{"id":6852,"date":"2025-09-12T03:03:30","date_gmt":"2025-09-12T03:03:30","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/12\/bulletproof-host-stark-industries-evades-eu-sanctions\/"},"modified":"2025-09-12T03:03:30","modified_gmt":"2025-09-12T03:03:30","slug":"bulletproof-host-stark-industries-evades-eu-sanctions","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/12\/bulletproof-host-stark-industries-evades-eu-sanctions\/","title":{"rendered":"Bulletproof Host Stark Industries Evades EU Sanctions"},"content":{"rendered":"

Bulletproof Host Stark Industries Evades EU Sanctions
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

In May 2025, the European Union levied financial sanctions on the owners of\u00a0Stark Industries Solutions Ltd.<\/strong>, a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new findings show those sanctions have done little to stop Stark from simply rebranding and transferring their assets to other corporate entities controlled by its original hosting providers.<\/p>\n

\n\"\"<\/p>\n

Image: Shutterstock.<\/p>\n<\/div>\n

Materializing just two weeks before Russia invaded Ukraine in 2022, Stark Industries Solutions became a frequent source of massive DDoS attacks, Russian-language proxy and VPN services, malware tied to Russia-backed hacking groups, and fake news. ISPs like Stark are called \u201cbulletproof\u201d providers when they cultivate a reputation for ignoring any abuse complaints or police inquiries about activity on their networks.<\/p>\n

In May 2025, the European Union sanctioned<\/a> one of Stark\u2019s two main conduits to the larger Internet \u2014 Moldova-based PQ Hosting<\/strong> \u2014 as well as the company\u2019s Moldovan owners Yuri<\/strong> and Ivan Neculiti<\/strong>. The EU Commission said the Neculiti brothers and PQ Hosting were linked to Russia\u2019s hybrid warfare efforts.<\/p>\n

But a new report<\/a> from Recorded Future<\/strong> finds that just prior to the sanctions being announced, Stark rebranded to\u00a0the[.]hosting<\/strong>, under control of the Dutch entity WorkTitans BV<\/strong>\u00a0(AS209847) on June 24, 2025. The Neculiti brothers reportedly got a heads up roughly 12 days before the sanctions were announced, when Moldovan and EU media reported on the forthcoming inclusion of the Neculiti brothers in the sanctions package.<\/p>\n

In response, the Neculiti brothers moved much of Stark\u2019s considerable address space and other resources over to a new company in Moldova called PQ Hosting Plus S.R.L<\/strong>., an entity reportedly connected to the Neculiti brothers thanks to the re-use of a phone number<\/a> from the original PQ Hosting.<\/p>\n

\u201cAlthough the majority of associated infrastructure remains attributable to Stark Industries, these changes likely reflect an attempt to obfuscate ownership and sustain hosting services under new legal and network entities,\u201d Recorded Future observed.<\/p>\n

Neither the Recorded Future report nor the May 2025 sanctions from the EU mentioned a second critical pillar of Stark\u2019s network that KrebsOnSecurity identified in a May 2024 profile on the notorious bulletproof hoster<\/a>: The Netherlands-based hosting provider MIRhosting<\/strong>.<\/p>\n

MIRhosting is operated by 38-year old Andrey Nesterenko<\/strong>, whose personal website<\/a> says he is an accomplished concert pianist who began performing publicly at a young age. DomainTools<\/strong> says mirhosting[.]com is registered to Mr. Nesterenko and to Innovation IT Solutions Corp<\/strong>, which lists addresses in London and in Nesterenko\u2019s stated hometown of Nizhny Novgorod, Russia.<\/p>\n

\n\"\"<\/p>\n

Image credit: correctiv.org.<\/p>\n<\/div>\n

According to the book Inside Cyber Warfare<\/em> by Jeffrey Carr, Innovation IT Solutions Corp. was responsible for hosting StopGeorgia[.]ru<\/strong>, a hacktivist website for organizing cyberattacks against Georgia that appeared at the same time Russian forces invaded the former Soviet nation in 2008. That conflict was thought to be the first war ever fought in which a notable cyberattack and an actual military engagement happened simultaneously.<\/p>\n

Mr. Nesterenko did not respond to requests for comment. In May 2024, Mr. Nesterenko said<\/a> he couldn\u2019t verify whether StopGeorgia was ever a customer because they didn\u2019t keep records going back that far. But he maintained that Stark Industries Solutions was merely one client of many, and claimed MIRhosting had not received any actionable complaints about abuse on Stark.<\/p>\n

However, it appears that MIRhosting is once again the new home of Stark Industries, and that MIRhosting employees are managing both the[.]hosting and WorkTitans \u2014 the primary beneficiaries of Stark\u2019s assets.<\/p>\n

A copy of the incorporation documents for WorkTitans BV obtained from the Dutch Chamber of Commerce shows WorkTitans also does business under the names Misfits Media<\/strong> and and WT Hosting<\/strong> (considering Stark\u2019s historical connection to Russian disinformation websites, \u201cMisfits Media\u201d is a bit on the nose).<\/span><\/p>\n

\n\"\"<\/p>\n

An incorporation document for WorkTitans B.V. from the Netherlands Chamber of Commerce.<\/p>\n<\/div>\n

The incorporation document says the company was formed in 2019 by a y.zinad@worktitans.nl<\/strong>. That email address corresponds to a LinkedIn account<\/a> for a Youssef Zinad<\/strong>, who says their personal websites are worktitans[.]nl and custom-solution[.]nl. The profile also links to a website (etripleasims dot nl) that LinkedIn currently blocks as malicious. All of these websites are or were hosted at MIRhosting.<\/p>\n

Although Mr. Zinad\u2019s LinkedIn profile does not mention any employment at MIRhosting, virtually all of his LinkedIn posts over the past year have been reposts of advertisements for MIRhosting\u2019s services.<\/p>\n

\n\"\"<\/p>\n

Mr. Zinad\u2019s LinkedIn profile is full of posts for MIRhosting\u2019s services.<\/p>\n<\/div>\n

A Google search for Youssef Zinad reveals multiple startup-tracking websites that list him as the founder of the[.]hosting, which censys.io<\/strong> finds is hosted by PQ Hosting Plus S.R.L<\/strong>.<\/p>\n

The Dutch Chamber of Commerce document says WorkTitans\u2019 sole shareholder is a company in Almere, Netherlands called Fezzy B.V. <\/strong>Who runs Fezzy? The phone number listed in a Google search for Fezzy B.V. \u2014 31651079755<\/strong> \u2014 also was used to register a Facebook<\/strong> profile for a Youssef Zinad from the same town, according to the breach tracking service Constella Intelligence<\/strong>.<\/p>\n

In a series of email exchanges leading up to KrebsOnSecurity\u2019s May 2024 deep dive on Stark<\/a>, Mr. Nesterenko included Mr. Zinad in the message thread (youssef@mirhosting.com), referring to him as part of the company\u2019s legal team. The Dutch website stagemarkt[.]nl lists Youssef Zinad as an official contact for MIRhosting\u2019s offices in Almere. Mr. Zinad did not respond to requests for comment.<\/p>\n

\"\"<\/p>\n

Given the above, it is difficult to argue with the Recorded Future report on Stark\u2019s rebranding, which concluded that \u201cthe EU\u2019s sanctioning of Stark Industries was largely ineffective, as affiliated infrastructure remained operational and services were rapidly re-established under new branding, with no significant or lasting disruption.\u201d<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n BrianKrebs
\n \t

\n
<\/BR>
\nGo to krebsonsecurity<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Bulletproof Host Stark Industries Evades EU Sanctions In May 2025, the European Union levied financial sanctions on the owners of\u00a0Stark Industries Solutions Ltd., a bulletproof hosting provider that materialized two weeks before Russia invaded Ukraine and quickly became a top source of Kremlin-linked cyberattacks and disinformation campaigns. But new findings show those sanctions have done […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[188,1828,1829,440,1355,55,206,1830,1831,190,381,1832,1833,369,992,1834,1835,1836,1358],"tags":[72],"class_list":["post-6852","post","type-post","status-publish","format-standard","hentry","category-a-little-sunshine","category-andrey-nesterenko","category-as209847","category-domaintools","category-ivan-neculiti","category-krebsonsecurity","category-latest-warnings","category-mirhosting","category-misfits-media","category-neer-do-well-news","category-pq-hosting","category-pq-hosting-plus-s-r-l","category-recorded-future","category-russias-war-on-ukraine","category-stark-industries-solutions-ltd","category-worktitans-b-v","category-wt-hosting","category-youssef-zinad","category-yuri-neculiti","tag-krebsonsecurity"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6852"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6852"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6852\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}