0xTeles

Totally forgot to post about this, but after researching, I had suspicion that some of the netflow data from tzulo.com (AS11878) was being fed into Team Cymru's platform. A bunch of VPN providers, including Mullvad (22% of their servers!), ivpn and Windscribe were Tzulo clients at the time. After trying direct contact with Tzulo and getting a not-so-helpful response, I decided to reach out to the VPNs. Out of all of them, surprisingly @windscribe was the only one that took a closer look at it. They escalated it to Tzulo, who confirmed the culprit was Sharktech, their upstream provider (also mentioned in my initial research). Tzulo has since migrated away from them, but this confirms netflow data from some of these servers was indeed being captured before September 2025 (when Windscribe sent me this email). Hopefully this has contributed a bit to the privacy community. Kudos to @windscribe for caring and to @404mediaco for inspiring this research :)