AS215365 — Threatoff Tom Gewiese

AS215365 announces 16 IPv4 prefixes covering 5,376 addresses and 4 IPv6 prefixes.

About this network

THREATOFF is operated by Threatoff (Tom Gewiese).

What it's used for

• The address space carries VPN and proxy infrastructure, evidenced by reverse DNS entries for threatoff.eu and stealthsurf.network (including regional subdomains like de.stealthsurf.network and fi.stealthsurf.network).
• The AS announces 5,376 IPv4 addresses across 16 prefixes and 4 IPv6 prefixes, with only 1 observed neighbour, indicating a small-scale access or endpoint network rather than a transit provider.
• Traffic from this AS consists of VPN client connections and proxy endpoints, consistent with the operator's business of providing privacy-focused network services.

Notable

• All registrants for the largest prefixes are GHOSTnet GmbH, with netnames such as DE-GHOSTNET-20120911 and DE-GHOSTNET-20070413, indicating the address space was originally allocated to GHOSTnet GmbH before being announced by Threatoff.
• The address inventory is fragmented across multiple /23 and /24 blocks in the 5.231.0.0/16, 77.90.0.0/16, 85.93.0.0/16, 94.249.0.0/16, and 217.69.0.0/16 ranges, suggesting historical accumulation or leasing of disparate blocks.

This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy.

Announced prefixes

• 5.231.117.0/24
• 5.231.118.0/23
• 5.231.123.0/24
• 77.90.15.0/24
• 77.90.52.0/24
• 77.90.60.0/23
• 77.90.63.0/24
• 85.93.2.0/24
• 94.249.177.0/24
• 94.249.178.0/23
• 94.249.184.0/24
• 94.249.186.0/23
• 94.249.188.0/23
• 94.249.195.0/24
• 94.249.198.0/24
• 217.69.167.0/24
• 2a09:3f00:1007::/48
• 2a09:3f00:1008::/47
• 2a09:3f00:3000::/40
• 2a14:7c0:1000::/39

Upstream networks

• AS49581 Ferdinand Zink trading as Tube-Hosting

Adjacent networks

• AS49581 Ferdinand Zink trading as Tube-Hosting

Routing security

• RPKI: 29 valid, 0 invalid and 0 not-found announcements; 34 ROAs.
• ASPA: none published.
• IRR: 83% of announcements registered; 25 route objects.
• Listed in as-sets: AS-HURRICANEV6, AS-SCALEBLADE:AS-CUST, AS-TUBE, AS3216:AS-SKYLINK.