FLASH
Shkruar nga Pamfleti
The Tirana Prosecutor's Office has officially confirmed that it has communicated with "internet companies" to identify the end users of the two IPs that led to the extortion of 50 million euros. No provider name has been made public. The pamphlet has verified the technical infrastructure and raises questions that Albanian officials are avoiding
On April 13, 2026, the Tirana Prosecution Office raided three call centers in the capital and arrested ten people in the operation that uncovered a 50 million euro fraud against European Union citizens. The Prosecution’s official announcement on criminal proceedings no. 3377 contains a technical detail of great investigative weight: investigators “from official communications with internet companies in Albania discovered the end users of these IPs, which have been operational since at least November 2023.” Although 26 million euros were extorted from only 150 Austrian victims through these lines, none of these internet companies have been publicly named in the three weeks following the operation.
The institutional silence on the identity of the provider makes sense according to investigative secrecy, but does not eliminate the journalistic obligation to ask the question that is missing from official communications. The Albanian internet market is dominated by five main operators: Albtelecom, One Albania, Digicom, Abissnet sh.a. and several smaller regional operators.
Which of them had an active contract with the six front companies identified by the Prosecution; “IOTA Network”, “Victory Communication”, “Espiron Studio”, “Zeta Studio”, “Upstream Creative” and “Koppa Network”; as well as with the shell entities of the intermediary Eduard Dalla, who created internet contracts in the name of the fictitious person “Jose Santos”? To this day, the answer remains strictly in the investigative file.
Pamphlet has conducted a technical verification on the public databases of Hurricane Electric BGP Toolkit and RIPE NCC, the regional Internet registrar for Europe. According to this data, Abissnet sh.a. operates with two autonomous system numbers (AS35047 and AS207368) and owns seven main IPv4 blocks with about 18,432 public addresses in total. One of these blocks, 185.9.44.0/24, is explicitly labeled “Abissnet Business Customers” — precisely the segment that offers static IPs to business clients, a must-have product for any professional call center. The data is accessible and verifiable by anyone in real time. The technical question that remains for the Tirana Prosecutor’s Office alone is: do the two suspicious IPs identified by the Austrian authorities belong to Abissnet’s blocks or to the blocks of another provider?
A critical part of the Tirana Prosecutor's Office file identifies Eduard Dalla, 48, as an "intermediary between call centers and various internet service providers." The prosecution confirms that Dalla "concluded internet contracts in the name of his fictitious companies registered with the Central Bank, to make identification through IPs more difficult."
The detail that sparked the investigation: Eduard Dalla's personal phone number was registered in "an internet contract in the name of the fictitious person Jose Santos." This data raises two inevitable questions: which Albanian ISP issued a contract in the name of a fictitious person without verifying the identity, and which ISP billed a marketing consultancy every month for internet traffic suitable for 100 to 450 workstations?
Sources close to the investigation indicate that the main company that could have provided internet service to most of the call centers affected by the April 13 operation is Abissnet sh.a. , one of the oldest operators in the Albanian internet market, historically linked to the figure of businessman and former socialist MP Koço Kokëdhima.
This information awaits official confirmation or denial. Did the company have active internet service contracts with the six entities identified by the Prosecution as call center fronts; did it have contracts with Eduard Dalla or with companies administered by him; was it officially contacted by the Tirana Prosecution or the Cybercrime Directorate; and what verification procedures does it apply to business clients requesting static IPs.
The applicable legal framework sets out specific obligations for providers. Law No. 9918/2008 “On electronic communications in the Republic of Albania” and AKEP Regulation No. 47/2017 require providers to identify their subscribers, but do not oblige them to verify the real nature of the activity beyond the regular documentation of the Central Bank.
Formally, when Eduard Dalla presented himself with a valid NIPT and a lease agreement, the internet provider had no legal obligation to check whether 50 or 100 workstations were operating inside the office. However, good commercial practices and AKEP's own regulations on network security require reporting to the authorities when a subscriber's traffic is abnormal for the declared type of activity.
The question that remains for AKEP: has any Albanian ISP filed a suspicious activity report regarding these extortion call centers and, if not, why not?
The title question is not an accusation. The question is the first step of an investigative exercise that should be officially addressed to the Tirana Prosecutor's Office, AKEP and the current directors of Abissnet sh.a. /Pamphlet
Ikni naten me hene nga pordhshteti i pordhkriminelave ...sa me larg aq me mire
Nuk besoj se jane bashkefajtore ISP-te! Ato internetin kane produktin qe shesin. Kuptohet, nese prokroria kerkon te dhena per IP-te qe jane perdorur, ISP duhet te jete bashkepunuese.
E ç’rëndësi ka kjo se kush i furnizoi me internet. Është njësoj si të furnizosh me karburant, një krimimel që nuk e njeh. Rëndësi ka se kush i liçensoi ? A duhen lipensuar ? A duhet të vazjdojnë të punojnë call center ? Pse duhet të vazjdojnë ? Italia i ka mbyllur për shëmbull. Ok nderuar Zef ?