The Gray Space: Russian-Linked Proxy and Hosting Infrastructure in Estonia

2011: Fineproxy starts operating through Region40 LLC in Kaluga, Russia (per Qurium, 2023).

15 September 2016: QualityNetwork OÜ is registered in Estonia, with Ilia Trusov on its management board (e-Äriregister).

August 2018 and August 2019: Qurium traces DDoS attacks on Azerbaijani media and a human-rights site to Fineproxy (section 04).

2019: Trusov registers two Wyoming LLCs, Security Servers and Traffictransitsolution (Reuters). Both have since been dissolved; the Wyoming register shows Traffictransitsolution administratively dissolved in 2022.

Early February 2022: per Qurium, the operation at UGB Hosting in Narva "was abruptly canceled" and the networks moved to other providers, including King Servers B.V.

30 October 2023: DDoS attack on Rappler; Qurium traces the data-center share of the traffic to Fineproxy and Rayobyte infrastructure. December 2023: Reuters publishes its interview-based report on Trusov.

11 March 2024: UGB Hosting OÜ is liquidated (e-Äriregister).

September 2026: QualityNetwork OÜ becomes a RIPE LIR and is allocated the prefixes listed above.

This paper covers two kinds of Estonian-registered network infrastructure. The first is a commercial proxy service: Fineproxy sells access to large pools of proxy IP addresses, which Qurium has repeatedly found in DDoS traffic. The second is hosting advertised as "bulletproof", meaning a provider that promises in underground forums to ignore abuse complaints and resist takedowns.

A documented example of the second kind is the 2009–2015 bulletproof hosting scheme run by Aleksandr Grichishkin and others, which included an Estonian defendant, Pavel Stassi (sentenced in the United States in 2021).

Rayobyte, a US proxy provider, appears below only because Qurium traced part of the Rappler attack traffic to it. It has no Estonian link.

Reuters describes Ilia Trusov as a Russian IT entrepreneur. Per Qurium, Fineproxy began in 2011 under Region40 LLC in Kaluga and later traded through QualityNetwork OÜ, registered in Estonia in 2016 with Trusov on its board. fineproxy.org now names Quality Network US LLC in Wyoming and QualityNetwork OU in Tallinn as its operators.

According to Reuters, Trusov said he set up the Wyoming companies to make his clients' web traffic appear American and to help with "fielding legal requests". He denied tolerating cybercrime and said he "often worked with police agencies". Reuters reported that researchers had traced waves of intrusions and spam to his proxy service in 2017 and that, "despite the public exposure", he registered two Wyoming LLCs, Security Servers and Traffictransitsolution, in 2019; both have since been dissolved. Quality Network US LLC uses the same registered-agent address.

Qurium's reports describe what made the network useful: RIPE objects that Qurium found declared countries the prefixes were not routed from. Geolocation databases such as MaxMind trusted those entries, so, in Qurium's words, "Fineproxy sold proxies from dozens of countries while all the traffic was sourced from Narva, Estonia." That Narva operation, at UGB Hosting, ended in February 2022 per Qurium, and the networks moved to providers including King Servers B.V.; AS14576, which Qurium's 2023 table lists as "HOSTING-SOLUTIONS (EE) | Kingservers", is registered with ARIN to Hosting Solution Ltd. (Anguilla). UGB Hosting OÜ was liquidated in March 2024.

Azerbaijan, 4 August 2018. Qurium's report of 6 August 2018 describes DDoS attacks on the Azerbaijani outlets gununsesi.info and azadliq.info and says the attack was "traced back… to a Proxy Service known as fineproxy.org, registered in the name of QualityNetwork OÜ in Estonia". Qurium found that the prefixes of AS200557 (Region40 LLC) were routed by Rostelecom (AS12389) or AS50896; that passage calls AS50896 Megafon, while elsewhere the same report attributes AS50896 to Trusov. Prefixes announced from UGB Hosting (AS206485) via Telia carried foreign countries such as France in RIPE, while latency placed them in Estonia. Qurium wrote that it is "difficult to know who might be paying" for the attacks, and noted that test queries came from Azerbaijan and that attack traffic came from a network hosting Azerbaijani government institutions.

Azerbaijan, from 18 August 2019. Qurium's report of 30 October 2019 describes a DDoS attack on Humanrightsclub.net after it published an article on companies linked to the president of SOCAR, Azerbaijan's state oil company. Per Qurium, the attacks lasted hours over several days, with millions of requests proxied through more than 1,000 Fineproxy IP addresses.

Philippines, 30 October 2023. Qurium analysed a DDoS attack on the news outlet Rappler. Most requests came from residential or mobile connections, but "we could identify 10% of the IP addresses originated from data centers", and Qurium traced that data-center traffic to the infrastructure of two proxy providers, Fineproxy and Rayobyte. For Fineproxy, its table lists AS35624 Silverstar Invest Limited and AS35830 BTT Group Finance as "Partner and IP Provider", and AS51765 Oy Crea Nova Hosting Solution Ltd, AS26548 PureVoltage and AS14576 HOSTING-SOLUTIONS (EE) as "Hosting Provider". In 2023 Qurium named Sprious LLC as Rayobyte's operator; Rayobyte's site now gives Rayobyte, LLC, of Lincoln, Nebraska.

The same report says Qurium "has since 2018 mitigated and documented dozens of denial of service attacks launched from FineProxy's infrastructure". Qurium's May 2026 report on residential proxies still lists Fine Proxy among attack sources.

Vault Dweller OÜ was registered in Tallinn on 1 July 2019 with €2,500 share capital and the activity code EMTAK 63102 (data processing). It held AS203834, created on 19 July 2022. An anonymous, self-published profile by the Reno Project lists a service called DEDBROPRO under the label "BPH-02 / Estonia Reg / No Sanctions" and connects it to that ASN. The profile itself says that no named individual was identified and that no major security vendor has published an assessment.

The malware documented for the ASN is remote-access trojans and stealers (Remcos, SectopRAT, DCRat, Rhadamanthys, Lumma), not ransomware. ThreatFox shows 307 observed IOCs for AS203834; its 23 tagged sightings run from 16 October 2024 to 30 May 2025, with none in the past twelve months. The Reno profile gives the upstream as Belcloud (AS44901, Bulgaria) and says the specific facility is unconfirmed. It also reports a forum advertisement in March 2026, which could not be checked because the forum requires a login.

As of 3 October 2026, AS203834 has been withdrawn: the RIPE Database has no aut-num object for it and RIPEstat shows no holder. e-Äriregister shows that a notice on the deletion of Vault Dweller OÜ has been published in Ametlikud Teadaanded. No source reviewed links the company's registered owner to the advertised service, so the owner is not named here.

These two cases illustrate a pattern: the company is registered in Estonia, while the routing, hardware or people are elsewhere. Estonia makes the first step easy. A company can be founded and run remotely, including through e-Residency, and an Estonian company can join the RIPE NCC and receive IP addresses in its own name. Narva, on the Russian border, hosted the UGB operation until 2022.

The state's tools are limited. The business register can delete a company, the stage Vault Dweller OÜ has reached, but it does not check what a company's network is used for. CERT-EE, part of RIA, handles incident reports, and NIS2 obligations depend on a provider's sector and size, so a small hosting or proxy company may fall outside them. The Internal Security Service (KAPO) described the same shell pattern in another field in its 2025–2026 yearbook: Estonian-registered companies that do not actually operate here, used for Russian military procurement.

Searches for this paper found no 2024–2026 sanctions or enforcement action against Trusov, QualityNetwork OÜ, Kingservers or Vault Dweller OÜ, and no change to RIPE policy on geolocation data or geofeeds.

Bulletproof hosting is now a sanctions target. The EU listed Stark Industries on 20 May 2025; per Recorded Future, the company moved its assets before the listing took effect. On 13 July 2026 the EU listed Media Land, ML.Cloud and Volosovik. The US, UK and Australia sanctioned Zservers (February 2025), Aeza (July 2025) and Media Land (November 2025).

Estonian-registered hosting also appears in recent DDoS reporting: per Recorded Future (November 2025), AS62005, Blue VPS OÜ, hosted about 3% of the top-tier command-server IP space of NoName057(16)'s DDoSia project. Between 14 and 17 July 2025, Operation Eastwood, coordinated by Europol and Eurojust, disrupted more than a hundred of the group's systems worldwide, took most of its central servers offline and led to seven arrest warrants; Estonia was among the countries that supported the investigation. The attacks did not stop: RIA registered a record 756 DDoS attacks against Estonia in 2025, over a third more than in 2024, of which 95 (12.5%) had any effect on the targeted service.

Russian state groups use rented and proxied infrastructure to hide where they operate from. APT28, attributed to the GRU's 85th Main Special Service Center (military unit 26165), has been active since at least 2004 (MITRE ATT&CK G0007). Joint advisory AA25-141A (May 2025), co-signed by Estonia's Foreign Intelligence Service and NCSC-EE, documents unit 26165 proxying "via devices with geolocation in proximity to the target". Microsoft reported in January 2024 that Midnight Blizzard (APT29) used residential proxy networks.

None of the sources reviewed links Trusov, his companies or Vault Dweller OÜ to a named Russian state campaign. The documented operations are DDoS and spam, politically targeted in some cases, and command servers for commodity malware.

Over-attributing commercial infrastructure to state units weakens the signal and hides the regulatory question: how to deal with providers whose services are used as DDoS platforms for hire, without having to prove state sponsorship.

Use dated indicators, not company names. As of 3 October 2026: 185.46.84.0/22 was first seen in routing in March 2014 and is announced by AS35624, with a RIPE route object for that origin dating from April 2021. AS203834 is no longer announced, and its ThreatFox sightings end in May 2025. AS200557, Region40's ASN in Qurium's 2018 and 2019 reports, has been reassigned to an unrelated Australian holder; a block list that still names it will hit the wrong network.

Check declared locations against measurements. Compare the country in RIPE objects or geofeeds with round-trip times measured from probes near the claimed location and with the upstream AS path. This is how Qurium showed that "French" prefixes were in Estonia. Prefixes whose declared country cannot be reconciled with latency or routing should trigger automated scrutiny.

Report abuse to the network's abuse contact and to CERT-EE. Prompt reports shorten the operational life of gray-space infrastructure.

Separate cybercrime from state operations. The supply chain for DDoS, malware and espionage infrastructure overlaps in the gray zone. Calibrate the response to observed behavior, not assumed sponsorship.