5 ms·
Ask HN: My Suspicion Regarding “M247 Ltd”
Around a year or two ago I noticed almost every single self-proclaimed No-logs VPN had started opening new servers with a provider called M247, which is based in Manchester, UK. At first it was nothing suspicious and maybe 20% of the VPN servers I used were operated by M247, and these were all servers in Europe, and there were no red flags or anything suspicious to me at the time.
However fast forward to the present day and I notice that M247 Ltd is operating an estimated 65-85% of these VPN servers, and 90% of the USA servers are operated by them. Now they have VPN exits everywhere. All over USA, all over Europe, they have some in Asia, even Australia. The fact that so many VPN servers are using their network concerns me for a number of reasons, the first being that with all the VPN traffic flowing through their network, there is now a target on their back by government organizations, etc, what's stopping them from putting DPI boxes on their upstream ISP, or forcing them to log all traffic?
The second is more concerning: What if M247 is just a front, not really a network provider at all but really an intelligence operation, created specifically so that VPN provider owners would rent servers with them so the traffic could be analyzed? I heard from some other sources that M247 has been known to conduct shady deals, etc. What if the government is offering up these servers for dirt cheap to VPN providers purposefully, and that is why they are all using them?
Another fishy thing that concerns me is the number of false names that M247 VPN IP addresses are registered with, previously I noticed they were all registered under the name "M247 Ltd" , "M247 Europe SRL" , "M247 Miami/Phoenix/etc Infrastructure" , but recently I notice they are registering their IP addresses under completely false names that don't turn up any results on google, such as "Ppman Services SRL" , "Secure Data Systems SRL" , "Venus Business Communications Limited" , "UK Web Solutions Limited" , "FirstClassIT Solutions" , and a few others that I can't remember at the time. These IPs all use the M247's ASN (AS9009) , and under "Organization" it does say "M247 Ltd" , but "ISP" says those false names.
Another strange thing I noticed was that they even used "Cogent Communications" as one of the false names attatched to some of their IP addresses (however just like usual Organization was M247 and AS was 9009). If they are a regular legal company, how can they possibly be making up ISP names out of thin air and using them, as well as using the name of an already existing network provier, Cogent.
All these signs point to M247 conducting some less than kosher business, whatever that may be. I'm now very suspicious of connecting to VPN servers where the ISP is M247, for fear that they are some kind of government front/data collection firm/etc. Has anyone other than myself felt suspicious of M247 and thinks they are up to something? Or better yet, is there anyone who knows more about them than I do who is willing to shed some light on them?
- deleted 7y ago[deleted]
- serf 7y agoVPN organizations have a few characteristics i've noticed: 1) they're fairly cheap to run, so groups spin up from nowhere fast. 2) due to being cheap to run, they seem to gather industry newcomers with little experience who are seeking a low-hanging-fruit first project. 3) they have a quick business 'period'. They come fast and they go fast. Probably due to the low-experience and extreme competition in that sector. 4) they consolidate quickly into large groups, and those large groups are fairly fast to buy up smaller competition in an effort to control commodity price. >What if the government is offering up these servers for dirt cheap to VPN providers purposefully, and that is why they are all using them? I guess that's just dependent on the threat model you're abiding by. Most casual vpn-as-a-business isn't going to do much to protect from state level adversaries, anyway. The same phenomenon has happened in the US on the vpn market a few times now. I haven't checked recently, but a good chunk of exit structure was owned by London Trust Media last time I checked, a group that's affiliated with PIA and KAPE. I can appreciate the suspicion. I think that it's warranted; but personally i'm of the opinion that the market consolidation is more due to the nature of the product and the market that it exists within. Whether or not a state group is gaming that consolidation.. I would suspect yes, but hold no proof.
- MaupitiBlue 7y agoAre you trying to hide from the NSA, FBI, China, or Disney? If you’re a pirate, I wouldn’t worry. Likewise if you’re a Chinese dissident or tax cheat. The NSA isn’t going to blow its cover over Frozen 2 or your $3 million bitcoin wallet. Recent news accounts also suggest that the Feds are dismissing child porn cases rather than disclosing methods. That leaves espionage and terrorism. If you’re involved in those, maybe going cheap on a vpn isn’t best practices to begin with.
- na85 7y ago> The NSA isn’t going to blow its cover over Frozen 2 or your $3 million bitcoin wallet. Parallel construction means they don't have to. https://en.m.wikipedia.org/wiki/Parallel_construction https://en.m.wikipedia.org/wiki/Parallel_construction