AS9009 — M247 Europe SRL

AS9009, operated by M247 Europe SRL, is hosting space that is heavily used for anonymization. Of the 1,057 addresses we have observed on it, 91% are VPN endpoints. An address arriving from this network usually says where a tunnel ends, not where the person behind it is.

994 of the 1,057 observed addresses (94%) carried a notable risk score of 40 or higher when last checked. That concentration is the network's defining feature: it does not mean any individual visitor is hostile, but it does mean this network's addresses start from a lower trust position than ordinary hosting space.

Addresses on this network have been looked up through Predax between February 10, 2026 and August 31, 2026. Each figure on this page reflects an address's most recent check, not a permanent record.

Geographically, the observed addresses span 54 countries, with the largest share (476 of 1,057) geolocating to United States.

A footprint that wide usually means globally distributed infrastructure — the same operator announcing address space from many regions — rather than a network serving one local population.

Screening traffic from this network is a defensible default for checkout, login and signup flows: the anonymization share is high enough that an address here tells you little about who is actually connecting.

It is still worth screening by score rather than blocking the whole network — VPN use is mainstream, and a blanket network block also turns away the privacy-conscious customers routing through it. A challenge (CAPTCHA or verification) keeps them while stopping most automation.

Doing that screening by hand is not practical — addresses on networks like M247 Europe SRL (AS9009) rotate constantly. The Predax Security plugin for WordPress applies exactly the score-based challenge described above to every visit, and the WooCommerce version runs the same check at checkout, before a payment is attempted.