Infrastructure Layer

Bulletproof Hosting Profiles

Structural profiles of bulletproof hosting providers serving Russia/CIS-linked ransomware and cybercrime networks, covering ASN infrastructure, operator attribution, sanctions exposure, and disruption history.

Read first  ·  Cross-cutting analysis
The Enablement Layer
Every provider below depends on a commercial chain it does not own: upstream transit carriers, address registries, datacenters, and formation agents. This analysis covers why that layer permits them to operate, and where the leverage sits. State protection is assessed separately in Section 07 of each profile.
Upstream transit RIPE freeze, not revoke EU mere conduit Formation agents Cross-profile upstream map
Read the analysis ↗
Provider Profiles
BH
AS200593 // AS198953
Russian bulletproof hosting server infrastructure, Proton66 / PROSPERO / Bearhost network
Active
BPH-01 / Russia / No Sanctions
Bearhost / Underground / Voodoo Servers
Active since ~2019. PROSPERO OOO (AS200593) and PROTON66 OOO (AS198953). 3 brand identities. 10+ documented malware families. No law enforcement action to date.
View Profile ↗
DD
AS203834
BPH landscape on Russian-language cybercrime forums, Cybercrime Diaries research, 2024
Active
BPH-02 / Estonia Reg / No Sanctions
DEDBROPRO
Vault Dweller OU, Estonia. Shares RIPE maintainer with ex-XHOST AS59753 (ZServers link). Own ASNs unrouted since Jun 2025, two deleted from RIPE by Oct 2026; nine blocks now leased out via InterLIR (incl. Hostkey). Storefront live; advertised on Carder.su (2026). 307 ThreatFox IOCs historically.
View Profile ↗
ML
AS206728
Yalishanda / Media Land, Analyst1 Infrastructure in the Shadows investigation, January 2026
Degraded
Sanctioned
BPH-03 / Russia / Sanctioned + Indicted
Media Land LLC / Yalishanda
Active since ~2009. St. Petersburg, Russia. AS206728 (~2,048 IPs). Sanctioned by the US, UK and Australia November 2025 and by the EU July 2026. Three principals indicted in the Northern District of Ohio, unsealed July 2026, with a $10M reward offered. None in custody.
View Profile ↗
SI
AS209847
Stark Industries Solutions homepage, KrebsOnSecurity investigation, May 2024
Degraded
Sanctioned
BPH-04 / Netherlands / EU RUSDA Sanctioned
Stark Industries Solutions
Founded Feb 2022. Amsterdam/The Hague operators. 800+ servers seized May 2026. 200+ prefixes still active. 4 named operators sanctioned. Successor ASN (AS209847) operational.
View Profile ↗
ZS
AS197414 (de-registered)
ZServers / XHost seized server equipment, Dutch police, Amsterdam datacenter, February 2025
Disrupted
Sanctioned
BPH-05 / Russia / 3 Sanctions Authorities / All ASNs Gone
ZServers / XHost
Active ~2010 to February 2025. Barnaul, Altai Krai, Russia. 127 servers seized. $5.2M+ on-chain activity. 6 individuals sanctioned. ASN de-registered. Most thoroughly disrupted BPH profiled.
View Profile ↗
AZ
AS210644 // AS216246
Active
Sanctioned
BPH-06 / Russia / 3 Sanctions Authorities / Reconstituted
Aeza Group
St. Petersburg. MskHost successor. OFAC, UK, and AU sanctioned 2025; 6 individuals sanctioned, core leadership detained in Russia. Hypercore successor dissolved, footprint rebuilt on the original ASNs plus NetCrafters to ~137k IPs (Sep 2026), 57 new blocks since OFAC. No EU designation. Spamhaus ASN-DROP listed.
View Profile ↗
VL
AS214943 // AS202412
Disrupted
BPH-07 / Kentucky Front / Domain Seized Oct 2026
Virtualine
Russia-linked cluster advertised as "DMCA & Abuse Ignored." FBI seized virtualine.net on 27 Oct 2026 (Operation Omegaline); Railnet backbone unrouted since Feb 2026, OMEGATECH near-dark, AS209800 still live. No named operator, no arrests, no sanctions; operator says it will rebrand.
View Profile ↗