AS9009

AS9009 is the network of M247, a global hosting and connectivity provider registered under RIPE to M247 Europe SRL in Bucharest, spanning 55-plus points of presence across roughly 36 cities in 28 countries. PeeringDB classifies it as an NSP running 5–10 Tbps with a balanced ratio. It announces on the order of 4,150–4,260 IPv4 prefixes and ~800 IPv6 prefixes (~1.58 million IPv4 addresses), is present at around 60–65 IXPs, and takes transit from Cogent, Arelion, Lumen, GTT, NTT, Orange, and PCCW; CAIDA ranks it #346 with a customer cone of 143 ASNs. Its corporate lineage spans GLOBALAXS, OHTele, Axamba, WebTapestry, and SOInternet, and PitchBook records a June 2025 acquisition by Convergence Group. What sets AS9009 apart for triage is its very heavy commercial-VPN-hosting footprint: independent analysis finds M247 hosts servers for a large majority of tracked consumer-VPN providers (one 2026 analysis cites 38 of 50; 2020 testing found it was the egress point in 70% of tested VPN/location combinations across Europe). The practical implication is that many M247 IPs are VPN exit nodes, so geolocation and per-IP user attribution are unreliable — a "country" tag may be a virtual location, and a single IP may aggregate many users. Frame this neutrally: it reflects VPN/tenant traffic, not operator intent.

Operator

M247 Europe SRL (Bucharest, Romania) [Confirmed] — RIPE / PeeringDB

Country / RIR

RO, RIPE [Confirmed] — RIPE WHOIS

Allocated

2005-06-06 [Confirmed] — RIPE / PeeringDB

Org status

active; lineage GLOBALAXS/OHTele/Axamba/WebTapestry/SOInternet (M247 Ltd fka Open Hosting Limited); founded 2000 in Manchester; PitchBook records 2025-06-11 acquisition by Convergence Group [Likely] — pitchbook.com

Security/abuse context (DATED, NEUTRAL — VPN focus)

many M247 IPs are commercial-VPN exit nodes, so geolocation and per-IP user attribution are unreliable. Independent analysis: M247 hosts servers for 38 of 50 tracked VPN providers (codamail, 2026, cross-checked vs X4BNet's 10,577-range DB); earlier 2020 testing found M247 was the egress point in 70% of tested VPN/location combinations across Europe (NordVPN/Surfshark/PIA/AirVPN/ProtonVPN/Mullvad). Scamalytics assigns elevated fraud scores to some ranges. Reflects VPN/tenant traffic, not operator intent — whoisyourvpn.com, scamalytics.com

Network & routing

Network type

hosting-VPS / carrier (PeeringDB NSP, 5–10 Tbps, balanced) [Confirmed]

Size

~4,151–4,257 IPv4 prefixes (some trackers ~4,009), ~783–813 IPv6 (~1.58M addrs originated) — bgp.he.net / bgp.tools (2026-06)

Routing/peering

~60–65 IXPs; upstreams Cogent (AS174), Arelion (AS1299), Lumen (AS3356), GTT (AS3257), NTT (AS2914), Orange (AS5511), PCCW (AS3491); RPKI ~2,459 v4 valid, 125 invalid — bgp.tools, peeringdb.com/net/601

Notable usage

global hosting/connectivity provider (55+ POPs, ~36 cities, 28 countries) with a very heavy commercial-VPN exit/endpoint-hosting footprint — m247.com

Related ASNs

GLOBALAXS lineage and other M247 ASNs

Analyst note

If you see M247 in logs, assume the IP may be a VPN endpoint aggregating many users; do not infer a single actor or true geolocation from the IP alone.