LeakySensey is based in Russia

Assessment

This attribution is well-supported by multiple independent artifacts recovered from the exposed server: Russian-language code comments, configuration files, and AI prompts; a Russian-language public storefront; and evidence the operator actively researched circumventing Russia's own TSPU and deep-packet-inspection censorship systems, which would be a distinctive interest for someone operating from within Russia specifically. However, the server itself was hosted with a French cloud provider (OVH SAS), and none of the artifacts described constitute a confirmed real-world identity or verified physical location — the attribution is an inference from consistent circumstantial evidence, which Cybernews itself frames as an assessment ("believed to be operating from Russia") rather than a confirmed fact.