Aeza-linked networks now hold 21 times the IPv4 space of 2022, Qurium finds

Qurium's growth window opens at the end of 2022, when AEZA-AS (AS210644) announced 25 prefixes covering 6,400 addresses ^[1]. The 536 prefixes and roughly 135,000 addresses it counts now belong to Aeza International and NetCrafters together ^[2]. That is 21.4 times the prefix count and 21.1 times the address space ^[16][17]. OFAC's first designation, on 1 July 2025, falls 30 months into that window ^[3][19]. Qurium's text does not give the prefix count on that date or the split of the 536 between the two networks, so the growth cannot be divided into before and after the designation. Qurium says the expansion continued despite regulatory and law-enforcement pressure ^[15].

The pattern predates the sanctions. Qurium and EU DisinfoLab published their joint investigation into Aeza and the Doppelganger disinformation campaign in July 2024 ^[9]. DataCamp/DataPacket ended service to Aeza on 31 July, and by early August Combahton/Aurologic was its principal replacement upstream ^[8]. After the 1 July 2025 designations, a second round of OFAC sanctions identified Hypercore Ltd in the UK as an Aeza front company ^[4].

Company names are the weak key. Qurium says AS210644 is still registered as Aeza International Limited, the name of a designated entity, and still originates hundreds of prefixes ^[6][3]. Live routing data also holds numerous prefixes whose descriptions identify AEZA GROUP LLC, and NetCrafters OU, registered in Estonia, appears across infrastructure that Qurium traces back through earlier Aeza-associated networks ^[14]. Qurium's method is to follow autonomous systems, prefixes, routing relationships, upstreams and address registries, because infrastructure is less volatile than the legal entities built around it ^[18].

In our view the evidence shows that name-based lists fail here, and that a footprint counted across two networks needs more than one entity's entry. Qurium builds its own case on ASNs and prefixes, so the evidence does not point to the ASN as the weak key.

Aurologic's director, Joseph Hofmann, has repeatedly framed the relationship around the "precise legal identity" of the contracting customer, Qurium says, citing his posts on LowEndTalk ^[10]. Asked in July 2025 whether Aurologic would keep working with Aeza after the first designations, he said it would assess the situation with "our customer, which is not Aeza Group LLC" ^[11]. By November he said: "we don't have an active customer called 'Aeza'" ^[12]. As Qurium describes his position, serving a customer that is not itself sanctioned does not on its own amount to helping evade sanctions, even when the ASN and every network resource behind it are tied to a sanctioned entity ^[13].

The OFAC designations and the routing announcements are public ^[3][7]. The 536 count and the NetCrafters lineage are Qurium's analysis, and this account rests on Qurium's report alone ^[2][14].