); Qurium has named aurologic AS30823 as connectivity enabler [attributed] — bgp.tools, peeringdb.com/asn/210644

Notable usage

AEZA's largest ASN; #1 for estimated eyeballs in the Russian Federation per bgp.tools; still visible/announced mid-2026 — aeza.net

Related ASNs (RIPE

:AS-AEZA set, aeza-mnt): AS216246 (RU-AEZA-AS, still announced); AS211522 (Hypercore Ltd, UK — OFAC/UK-designated front, created 2025-07-10); AS203273 (NetCrafters OU, EE); AS214231 (EuroCTP B.V., inactive). NOTE: AS214004 unverified as AEZA [Unknown]; AS213520 (Senko Digital LLC) is a SEPARATE brand not confirmed as AEZA [Confirmed via bgp.tools AS-set]

Analyst note

OFAC-sanctioned bulletproof host; an analyst seeing these IPs is triaging sanctioned Russia-based hosting frequently associated by vendors with ransomware/infostealer/darknet infrastructure. Multi-tenant; abuse attaches to tenants/incidents; US persons prohibited from transacting with designated entities.