VPNLab

» see vpnlab.net as it lived, on the wayback machine

~ the obituary ~

A VPN in Turkey means something ordinary. Twitter went dark in March 2014 and Wikipedia was blocked from April 2017 until January 2020, and across those years installing one was something people did on a phone without thinking of it as a technical act. VPNLab sold the same protocol for a different job entirely.

It started in 2008 and its pitch was plain: OpenVPN access with 2048-bit keys for sixty dollars a year, paid in WebMoney or Bitcoin. There was a DoubleVPN tier at 129 dollars that routed you through two hops instead of one. None of that is unusual. What decides the character of the business is where it advertised, and it advertised on dark web forums.

The product was unremarkable on purpose. Nothing about the encryption was special and nothing about the server list was clever. What made it worth paying for was who else was already using it and what the operators did not keep.

~ the case file ~

~ what it sold ~

Investigators kept running into the same domain. Malware distribution came first, and then the infrastructure ransomware crews used to talk among themselves while an attack was being set up. When one address turns up across unrelated cases in unrelated countries, it stops looking like a coincidence and starts looking like a supplier.

Reporting at the time put the service behind at least 150 ransomware attacks, with losses over 60 million euros. Those figures came from law enforcement rather than from an audit, and they read better as an order of magnitude than as a number.

~ the day it died ~

On 17 January 2022 ten countries moved at once, coordinated through Europol. The list of forces taking part ran to Germany, the Netherlands, Canada, the Czech Republic, France, Hungary, Latvia, Ukraine, the United States and the United Kingdom. Fifteen servers came off the network in a single morning and vpnlab.net answered with a seizure banner carrying the crests of the agencies.

Nobody was arrested. The operators were never publicly named, which sets this apart from the darknet market takedowns of the same period, where the ending is usually a person and a sentence measured in years. Here the ending was purely infrastructural. The company was not prosecuted, it was switched off.

~ what the servers gave up ~

The seized machines held customer data, and that mattered more than the shutdown did. Europol used what was on them to warn more than a hundred companies that an attack against them was already under way or about to begin. A service sold on the promise of keeping nothing became, the morning it was taken, the best available source on its own customers.

The action followed the pattern set by Safe-Inet and Insorg in December 2020, and the pattern has held since. In 2026 vpnlab.net does not answer at all. Even the seizure banner is gone, which is the last stage of this kind of death: first the service, then the notice that the service was taken.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »