Dutch-Russian cyber crime case reveals how the police tap the internet

Leaseweb is known to be a quite 'hands-off' provider, often the source of ddos attacks, torrent sites, etc.

Figures that Leaseweb, who doesn't do much (any?) self-policing ends up being a honeypot.

Perhaps ICQ comms servers or proxies are located at Leaseweb? The AMS-IX is I think the largest connection between Europe and the US, it makes sense as a central location for a messaging service, or as pass through for messages between Russia and the U.S. (not sure what the lines are like the other way around the world).

The background article [1] in Dutch somewhat vaguely states that: (emphasis mine)

It's hard to do anything against this type of crime: the [ZeuS] virus is particularly effective and the owners are hiding behind anonymous internet browsers. And often they use the servers of the Dutch provider Leaseweb. In 2008, 27 percent of European data traffic went via the servers of this company from Haarlemmermeer. The police have an explanation for this. 'This is likely due to the combination of high-speed internet access, a relatively inexpensive product offering and a high degree of freedom and anonymity when setting up the leased facilities,' says an internal note.

[1]: http://www.volkskrant.nl/kijkverder/2017/hacker/

Maybe the criminals were running a VPN server on the leaseweb servers, so incoming ICQ was encrypted but outgoing (to the ICQ servers) was unencrypted?

It isn't too clear.

Running a messaging client on a server, like centericq or irssi, was not uncommon, especially for someone from Russia, since all of their internet communications are openly surveilled.