AS9009

AS9009 is the live production network of M247, a Bucharest-registered, facilities-based global hosting, IP-transit, and commercial-VPN-server-hosting provider. As observed by RouteViews at 2026-08-15T02:00 UTC, it originates 4,215 IPv4 prefixes (about 1,561,600 addresses) and 801 IPv6 prefixes, with 167 distinct BGP neighbors seen adjacent to it — an actively routed, heavily peered network.

M247 Europe SRL, registered address Soseaua Fabrica de Glucoza No. 11B, Level 1, District 2, Bucharest 020331, is the entity that holds AS9009 per the operator's own knowledge base. That same portal lists company registration number J37/144/2012, which conflicts with a second number, J2015003081408, shown elsewhere on the portal under the identical VAT/CUI RO30203422 — a discrepancy noted here, not resolved. M247 Europe SRL sits alongside sibling entities M247 DC SRL (Bucharest) and M247 Global Ltd (London).

M247 Global describes itself as facilities-based rather than a reseller, owning its routers, switches, and servers across a Cisco-based, dual-stack IPv4/IPv6 backbone serving hosting, IP-transit, colocation, cloud, and dedicated-server customers. Self-reported footprint counts are inconsistent across the operator's own pages — 55+ PoPs across 36 cities in 28 countries on one, 46 data centers across 37 cities on another — read as loosely maintained marketing figures rather than a precise census.

The operator states backbone capacity of "up to 1 Tbps" across two separate official pages — lower than the 5–10 Tbps figure the prior entry carried. M247 also publishes its own peering policy: selective, requiring a 24/7 NOC, an RIR-assigned ASN running BGP4, presence in at least two countries per continent where multi-continent, a current PeeringDB object, and exclusion of existing M247 customers from settlement-free peering; private-interconnect thresholds are 20 Gbps multihomed or 10 Gbps single-homed.

A June 2025 divestment is sometimes read as a whole-company sale, but M247's own characterization, echoed in trade press, limits it to the UK-only connectivity and IT-services arm sold to Convergence Group; the international side, including M247 Europe SRL — AS9009's actual registrant — was explicitly retained and continues operating. Consistent with that, m247.com (the domain M247's own as9009.net page still names as its site) now redirects permanently to convergencegroup.co.uk, while M247 Europe SRL runs its own separate, live site.

M247 Global's own marketing names VPN providers as a target customer sector alongside media/streaming, AI/ML, gaming, and gambling platforms, and separately sells dedicated commercial-VPN server hosting as its own product line. This corroborates, from the operator's own side, the heavy VPN-hosting footprint documented by independent research: M247 hosts servers for 38 of 50 tracked VPN providers, and testing has repeatedly found it among the most common VPN egress networks in Europe.

AS rank, customer cone size, RPKI validation posture, IX presence, and abuse contacts are Unknown for this entry, and allocation date is likewise Unknown. Upstream and transit relationships cannot be determined from BGP-adjacency data alone, since it carries no directionality — several of AS9009's 167 observed neighbors happen to be large global carriers, but that overlap does not establish which ASNs, if any, provide it transit.

Exposure

M247 is heavy-tenant hosting/VPS/commercial-VPN infrastructure; a source IP alone does not identify the actor or true geolocation, since a "country" tag may reflect a VPN exit location rather than the end user.

VPN concentration

M247 hosts servers for 38 of 50 tracked VPN providers (codamail.com, published 2026-04-07, updated 2026-06-01); the same analysis cross-checks against X4BNet's VPN-IP database, where M247 and Datacamp together account for 43.9% of tracked ranges — a combined figure, not M247 alone. 2020 testing found M247 was the VPN egress point in roughly 70% of tested Europe VPN/location combinations (whoisyourvpn.com).

Fraud-score listing

Scamalytics lists "M247 Ltd" in its ISP fraud-score index; the current score distribution could not be independently confirmed, so only the listing itself is asserted here, not a specific figure.

Historical finding

a RIPE anti-abuse-wg mailing-list post dated 2016-08-03 named AS9009 (then M247 Ltd, Manchester) as an upstream transit connection for Host Sailor Ltd. (AS60117), a hosting operation Krebs on Security's 2016 reporting linked to a prior bulletproof-hosting operation — a 2016 relationship, not a description of current M247 conduct.

Recent sightings

Hunt.io reporting (published 2026-06-24, updated 2026-07-10) recorded three separate AS9009-hosted IPs: one tied to Cloud Atlas APT campaign infrastructure, one flagged as a probable Mullvad VPN node also linked to a FreePBX toll-fraud campaign, and one staging a malicious npm package — individual sightings, not a claim about AS9009's overall malicious-traffic volume.

Spam signal

CleanTalk (data as of 2026-08-01) logs about 4.66% of its roughly 98,631-IP AS9009 sample as spam-active, tagging the AS's traffic profile "Public, Paid VPN, Hosting, Tor, good_bots, cdn."

Perimeter hygiene

UpGuard's automated external rating for M247's own corporate site (dated 2026-08-15) gives a C grade (596/950) for routine web-hygiene gaps — HSTS, TLS 1.2 ciphers, DNSSEC, DMARC — but reports no recent botnet, malware, phishing, or brute-force findings.

Advisories

no CISA advisory, Europol notice, or sanctions action naming M247 or AS9009 was found as of an August 2026 search.

Operator

M247 Europe SRL — registered address Soseaua Fabrica de Glucoza No. 11B, Level 1, District 2, Bucharest 020331, Romania; sibling entities M247 DC SRL (Bucharest) and M247 Global Ltd (London) share the corporate umbrella [Confirmed] — portal.m247.ro knowledgebase, m247global.com/contact-us

Country / RIR

RO, RIPE NCC [Confirmed for country; Likely for RIR] — m247global.com/contact-us

Allocated

Unknown [Unknown]

Org status

active; M247 Europe SRL continues operating independently. Corporate lineage — GLOBALAXS, OHTele, Axamba, WebTapestry, SOInternet; M247 Ltd fka Open Hosting Limited, founded 2000 in Manchester — carried forward from the prior entry [Likely] — pitchbook.com. The June 2025 Convergence Group transaction was limited to M247's UK-only connectivity/IT-services arm; the international side, including M247 Europe SRL (AS9009's registrant), was explicitly retained and continues operating independently [Confirmed for the divestment scope; Likely for M247 Europe SRL's specific exclusion] — convergencegroup.co.uk, ispreview.co.uk (2025-06)

Contacts

peering@m247.com (peering requests), nmc@m247.com (Network Management Centre / NOC) [Confirmed] — as9009.net/policy.html

Security/abuse context (DATED, NEUTRAL)

mixed-tenant hosting/VPS/commercial-VPN infrastructure; full sourced breakdown (VPN concentration, a 2016 upstream-transit history note, 2026 threat-intel sightings, spam/perimeter metrics) is in the Security section above

Network & routing

Network type

facilities-based (self-described "not a reseller") global hosting / IP-transit / colocation / cloud / dedicated-server / commercial-VPN-server-hosting provider; Cisco-based, dual-stack IPv4/IPv6 backbone [Confirmed] — m247global.com/about-us, m247global.com/ip-transit

Size

4,215 IPv4 prefixes (~1,561,600 addresses) and 801 IPv6 prefixes, as observed by RouteViews at 2026-08-15T02:00 UTC [Confirmed] — the RouteViews BGP routing data (CC BY 4.0) AS9009

Routing/peering

167 distinct BGP neighbors observed by RouteViews at 2026-08-15T02:00 UTC; 32-entry column-capped sample: AS174, AS260, AS293, AS1299, AS1403, AS2518, AS2914, AS3210, AS3257, AS3292, AS3303, AS3356, AS3491, AS3503, AS4637, AS4826, AS5511, AS6461, AS6762, AS6830, AS6939, AS8529, AS10753, AS12552, AS13004, AS13210, AS15967, AS19211, AS19575, AS19695, AS19793, AS20912; adjacency carries no upstream/customer direction, so no transit relationship is asserted from this list

[Confirmed] — the RouteViews BGP routing data (CC BY 4.0) AS9009

Peering policy

selective, per the operator's own published policy — requires a 24/7 NOC, an RIR-assigned ASN running BGP4, presence in at least two countries per continent where present on multiple continents, a current PeeringDB object, and excludes existing M247 customers from settlement-free peering; private-interconnect thresholds are 20 Gbps multihomed or 10 Gbps single-homed

[Confirmed] — as9009.net/policy.html

RPKI

Unavailable — validation posture not checked [Unknown]

IX presence

Unknown [Unknown]

AS rank / customer cone

Unknown [Unknown]

Notable usage

hosting/IP-transit provider that also markets dedicated commercial-VPN server hosting as a named product line; M247 Global's own marketing names VPN providers as a target customer sector alongside media/streaming, AI/ML, gaming, and gambling platforms

[Confirmed] — m247global.com, m247global.com/vpn-servers

Related ASNs

Unknown — no additional M247-affiliated ASN numbers confirmed; corporate lineage names above are not themselves ASN identifiers [Unknown for ASN numbers; Likely for lineage names] — pitchbook.com

Analyst note

M247/AS9009 is shared multi-tenant infrastructure — hosting, VPS, and commercial VPN together — so a source IP alone does not identify the actor or true geolocation. The same address space serving major consumer-VPN brands has, per dated third-party threat-intel reporting, also briefly hosted APT-linked C2, toll-fraud, and malicious-package-staging infrastructure at specific IPs; corroborate with a current per-IP abuse/threat-feed lookup before attributing any single incident to a specific tenant.