German ISP aurologic GmbH Identified as Key Hub for Malicious Hosting Infrastructure

German hosting provider aurologic GmbH has emerged as a key hub within the global malicious infrastructure, acting as a primary upstream provider to multiple threat activity enablers and sanctioned entities and linking some of the internet’s most abusive networks, according to Insikt Group’s analysis.

The Langen-based ISP operates AS30823 and maintains upstream transit connections to numerous suspected threat actors, raising questions about infrastructure accountability. aurologic emerged in October 2023 after the Combahton GmbH fastpipe[.]io network transition, with the formal rebrand completed in November 2023, and runs its primary facility at Tornado Datacenter GmbH & Co. KG in Langen, Germany.

Joseph Maximilian Hofmann has headed both aurologic and Tornado Datacenter since September 2015, establishing a direct link between the two entities. The company has connections to Aeza Group LLC and other networks, and has been identified in Qurium’s Doppelgänger investigation as an upstream provider enabling Russia-linked infrastructure, including ties to WAIcore Hosting Ltd, Altawk, and Tnsecurity Ltd (EVILEMPIRE).

Its neutrality, alongside a high density of malicious activity as of September 2025, has been described as a factor underpinning a reactive abuse stance rather than proactive safeguards.