‘Disposable’ IP Firms in Serbia, Montenegro Obscure Origins of Russian Cyber Meddling

In a ninth-floor apartment in the central Serbian town of Krusevac, BIRN tracked down Russian-owned web hosting firmeServer. It was registered in the months following Russia’s full-scale invasion of Ukraine, in April 2022, by 43-year-old Maxim Azarov. Azarov’s eServer to links several entities that have been sanctioned by Western states, including Aeza Group and another Russian BPH service provider called Stark Industries Solutions. A so-called bulletproof hosting, BPH, service provider, Aeza Group was sanctioned in July last year by the United States, which accused it of supporting cybercriminals in ransomware attacks, stealing US technology, and selling black-market drugs. Stark Industries Solutions is another Russian bulletproof hosting provider. It was sanctioned by the European Union in May last year for allegedly providing critical digital infrastructure to Russian and Belarusian state-aligned actors involved in cyberattacks and hybrid warfare. BPH services providers are defined as selling access to specialised servers and other IT infrastructure designed to help cybercriminals evade detection. Azarov is not the only one of its kind in Serbia. Several other service providers registered in the country have connections to the IP ecosystems of sanctioned Russian companies and to infrastructure used in covert Russian influence and disinformation activities, BIRN’s investigation has found. These companies act as conduits for clusters of IP addresses, known as IP ranges, receiving or passing them on from other entities flagged for nefarious activities or slapped with sanctions by the West. Foreign actors often set up such “disposable” front companies in other countries, said Ian Campbell, senior security operations engineer and threat researcher for the US-based cybersecurity firm DomainTools. “We see actors rotating IP address blocks between different autonomous systems,” Campbell told BIRN. “They do this precisely because they know that a provider will delay any request for a shutdown or enforcement action for long enough to allow them to quickly move a block of IP addresses to another autonomous system.” Ownership obscured An Internet Protocol address, or IP address, is a unique sequence of numbers assigned to every device connected to an internet network, acting as a digital mailing address that allows devices to identify and communicate with each other over the internet. In 2011, the global pool of new, free IP address clusters began running out; the IP ranges that regional registries like the Regional Internet Registry for Europe, Middle East and Central Asia, known as RIPE NCC, distribute today are sold, leased, or transferred between companies as scarce resources. The registries, whether RIPE NCC in Europe, for example, or ARIN in North America, record these changes. Regulations on how ownership can be transferred vary between regions, but in general buyers and brokers vet IP blocks to ensure they have not previously been flagged on global cybersecurity lists for malicious operations; buyers and sellers must provide evidence of their registration rights and corporate identity. Holders cannot re-sell IP blocks for a period of time – two years in Europe, for example, or 12 months in Africa. However, the companies identified in the course of this investigation, in Montenegro and Serbia, are buying or leasing pools of IP blocks from so-called upstream providers and sub-allocating or leasing them out downstream to other resellers or end-users. This serves to obscure ownership. End-users may not know who ultimately owns the blocks they are using. Balkan front Social media posts show that Maxim Azarov attended a conference at the Russian presidential administration led by German Klimenko, Putin’s former internet adviser. Source: Instagram.Between late 2022 and February 2024, Azarov’s eServer said it was managing two IP ranges that subsequently came under the control of Stark Industries Solutions. Following the EU sanctions, Stark Industries Solutions rebranded as PQ Hosting and transferred its IP resources under the umbrella of Dutch WorkTitans. In May this year, Dutch police arrested the owners of WorkTitans and MIRhosting on suspicion of aiding Stark Industries Solution in circumventing sanctions. Archived routing data show that at the end of 2024, Azarov was an upstream provider for PQ Hosting, i.e. the rebranded Stark Industries Solutions. BIRN identified at least eight IP ranges that WorkTitans listed as being located in or used from Serbia and Belgrade, with Serbian Open Exchange, an internet traffic exchange point, serving as the internet gateway for all the ranges. These include two previously advertised by eServer. Azarov said his company “had no direct business relations with Stark Industries”. “Subnets roam between some providers and if we get request from any of our clients to announce network we just do so – that’s our part of hosting business,” he said in a response to BIRN, written in English. “And you say it later came under control of Stark – then maybe they acquired it somehow.” BIRN also identified three other IP ranges that have, over the past several years, moved between eServer, Stark Industries Solutions and Aeza Group. An analysis of the RIPE NCC database shows that numerous IP ranges previously controlled by Azarov have since passed to two providers previously linked to the Russian bulletproof ecosystem and infrastructure used in cyberattacks: Cypriot-registered IT-Hostline and Russia-based Fortis. IT-Hostline was previously a partner of Stark Industries Solutions and now provides infrastructure to Aeza Group, according to France-based cybersecurity firm Intrinsec, while Fortis’s infrastructure was used by FIN7 hacking group, responsible for mass financial theft and corporate extortion, Insikt Group reported last year. Former eServer ranges are also now advertised by Global Connectivity Solutions and Global Internet Solutions, both linked to Aeza Group, Insikt Group said, and identified a number of ransomware groups that it said had used their infrastructure. According to RIPE NCC data, among the current users of IP ranges previously held by eServer are: Russian provider Rost, whose infrastructure was also reportedly used in the Doppelganger campaign; Russian Timeweb, where researchers this year found more than 300 active C2 servers – systems used to send instructions to malware-infected devices and steal data; and US-based Baxet Group, whose infrastructure has been linked to cyberattacks by Russia’s military intelligence service, GRU, as reported by Arctic Wolf Networks, an American cybersecurity company, in November 2025. Today, Azarov advertises an IP range belonging to Neterra Ltd, a Bulgarian provider previously used by the hacking-for-hire and corporate espionage group DeathStalker and whose infrastructure was also partly used to distribute Pegasus spyware, according to Amnesty International. Azarov, however, insisted his eServer “has a strict anti cybercrime policy on all of our locations”. “By targeting on B2B and B2C markets we always monitor our networks and try to keep environment safe and trustworthy,” he wrote to BIRN. “You can see that our networks are not in SBL and other lists and if some IPs get into it we act immediately. So as I told you we did not work directly with Stark Industries but even if their networks were announced by some of our clients, they were applied the same strict rules and filters so I don’t think there was any malicious activity.” Typically in cybercrime, when one network is shut down or sanctioned, attackers simply transfer IP addresses and other internet resources to linked providers and continue their operations. This is how sanctioned companies Aeza and Stark Industries have continued to operate. “Today, it is no longer a single server, but an entire dynamic infrastructure that is constantly changing,” Radunovic told BIRN. “That makes it difficult to track because it operates across multiple jurisdictions and legal procedures, so investigators, alongside technical traces, also follow money flows, cryptocurrencies and other connections.” Provider ‘does not care’ Smart Digital Ideas and Kambieva’s Hosting are both registered at the same address in a dilapidated 1990s-era shopping mall in the New Belgrade district. Photo: Google Street View.Founded in 2021, Aeza Group was identified in 2024 as a key part of a wide-ranging, ongoing Russian influence and disinformation campaign known as ‘Doppelganger’, in a report by the German investigative media outlet CORRECTIV, based on an analysis by the Swedish digital forensics NGO Qurium. According to the US Treasury Department, Aeza Group also hosted criminal services such as Lumma and Meduza malware, as well as BlackSprut, one of the largest online marketplaces for the drug trade. Its infrastructure was used in a November 2025 DDoS attack on the Serbian news portal Juzne vesti, the portal said at the time. “Classic bulletproof hosting is when the provider does not care what is on its servers,” said Vladimir Radunovic, a cyber diplomacy expert at the Diplo Foundation, a non-profit foundation established by the governments of Malta and Switzerland. “Sometimes it pretends not to know, and sometimes it actively participates,” Radunovic told BIRN. “If it actively participates, then it is part of the crime.” A few months after sanctioning Aeza Group, the US also sanctioned Belgrade-based company Smart Digital Ideas. As BIRN has previously reported, the company is owned by Andreas Maul, a town councillor for Germany’s far-right AfD party. According to a November 2025 report by Insikt Group, the threat intelligence research arm of cybersecurity firm Recorded Future, within 24 hours of being sanctioned, Aeza began reallocating some of its US IP resources to Smart Digital Ideas. Days later, Smart Digital Ideas transferred the resources to the British company Hypercore Ltd. The likely purpose, according to the Insikt Group report, was “to retain control of any assets affected” by the sanctions. “It is like someone selling weapons, then getting sanctioned and transferring the weapons to someone else,” said Radunovic. “Except that transferring weapons is not so easy, while with IP addresses you can do it in three clicks.” The US sanctioned Smart Digital Ideas and Hypercore Ltd on November 19, 2025. Castles, in Serbia and Russia Maxim Azarov’s eServer and Alexei Fedorov’s companies are both registered at the same apartment in the central Serbian town of Krusevac. Photo: Google Street View. Azarov’s eServer is registered as sharing the same address as another Russian-owned web hosting company, owned by 38-year-old Alexei Fedorov, who set up shop as a self-employed entrepreneur in June 2022. Fedorov registered his hosting service, kvmka.ru, with RIPE NCC in November 2023. The company’s website states that its servers are physically located in Serbia, at a Beotel data centre. In Russia, Fedorov is technical director of a company called Coloded and owner of the network provider Alex Group. Both companies have been identified as providing infrastructure for Doppelganger campaigns, according to Quirium. Last year, cybersecurity researchers at Intrinsec linked Alex Group to the Ukrainian FDN3 network, which was used in attacks on VPN services and operating systems. Alex Group’s network holds several large IP blocks from which IP ranges controlled by Aeza Group and systems linked to it have been allocated, while Coloded is a distributor of physical servers for Russian provider VDSina, which, according to Recorded Future, took over some of Aeza Group’s customers after it was sanctioned. Several IP ranges currently advertised by Fedorov were previously used by Aeza Group and Dutch MIRhosting, whose owner was arrested in May on suspicion of aiding Stark Industries Solutions in circumventing sanctions. Fedorov also advertises ranges previously held by Russian BPH service provider Media Land, sanctioned over the past year by the US, Britain, Australia, the EU and Canada for facilitating global ransomware operations, DDoS attacks, and major cybercriminal infrastructure. Drawing on Qurium’s research into the Doppelganger campaign, BIRN identified another participant with links to Serbia. In November 2023, 42-year-old Aleksandr Shmalko registered a company in Serbia’s second city of Novi Sad, under the name Castles. The company is registered as a DDoS protection provider. Its IP ranges are registered to Moscow. Shmalko is a director of a Russian company, also called Castles, in Veliky Novgorod, south of Saint Petersburg. This Russian company also appears in the Qurium report as a participant in the Doppelganger campaign. Besides its own ranges, Shmalko’s Serbian company currently advertises one belonging to IPX-FZCO, which Qurium Foundation has linked to Russian cyberattacks, the Doppelganger campaign and activities by the Qilin ransomware group, which hacked Serbia’s state-owned power utility EPS in December 2023. Experts say the expansion of Russian BPH service providers in Europe is part of an effort to conceal the true origin of malicious traffic and bypass Western cybersecurity alerts. “In most cases, these are small to medium-sized businesses,” said Campbell, the cybersecurity researcher. “They will not build huge companies that can easily attract attention, so it is much better for them to set up multiple small, quiet organisations that they can simply abandon when it becomes convenient.” “A fairly large part of Russian infrastructure in Europe is used more for transit and less for the actual attack infrastructure. The aim is to make it look as though the attacks are coming from the European Union.” How BIRN traced the digital fingerprints To identify and link individuals, digital traces, and other relevant information, BIRN used the OSINT tools osint.industries and Intelligence X, searching publicly available data associated with email addresses, usernames, domains and other digital identifiers. PimEyes was used to verify and link visual identities. The investigation also relied on previously leaked databases containing information on Russian citizens and their travel data. Relevant information was further checked and verified through official registries, publicly available documents and other independent sources.