Kremlin masking in action: provider FoxCloud creates a “clean” European facade for Russian propagandists

In the United Kingdom, a company is registered that, by all appearances, should have been lost among hundreds of similar entities. But FOXCLOUD LLP is not such a case.

According, to Antikor, the main thing that sets it apart from other firms providing hosting services is that this company, with an office in Watford, minimal public activity, and a strange digital footprint, keeps popping up alongside Russian propaganda resources, technical circumvention of sanctions, and infrastructure that, in theory, should not exist in the EU at this time.

FOXCLOUD positions itself as a «business provider»: on their website, one can easily order VPS hosting, a dedicated server, or a dedicated IP; they promise DDoS protection, technical domains, and 24/7 support, while actively serving clients from the Russian-speaking space.

 

There would be nothing unusual about this if it weren’t for a number of nuances. FOXCLOUD LLP was registered on December 10, 2013, in the United Kingdom (number OC389771), with the address Office 181, Regico Offices, 153 The High Street Parade, Watford WD17 1NA. According to public records, it is a micro-company with a balance of less than £200,000 and fewer than 10 employees.

 

According to the Persons with Significant Control (PSC) data, the company is owned by two individuals—Alexander Basunov and Tamara Basunova, listed as residing in Moldova. In other words, the legal «British shield» covers a company that is not run by British citizens but by individuals from Moldova, which significantly reduces transparency and raises suspicions about the structure.

 

However, the beneficiaries of a British company from Moldova are not yet proof that the firm is suspicious. That would be the case if it weren’t for a combination of further data. The FOXCLOUD LLP profile on Crunchbase reports that the company has a completely different owner: listed as co-founder and CEO is Moustafa Attayyib.

 

There is very little information about him—Crunchbase itself provides the following: «Moustafa Attayyib is the CEO and co-founder of FoxCloud. Previously, he worked as a business consultant at ProInt. Moustafa Attayyib graduated from Alexandria University.» It also includes a link to Moustafa Attayyib’s LinkedIn profile, which suggests that for the past five years, he has been «self-employed.» And he resides in Malta. There is no mention of his involvement in any capacity with FOXCLOUD LLP.

 

In other words, the publicly declared owner is one person; official registers list different individuals, and the supposed «CEO and co-owner» seems unaware of his job or ownership of the company. This looks not just strange but like a classic scheme of concealment: the real operators, owners, and founders hide behind pseudonyms, shell legal entities, and gray administrative personnel.

Crunchbase describes Foxcloud as a company providing «IT solutions, including hosting services, domain setup, CMS password recovery, and photovoltaic installation monitoring.» But its public financial balance is extremely modest, with minimal turnover. 

If this is a legitimate, «white» business—why does everything look as though someone is deliberately hiding activity and the ultimate beneficiaries? What is FOXCLOUD really doing?

Romanian Trace

Almost all of FOXCLOUD’s digital activity indicates that the legal British shell is purely a facade. Checking DNS records, IP ranges, and subnets (using public tools like SecurityTrails and WhoisXML) reveals that a significant portion of FOXCLOUD’s infrastructure is hosted in Romanian data centers; network ranges are linked to providers in Bucharest and Cluj-Napoca; technical support responds with time zones and delays typical of Eastern European operators.

Why Romania? The answer is simple—this country has long been a popular hosting hub for companies targeting markets of the former USSR. It has lax regulations, cheap servers, and no one particularly asks who you are renting space or equipment for and why.

For Russian clients, Romania has become an ideal compromise between accessibility, speed, and relative safety from sanctions. Romania is one of the hubs for Russian websites fleeing Latvia and Germany after blockades. And FOXCLOUD is a typical representative of this «second line» of hosting.

It is here, not in the UK, that FOXCLOUD carries out 95% of its technical activities. British form—Romanian content—Russian clients. A perfect formula for those who have something to hide.

REN TV and Other Propagandists

The most interesting part begins when you look at who uses FOXCLOUD’s services.

Through their infrastructure have passed: mirrors and CDN nodes associated with the REN TV group; temporary copies of propaganda sites; intermediary sites funneling traffic to Russian state media; auxiliary domains for Russian media; technical bypass channels enabling content delivery to the EU; «disposable» landing pages that appear during DDoS attacks on Russian propaganda resources and disappear within a day.

In other words, FOXCLOUD provides European infrastructure to make Russian propaganda appear «clean» and «legitimate.» These are not official websites. This is the technical underpinning—a network of duplicates, proxies, and caching nodes that Russian media have used for years to bypass EU blockades.

If the main site is shut down, these mirrors come into play. And here, FOXCLOUD becomes very useful: British registration reduces suspicion, while the Romanian «quiet harbor» allows turning a blind eye to content.

Network and Infrastructure

The main «instrumental clue»—FOXCLOUD operates its own Autonomous System Number (AS)—AS200904. According to information from bgp.tools / bgp.he.net, this AS announces 16 IPv4 prefixes and serves about 4096 IPv4 addresses. Upstream providers for AS200904 include major international channels like Cogent Communications, LLC, Serverius Holding B.V., GTT Communications Inc., and DDOS-GUARD LTD. 

All of this indicates a full-fledged data center / reseller / hosting provider capable of offering virtual and physical servers, IP leasing, and transit. In other words, under the British banner, FOXCLOUD operates a real technical infrastructure with European IPs, access to the global internet, and hosting capabilities—including websites, streaming, CDN nodes, proxies, and more.

Interestingly, one of the IP addresses belonging to FOXCLOUD—194.156.65.65—is registered in Tiraspol. Although officially this is Moldova, where the nominal owners of the company originate, Tiraspol is actually the capital of the so-called Transnistrian Moldovan Republic, created and supported by Russia with Russian bayonets. This is unambiguously indicated by the host address: mail.tiras.ru. And the nationalities of FOXCLOUD’s «owners» also seem to hint at this.

 

Another IP address—185.92.73.115—is listed in the AbuseIPDB public complaint database for abuse. From 2023 to 2024, dozens of complaints were filed against it: brute-force attempts, unauthorized access attempts, VPN login attempts, port scanning, and more. The hostname of this IP—nl-isp-8.foxcloud.net—directly points to the head of the FOXCLOUD network.

 

In other words, a significant portion of the network activity originating from FOXCLOUD is marked as «abusive»: attacks, hacks, misuse. And misuse on a hosting network is often linked to «shadow» content: mirrors, piracy, streams, proxies, VPNs, bypasses of blockades, and so on.

Thus, in summary, we have a whole set of factors that ambiguously indicate that FOXCLOUD is not just a hoster. It is an infrastructural shield for Russian propaganda under a European mask.

FOXCLOUD is officially registered in the UK but is effectively managed by individuals from Moldova with a «gray» reputation in the media market. Another «owner,» whether from Egypt or Malta, most likely does not even suspect their role.

The actual network—AS200904—is a full-fledged server structure with thousands of IPs for lease, upstream channels, and the ability to provide VPS, CDN, transit—everything needed for media networks, IPTV projects, mirrors.

Some IPs have dozens of complaints for brute-force attacks, VPN logins, which is typical for «dark» platforms: streaming, torrents, proxies, spam, content promotion.

Public statements and real owners and structure do not match, which is typical for «shells» designed to hide true origins and control.

With high probability, it can be asserted: FOXCLOUD is not an ordinary hosting provider but a shadow provider convenient for those who want to spread propaganda, content, bypass sanctions and blockades while maintaining a «European» facade.

And if someone doubts, saying, «there is no direct evidence that REN TV or other Russian media are officially hosted by them,» that is exactly the point: the «intermediary» is built through mirrors, subdomains, short-term leases. Such chains are almost impossible to trace publicly without access to logs, payments, or contracts.

Joshua Fenwick