Executive Summary and Provider Overview

Quick-Reference Attributes

Overall Assessment

DEDBROPRO (operating as dedbro.pro, brand handle "DedBro") is a newer bulletproof hosting (BPH) entrant offering dedicated servers, NVMe VPS, and VPN services on an explicitly anonymous and abuse-tolerant basis. The provider's infrastructure is registered under the Estonian company Vault Dweller OU (AS203834, dedbropro-as), with operational address-space activity observed primarily in Bulgaria. As of June 2026, DEDBROPRO is actively advertising to criminal audiences via Carder.su and maintains a public English-language commercial website at dedbro.pro that markets services without KYC requirements and accommodates clients whose "projects might encounter issues or complaints." [2][3]

Abuse telemetry from abuse.ch's ThreatFox identifies 307 indicators of compromise hosted on AS203834 over the trailing twelve months, with confirmed SectopRAT and Remcos remote access trojan (RAT) command-and-control (C2) infrastructure in the 195.82.147.x space, and generic malware distribution (unattributed PE executables) from 195.82.146.34 documented by URLhaus beginning March 2025. Criminal forum advertising on Carder.su (March 2026) explicitly endorses use for "scan, brute force and other projects," placing this provider unambiguously in the bulletproof hosting category rather than the privacy-hosting or grey-area hosting categories. [1][7][8][9][2]

No law enforcement actions, arrests, indictments, seizures, or sanctions designations targeting DEDBROPRO, Vault Dweller OU, or Yehor Minin have been documented as of October 2026. However, RIPE maintainer analysis (October 2026) reveals that Vault Dweller OU controls AS59753 (XHOSTIS-AS), a network Intel 471 linked directly to the sanctioned Zservers/XHOST operation, and that the same RIPE portfolio includes 185.170.144.0/24, a block carrying a Mallox ransomware IOC (Unit 42, 2023). The full infrastructure footprint is 3 ASNs and approximately 4,600 IPs across 9 blocks, with 4 blocks acquired after the Zservers sanctions. The primary structural leverage points are: EU entity registration (Estonian company law / CERT-EE); Belcloud (AS44901, Bulgarian upstream, EU jurisdiction); potential secondary sanctions exposure via the AS59753/Zservers link; and the identified director Yehor Minin. [11][13][14][15][17][18]

DEDBROPRO // Website Presence

DEDBROPRO public commercial website (dedbro.pro), operated on the Tilda platform, offering dedicated servers from $149, NVMe VPS from $5, and VPN from $5 per month, with explicit no-KYC and anonymity marketing. Billing panel at cp.dedbro.pro (ISPmanager/billmgr). Copyright footer reads "© 2024 DEDBRO.RPO."

dedbro.pro/eng.html, fetched June 2026

ThreatFox // AS203834 IOC Record

ThreatFox ASN report for AS203834 (dedbropro-as) documenting 307 indicators of compromise with confirmed Remcos and SectopRAT C2 tags. The DEDBROPRO-AS tag page shows 23 discrete tagged sightings between 2024-10-16 and 2025-05-30. Note: direct screenshot unavailable; ThreatFox pages are JavaScript-rendered. Gallery placeholder shown.

abuse.ch ThreatFox, threatfox.abuse.ch/asn/203834 / threatfox.abuse.ch/browse/tag/DEDBROPRO-AS/

Carder.su // March 2026 Advertisement

Carder.su thread "Dedbro.pro - Bulletproof Dedicated Servers, VPS, VPN" (posted March 2026), advertising brute force and scanning tolerance, cryptocurrency payments, and 24/7/365 support. Explicit CIS-exclusion policy. Contacts: xmpp@dedbro.pro (Jabber) and @dedbropro (Telegram).

carder.su/threads/dedbro-pro-bulletproof-dedicated-servers-vps-vpn.1044/, March 2026

drb_ra // Remcos C2 Disclosure

X (Twitter) post by researcher @drb_ra (May 2025) disclosing Remcos C2 endpoint 195.82.147.97:443 hosted on DEDBROPRO-AS. Classified as unverified in ThreatFox. First open-source attribution of DEDBROPRO to Remcos infrastructure in researcher-facing channels.

@drb_ra, x.com/drb_ra/status/1922545078054047899, May 2025

Lineage and Organizational Heritage

Predecessor and Sibling Analysis

RIPE maintainer inverse lookup (October 2026) reveals that Vault Dweller OU controls AS59753 (XHOSTIS-AS) under the same MNT-VLTDWELLER credential. AS59753 was linked by Intel 471 in their February 2025 Zservers/XHOST sanctions analysis as a front network for the sanctioned Zservers operation; the RIPE record for AS59753 lists "James Pippin" as technical contact, a documented alias for Aleksandr Mishin ("triplex560"), the sanctioned Zservers operator. This establishes a shared-infrastructure relationship between Vault Dweller OU and the Zservers/XHOST network. Additionally, AS47105 (as-vd), created 2008-04-28, indicates the Vault Dweller OU entity has been operating IP space for at least 18 years, far longer than AS203834's 2022 creation date suggests. The "DEDBROPRO" brand is a newer consumer-facing identity layered over a much older infrastructure operation. Confidence for the Zservers linkage: Tier 1 CONFIRMED (shared RIPE maintainer and org); Tier 2 CREDIBLE (Intel 471 attribution of AS59753 to Zservers network). [1][11][12][13][17][18]

Brand Continuity and Entity Structure

Evidentiary Pillars

Operator Profiles

Estonian Business Register records identify Yehor Minin (Estonian ID 37411190106, born 19 November 1974) as the sole owner and director of Vault Dweller OU. No sanctions designation, indictment, or criminal charge has been publicly issued against Minin as of October 2026. The RIPE contact record for all Vault Dweller OU objects is APF32-RIPE, listed as "Alexander P. Frei" with email alex@vaultdweller.net (last modified 2025-12-17), this is assessed as a likely operational alias or fictitious identity rather than a genuine name. The forum handle "DedBro" used on Carder.su is attributed to DEDBROPRO but has not been linked to Minin by name in open sources.

2.1 Handle: "DedBro"

2.2 Entity: Vault Dweller OU

Disputed Assessments

No major security vendors have published assessments specific to DEDBROPRO as of June 2026. Primary attribution and infrastructure data derive from abuse.ch community feeds (ThreatFox, URLhaus), a researcher disclosure on X (@drb_ra), and direct site and forum analysis. No vendor-to-vendor disagreements exist because no vendors beyond the abuse.ch community have formally assessed this provider in the open. This is an intelligence gap rather than a dispute. Gap: No Formal Vendor Assessments

Operational and Business Model

Service Model

DEDBROPRO operates as a direct-to-criminal bulletproof hosting provider, selling compute infrastructure (dedicated servers, NVMe virtual private servers) and VPN access on an anonymous, no-KYC basis with explicit tolerance for abuse-prone use cases. The service model combines a public English-language commercial website (dedbro.pro) with direct outreach channels (Telegram @dedbropro, Jabber xmpp@dedbro.pro) and criminal forum advertising (Carder.su). The provider's stated value proposition centers on: (1) anonymity ("We do not request KYC, phone number verification, or any other personal identification"), (2) abuse accommodation ("If your project might encounter issues or complaints, please let us know"), (3) DDoS resilience ("Free 500Gbps DDoS Protection"), and (4) round-the-clock human support. [2][3]

The Carder.su advertisement specifies tolerance for "scan, brute force and other projects upon agreement," confirming that the service model explicitly accommodates network scanning, credential brute-forcing, and unspecified additional attack infrastructure, with the euphemism "upon agreement" likely referring to advance disclosure to avoid automated abuse detection by upstream providers. [2]

Verbatim Advertising Copy

Pricing and Service Tiers

Discounts are offered for ordering three or more services or for prepayment of three months or more. [3]

Onboarding and Client Acquisition

Onboarding is explicitly low-friction: customers may place orders via the commercial website (cp.dedbro.pro running ISPmanager/billmgr) or "directly through our contacts without registration." The no-KYC and no-phone-verification policy is stated twice across the commercial site and the forum advertisement. Contact channels include the Telegram handle @dedbropro (public, indexed) and Jabber XMPP (xmpp@dedbro.pro), the latter providing encrypted messaging for operationally sensitive discussions. This structure mirrors standard BPH onboarding patterns: a public commercial face for discovery, chat-based sales for friction-free provisioning of abuse-tolerant resources. [2][3]

Abuse Handling and LE Posture

DEDBROPRO's stated abuse posture contains an internal tension that is common to BPH operators seeking to maintain partial legitimacy:

• The Carder.su ad explicitly accommodates "scan, brute force and other projects", confirming criminal use tolerance.
• The same ad states "We do not hold Spamhaus. In case of receiving SBL, the service will be suspended", indicating willingness to remove some abusive clients under narrow, blocklist-driven conditions.
• The public website includes an "Abuse report" link and the abuse contact abuse@dedbro.pro, providing cosmetic compliance infrastructure without evidence of meaningful abuse response.

The practical posture, as evidenced by 307 ThreatFox IOCs and sustained malware C2 and distribution hosting from late 2024 through at least May 2025, is abuse-tolerant with selective (and probably rare) enforcement when Spamhaus SBL pressure would threaten the provider's ability to maintain upstream peering relationships. [1][2][3][7]

OPSEC

Operator-level OPSEC indicators: anonymous advertising via forum "Guest" account on Carder.su; Jabber/XMPP contact (encrypted, no phone-linked identity); Telegram (pseudonymous). No Russian-language linguistic slippage visible in available advertising copy. The CIS-exclusion policy functions as a LE-risk management mechanism, reducing the probability of Russian-language victim complaints that could draw domestic attention. Estonian RIPE registration as an LIR adds a layer of apparent legitimacy (recognized regional registry member) while placing the entity in EU jurisdiction where direct law enforcement requests could theoretically be served. [2][3][13]

Technical Capabilities and Infrastructure Footprint

ASN Registration, Full Vault Dweller OU Portfolio

RIPE maintainer inverse lookup (MNT-VLTDWELLER) earlier in October 2026 returned three autonomous systems registered to ORG-VDO2-RIPE. Confirmed Re-run on 29 October 2026 the same lookup returns only AS47105: AS203834 and AS59753 no longer have aut-num objects in the RIPE database (deletion dates are not exposed by RIPE). RIPEstat shows the last announcements by AS203834 (195.82.147.0/24) on 23 June 2025 and by AS47105 (195.82.146.0/24) on 26 June 2025; AS59753 last announced in November 2022. The Estonian register lists Vault Dweller OÜ under a deletion notice [16]. The table below is retained as the historical portfolio. [17][20]

RIPE Maintainer Detail

IP Ranges and Geolocation, Full RIPE Footprint

RIPE maintainer inverse lookup (MNT-VLTDWELLER, October 2026) reveals a total footprint of 9 IP blocks covering approximately 4,600 addresses. Four blocks were acquired after the Zservers/XHOST sanctions (February 2025), indicating active reconstitution. [17]

Confirmed Who routes the space (29 October 2026). None of the nine blocks is announced by a Vault Dweller ASN. The allocations carry mnt-lower and mnt-routes delegated to the IP broker InterLIR (interlir-mnt), and the route objects are InterLIR-maintained: 185.170.144.0/24 is announced by AS50053 (VDSKA-AS, Anton Levin; route object 17 April 2026), 185.73.125.0/24 by AS203545 (Nerzen Bilisim Teknolojileri, Turkey), and 91.236.186.0/24 by AS57043 HOSTKEY B.V. (Netherlands), the provider at which the sanctioned ZServers operator Mishin held his reseller account. 195.82.146.0/23, 185.73.124.0/22, 185.70.220.0/22 and 5.145.176.0/23 are not announced. Analyst Inference Vault Dweller OU has shifted from operating a bulletproof network to leasing address space through a broker while the DEDBROPRO storefront continues to sell servers; the brand's hosting is therefore now delivered on other operators' ASNs, and the Hostkey routing of a Vault Dweller block is a second structural link to the ZServers upstream chain. Each lessee ASN inherits the abuse history of the block. [20]

Reconstitution signal: Four blocks (91.236.186.0/24, 5.145.176.0/23, 185.70.220.0/22, and sub-allocations under 185.73.124.0/22) were registered after the February 2025 Zservers/XHOST sanctions and the March 2025 Intel 471 exposure. The most recent block was acquired July 2026, 17 months post-sanctions. This pattern indicates the operator is actively expanding capacity rather than winding down. Analyst Inference

Data Center Footprint

DEDBROPRO's marketing claims "high-quality equipment located in the world's leading data centers" and offers hardware configurations consistent with a dedicated server reseller or colo customer rather than a facility owner. IP geolocation data (Bulgarian geolocations for C2 IPs) is consistent with the Belcloud (AS44901) upstream peering, which is a Bulgarian transit provider. No specific facility names or addresses in Bulgaria or Estonia are documented in open sources. Given the single /24 address block and startup-scale pricing structure, DEDBROPRO almost certainly leases rack space or individual server units from one or more wholesale providers rather than owning physical data center infrastructure. [3][6][11]

Upstream Transit Provider Chain

AS203834 (dedbropro-as) peered with two upstream transit providers while it was routed (to June 2025), confirmed via BGP data: [11][14][15]

Resilience Techniques

DEDBROPRO's resilience posture, as evidenced by the available data, relies primarily on: (1) DDoS mitigation (500 Gbps claimed, likely via upstream scrubbing or a commercial DDoS protection service); (2) moderately persistent IP allocations (SectopRAT and Remcos C2 endpoints documented over multiple months rather than hours, suggesting slow-burn resilience rather than fast-flux techniques); and (3) a consolidated ASN and addressing structure that allows the operator to re-provision customer services within the same IP space when individual IPs are burned. No fast-flux DNS, domain generation algorithms, or Tor-based resilience mechanisms are documented for the DEDBROPRO platform itself, though individual criminal clients may use such techniques independently. [2][3][7][8]

Hosted Activity Types

Blocklist Standing

Known Weaknesses and Single Points of Failure

• RIPE maintainer as single control point: All three ASNs and all nine IP blocks are controlled under one maintainer credential (MNT-VLTDWELLER). A successful compromise or revocation of this credential would destabilize the entire Vault Dweller OU portfolio simultaneously. [17]
• Documented Zservers/XHOST link: AS59753 (XHOSTIS-AS) in the same portfolio is directly named in Intel 471's analysis of the sanctioned Zservers network. This creates potential secondary sanctions exposure for Vault Dweller OU and Yehor Minin under OFAC's network-based designation authority. [18]
• EU-registered entity with identified owner: Vault Dweller OU is an Estonian company under deletion notice, with Yehor Minin on record as sole director. This makes the entity and its director accessible to Estonian company law, CERT-EE referral, and EU-member-state law enforcement coordination. [13][16]
• Belcloud upstream (EU jurisdiction): AS44901 (Belcloud, Bulgaria) is the primary IP transit path. EU-based coordinated abuse reports through CERT-EE or CERT-BG could support a de-peering request against AS203834 specifically, without requiring action against the full portfolio.
• 185.170.144.0/24 Intel 471 linkage: This block's connection to the Zservers/XHOST network via shared abuse contact (Intel 471) and the Mallox ransomware IOC (Unit 42) makes it the highest-profile leverage point in the portfolio for law enforcement and network operators seeking to target documented abuse. [18][19]
• ISPmanager billing panel exposed: cp.dedbro.pro is a publicly accessible billing panel (ISPmanager/billmgr); legal or investigative access would expose customer records, payment data, and provisioned server inventory.
• Known abuse contact: abuse@dedbro.pro is documented in RIPE records. Coordinated abuse reporting combined with upstream provider complaints is a low-cost disruption vector.

Financial Infrastructure

Payment Methods

DEDBROPRO explicitly accepts "bitcoin and other cryptocurrencies" per the Carder.su advertisement. No fiat payment methods (credit card, bank transfer), legacy e-money services (WebMoney, QIWI, Payeer), or mainstream payment processors are mentioned in available advertising or on the commercial website. The exclusive use of cryptocurrency is standard for BPH operations targeting criminal clientele, as it reduces KYC exposure for both provider and client and makes payment tracing more complex. [2]

The billing platform at cp.dedbro.pro (ISPmanager/billmgr) confirms automated invoicing infrastructure; the payment integration within billmgr for cryptocurrency typically uses third-party payment gateways (common examples include CoinPayments or NOW Payments in the CIS BPH space). No specific payment gateway has been identified for DEDBROPRO. [3]

Wallet Clusters and On-Chain Analysis

No publicly documented Bitcoin or cryptocurrency wallet addresses are specifically linked to DEDBROPRO, dedbro.pro, Vault Dweller OU, or the handle "DedBro" in available open sources. No publications from TRM Labs, Chainalysis, Elliptic, or Crystal Blockchain addressing DEDBROPRO on-chain activity were identified in this research pass.

Analyst Inference Typical BPH acquisition-layering-extraction patterns would suggest: direct BTC receipt from criminal clients to a provider-controlled address cluster (acquisition); movement through one or more hops using peer-to-peer exchanges, mixing services, or chain-hopping (layering); and conversion to fiat via OTC brokers or regulated exchange with lax controls (extraction). This pattern is speculative and not supported by direct evidence for DEDBROPRO specifically.

Sanctions and Risk Ratings

No sanctions designations have been imposed against DEDBROPRO, Vault Dweller OU, or the "DedBro" handle by any of the following as of June 2026: OFAC (U.S. Treasury SDN List), EU Official Journal (EU Consolidated Sanctions List), UK FCDO (UK Consolidated List), or any other national sanctions authority reviewed in this pass. The provider is de-facto high-risk for any counterparty (based on documented malware hosting and explicit criminal marketing) but is de-jure undesignated. No high-risk VASP classifications from FATF-aligned bodies or national financial intelligence units were identified. Financial risk is inferred from operational evidence; formal designation does not exist.

Client Profile and Hosted Operations

Crimeware Verticals by Evidence Tier

Client Geography and Target Profile

DEDBROPRO's CIS-exclusion policy ("Work on the CIS" is prohibited) has two practical implications: (1) it excludes victims in Russia, Ukraine, Belarus, Kazakhstan, and other CIS states, and (2) it signals the provider's likely target audience as CIS-based criminal operators who wish to avoid triggering domestic law enforcement scrutiny by harming their own constituencies. This pattern is consistent with the broader BPH norm in the CIS criminal ecosystem, where providers operating with Russian-language forums and Russian-origin operators routinely prohibit CIS-targeting to maintain a low-profile relationship with local authorities. [2]

The Carder.su advertising channel targets a Russian-language fraud and carding community. The confirmed RAT families (SectopRAT, Remcos) are general-purpose commodity RATs used across a wide range of criminal operations globally rather than being attributable to a specific nationality or criminal group.

Notable Hosted Cases

No law enforcement press releases, court documents, or major vendor case studies naming DEDBROPRO in connection with a specific criminal operation or high-profile incident have been identified in available open sources as of June 2026. Current documented evidence is limited to abuse.ch feed telemetry and a single researcher disclosure on X. This reflects the provider's relatively recent operational history and comparatively low profile relative to larger BPH operators with years of documented client activity. Intelligence Gap: No Named Client Cases

State Nexus Assessment

State Nexus Tier Assessment

Evidence Supporting Tolerated Safe Harbor Assessment

• AS203834 has operated with documented abuse (RAT C2, malware distribution) from at least October 2024 through May 2025 without any documented enforcement action by Estonian authorities, Bulgarian CERT, upstream providers, or RIPE NCC. [1][7][8][9]
• The dual-upstream structure (Belcloud / Bulgaria; RASCOM / Russia) routes DEDBROPRO through Russian network infrastructure despite Estonian entity registration. RASCOM (AS20764) serves many legitimate clients; its presence as upstream for DEDBROPRO does not alone establish state coordination but warrants monitoring.
• AS59753 (XHOSTIS-AS), registered to ORG-VDO2-RIPE under the same MNT-VLTDWELLER credential as DEDBROPRO, was identified by Intel 471 as a Zservers/XHOST front network. Zservers/XHOST is assessed by the U.S. Treasury as operating with Russian state toleration; structural proximity to that network via shared RIPE infrastructure is a meaningful nexus indicator even in the absence of direct evidence of Vault Dweller OU's state relationship. Credible [18]
• CIS-exclusion policy is consistent with an operator seeking to avoid triggering CIS-region law enforcement, a standard self-protective measure for CIS-origin operators rather than a signal of active state direction.
• Vault Dweller OU acquired four new IP blocks after the Zservers sanctions (February 2025) and the Intel 471 exposure (March 2025), with no observed enforcement response. Continued expansion under scrutiny without disruption is consistent with passive tolerance. [17]

Negative Evidence (Expected Indicators Absent)

The following indicators that would be expected if a higher-tier nexus existed are not present in available open sources:

• No documented selective protection by Russian or Estonian authorities following formal abuse complaints.
• No state-aligned APT infrastructure (e.g., GRU/SVR/FSB-attributed tooling) documented on DEDBROPRO. All observed activity is commodity crimeware (SectopRAT, Remcos), which is not characteristic of state-directed operations.
• No whistleblower reports, leaked communications, or vendor assessments asserting state coordination.
• No politically sensitive clients (e.g., hacktivism, influence operations, election interference infrastructure) identified on DEDBROPRO in open sources.
• No court filings or sanctions packages that would reveal state-protection relationships.

RASCOM Upstream: Significance and Limitations

Analyst Inference The presence of RASCOM (AS20764, Russia) as one of two upstream transit providers for AS203834 is notable. RASCOM provides connectivity to Cogent, Level3, Beeline, MTS, TTK, and Rostelecom, meaning DEDBROPRO traffic routes through Russian network infrastructure on the RASCOM path. This creates a technical visibility opportunity for Russian intelligence services that would not exist for a purely EU-routed provider. However, RASCOM serves thousands of legitimate commercial clients, and routing through Russian infrastructure is common for Eastern European providers with Russian commercial relationships. This indicator alone is insufficient to elevate the state nexus assessment above Tolerated Safe Harbor. It should be documented as a monitoring flag.

Law Enforcement and Regulatory Response

Documented LE and Regulatory Actions

No law enforcement arrests, indictments, criminal charges, civil actions, infrastructure seizures, domain takedowns, or sanctions designations specifically targeting DEDBROPRO, dedbro.pro, Vault Dweller OU, AS203834, or the "DedBro" handle have been documented in open sources as of June 2026. The provider appears to be fully operational across all documented channels (website, billing panel, Telegram, criminal forum advertising) with no disruption indicators observed. Gap: No LE Actions Documented

Post-Disruption Client Migration

Not applicable as of June 2026, no disruption events have occurred.

Regulatory Leverage Points

Analyst Inference The following regulatory and network-level leverage points are available to investigators or network defenders, in approximate order of accessibility:

• RIPE NCC abuse process: Vault Dweller OU holds LIR status under RIPE. Documented and repeated abuse without response to abuse@dedbro.pro could support a RIPE member-conduct complaint, though RIPE does not directly revoke allocations for abuse.
• Estonian company law / CERT-EE: Vault Dweller OU is an Estonian company subject to Estonian law. CERT-EE referral of abuse complaints to Estonian police and the Estonian Data Protection Authority represents a legitimate pathway. Estonian membership in EUROPOL and EU law enforcement cooperation frameworks may enable international case coordination.
• Belcloud (AS44901) de-peering: A coordinated campaign of abuse reports from national CERTs (CERT-EE, CERT-BG) and major security vendors directed at Belcloud could support a de-peering request under Belcloud's acceptable use policy. Loss of Belcloud as upstream would force DEDBROPRO to route exclusively via RASCOM, degrading connectivity quality and increasing its dependency on Russian infrastructure.
• OFAC sanctions designation: If sufficient financial flow evidence (wallet addresses, transaction clusters) linking DEDBROPRO to U.S.-nexus crimes is developed, an OFAC SDN designation of Vault Dweller OU is possible under existing cybercrime-related Executive Orders.

Connected Groups and Ecosystem Relationships

The following connected entity assessments apply two independent confidence tiers per the schema requirement. Every claim includes both Tier 1 (infrastructure relationship: did this BPH host their infrastructure?) and Tier 2 (operational relationship: did the BPH operator know the client identity or coordinate operationally?) assessed independently.

Entities with No Formal Assessment

The following security vendors and organizations have not published formal assessments of DEDBROPRO as of June 2026: Recorded Future, Mandiant (Google), CrowdStrike, Secureworks, Proofpoint, Microsoft MSTIC, Palo Alto Unit 42, Cisco Talos, Trend Micro, ESET, Kaspersky (public reporting), F-Secure/WithSecure, Group-IB, Team Cymru, SilentPush, DomainTools. This reflects the provider's relatively recent and lower-profile operational footprint compared to larger BPH operators that have attracted formal research attention.

Trajectory Assessment

Infrastructure Churn

Infrastructure churn is assessed as MODERATE and increasing. The consumer-facing DEDBROPRO brand (AS203834, Carder.su advertising, dedbro.pro) has maintained stable contact details and channel identity since at least 2024. However, the operator has acquired four new IP blocks since the Zservers/XHOST sanctions (February 2025), an acquisition rate of approximately one block every four months through July 2026. The RIPE maintainer record (MNT-VLTDWELLER) and RIPE person contact (APF32-RIPE) were both modified in December 2025, and the Vault Dweller OU registered address was updated simultaneously (from Majaka tn 26 to Vesivärava tn 50-201), consistent with post-exposure housekeeping. C2 infrastructure within AS203834 showed multi-month persistence (ThreatFox first sighting 2024-10-16, last 2025-05-30), indicating slow-burn rather than fast-flux client hosting. [1][2][7][17]

Market Position

DEDBROPRO's consumer-facing brand occupies the entry-level to mid-tier BPH segment. However, the full Vault Dweller OU portfolio (3 ASNs, ~4,600 IPs) is substantially larger than the DEDBROPRO brand alone suggests and is comparable in scale to several named mid-tier BPH operators. Structural proximity to Zservers/XHOST via shared RIPE infrastructure (AS59753, 185.170.144.0/24) positions Vault Dweller OU within a broader CIS BPH network rather than as a fully independent market entrant. The DEDBROPRO consumer brand remains the visible face; the underlying infrastructure operator (Vault Dweller OU / Yehor Minin) has operated IP space since at least 2008. [2][3][17]

Disruption History

No direct disruption events against DEDBROPRO, Vault Dweller OU, or Yehor Minin as of October 2026. However, the Zservers/XHOST sanctions (February 2025) and Intel 471 exposure (March 2025) targeted infrastructure overlapping with Vault Dweller OU's portfolio (AS59753, 185.170.144.0/24 shared abuse contact). The operator responded with RIPE record modifications in December 2025 and a registered address change, suggesting awareness of the exposure, followed by continued IP acquisition through July 2026. These are post-disruption-adjacent reconstitution signals rather than direct disruption of Vault Dweller OU itself. [17][18]

Trajectory Direction

Mandatory Intelligence Gaps

Recent Reporting

Update Pass (29 October 2026)

Source Integrity Notes

Open-Source Researcher Disclosure

The most specific recent open-source reporting on DEDBROPRO beyond abuse.ch feeds is a May 2025 X post by researcher @drb_ra disclosing Remcos C2 infrastructure on DEDBROPRO-AS at 195.82.147.97:443. This is a single-source disclosure tagged as unverified in ThreatFox. No major security vendor has published a formal technical report or blog post on DEDBROPRO as of June 2026. The provider remains below the attention threshold of mainstream threat intelligence publication cycles. [6]

Sources