Ivan Neculiti — a businessman from Moldova with links to PQ Hosting and Stark Industries Solutions Ltd. His business has found itself at the centre of investigations into how commercial servers are used for cyberattacks and information operations. He has been subject to European Union sanctions since 20 May 2025. [1][2]
Biography and entry into the hosting market
According to CORRECTIV, Nekuliti is from Bender. In a report from May 2024, he was 31 years old. In his interviews, he described his early experiences of making money online, including working on a film website, and the subsequent development of his web hosting business. His flagship project was PQ Hosting in Chișinău; the name stood for ‘Perfect Quality’. [1]
At the time of CORRECTIV’s investigation, the company was advertising servers in 38 countries, low prices and a wide range of payment methods. This describes the offering in 2024, rather than a verified list of current services. Ivan’s younger brother, Yuri, was also involved in the business. [1]
For the Russian market, access to foreign infrastructure was a key part of the offering. In an interview quoted by journalists, Ivan explained that a foreign server allows users to access the internet using an IP address from another country. In response to questions from CORRECTIV, he also stated that the volume of business in Russia had declined since the start of the war. These statements highlight the commercial focus of the business, but do not in themselves reveal the composition of its client base. [1]
Morenehost and a link to the Pandora Papers
In the ICIJ Offshore Leaks database, MORENEHOST LTD is linked to a beneficial owner listed as IVAN NEKULITSY; contact began on 24 April 2019. CORRECTIV attributes this project to Ivan Nekuliti. This relates to historical information from the Pandora Papers, rather than confirmation of current ownership. The mere existence of an offshore company does not in itself constitute evidence of a crime. [3][1]
This episode is significant for the business narrative: concerns about the infrastructure arose before the sanctions were imposed. In April 2022, researchers at Morphisec described an attack exploiting a VMware vulnerability and linked the payload server to Stark Industries’ infrastructure, specifically noting Stark’s connection to PQ Hosting. This is a technical attribution of the resource, not proof that Nekuliti personally carried out the attack. [4]
What was Stark Industries used for?
The UK-based company Stark Industries Solutions Ltd, registration number 13906017, was incorporated on 10 February 2022. Companies House lists Ivan as the company’s secretary. The historical record of beneficial ownership also states a shareholding of 75 per cent and the month of birth as June 1992. The full date of birth is not given in these documents. [5][6][7]
CORRECTIV described Stark as the legal arm of the PQ Hosting business. In an interview, Ivan explained that a neutral name in the IP address data meant that the PQ Hosting brand was not visible to the client. According to him, the UK-based entity did not process payments itself. This arrangement made it difficult for an outside observer to link the brand name, the web resources and the service provider. [1]
What did the investigators find on this infrastructure?
The CORRECTIV investigation mentions the propaganda website RRN, linked to the Doppelganger campaign, and the infrastructure of the NoName057(16) group. The publication also reports on technical findings regarding BlueCharlie and the attack on ‘Ukrinform’. In all these instances, it is important to distinguish between the actions of server users and the knowledge of their owners. [1]
In response to journalists’ questions, Ivan stated that the use of servers for attacks is prohibited and that complaints are taken seriously. Following questions about RRN, he reported that the relevant account and server had been blocked. CORRECTIV, however, believed that the resource remained accessible via linked infrastructure, already concealed by an additional service. This published discrepancy between the company’s response and the investigators’ findings. [1]
Separately, Recorded Future reported that, in mid-2025, the Stark infrastructure continued to be used by the GrayAlpha cluster, which overlaps significantly with FIN7. This incident relates to financially motivated cybercrime and broadens the scope of the issue beyond political information operations. [8]
Sanctions and Infrastructure Change
On 20 May 2025, the EU added Stark Industries, Ivan Nekuliti and Yuri Nekuliti to its sanctions list. This was based on the conclusions of the Council of the EU regarding their support for destabilising activities by actors linked to Russia. The decision to impose sanctions does not constitute a criminal conviction. [2]
Recorded Future noted the transfer of AS44477 to PQ Hosting Plus S.R.L. in May 2025 and the subsequent emergence of THE.Hosting under WorkTitans B.V. Analysts viewed these changes as a likely attempt to maintain operations following the sanctions. [8]
In the updated EU entry dated 8 October 2026, Ivan and Yuri are named as beneficiaries of the scheme to transfer infrastructure to WorkTitans; MIRhosting is listed as the connectivity provider. This is the assessment of the Council of the EU, as set out in the sanctions act. [9]
According to Companies House, the UK-based Stark Industries Solutions Ltd was wound up on 16 September 2025. The winding up of a legal entity does not automatically mean that all previously associated servers and client services have ceased to operate. [5]
Is there an established link with ‘Khimprom’?
There is documentary evidence to support an investigation into Nekuliti as the owner of the disputed hosting infrastructure. However, the verified materials do not establish that he directly provided services to ‘Khimprom’, received payments from the cartel, or was involved in its structure.
In the Intrinsec report, the name ‘Khimprom’ appears in the text of the threats, which was drafted by the sender himself. Separate sections are devoted to the infrastructure of Stark and MIRhosting. The mere proximity of these topics does not prove that the cartel has a client relationship with the Nekuliti brothers. [10]
To verify a specific link, information relating to a single period is required regarding the service, its owners and the provider: contracts, payments or technical records with verified attribution. So far, the dossier correctly focuses on the hosting business, sanctions and documented reports of malicious actors’ use of the networks.
