Infrastructure Layer

Bulletproof Hosting Profiles

Structural profiles of bulletproof hosting providers serving Russia/CIS-linked ransomware and cybercrime networks — covering ASN infrastructure, operator attribution, sanctions exposure, and disruption history.

BH
AS200593 // AS198953
Russian bulletproof hosting server infrastructure — Proton66 / PROSPERO / Bearhost network
Active
BPH-01 / Russia / No Sanctions
Bearhost / Underground / Voodoo Servers
Active since ~2019. PROSPERO OOO (AS200593) and PROTON66 OOO (AS198953). 3 brand identities. 10+ documented malware families. No law enforcement action to date.
View Profile ↗
DD
AS203834
BPH landscape on Russian-language cybercrime forums — Cybercrime Diaries research, 2024
Active
BPH-02 / Estonia Reg / No Sanctions
DEDBROPRO
AS created 2022, active from at least 2024. Vault Dweller OU, Estonia registration. Bulgaria-hosted infrastructure. 307 ThreatFox IOCs on ASN. Advertised on Carder.su (2026).
View Profile ↗
ML
AS206728
Yalishanda / Media Land — Analyst1 Infrastructure in the Shadows investigation, January 2026
Degraded
Sanctioned
BPH-03 / Russia / Sanctioned Nov 2025
Media Land LLC / Yalishanda
Active since ~2009. St. Petersburg, Russia. AS206728 (~2,048 IPs). 4 individuals and entities sanctioned November 2025. Operators not arrested.
View Profile ↗
SI
AS209847
Stark Industries Solutions homepage — KrebsOnSecurity investigation, May 2024
Degraded
Sanctioned
BPH-04 / Netherlands / EU RUSDA Sanctioned
Stark Industries Solutions
Founded Feb 2022. Amsterdam/The Hague operators. 800+ servers seized May 2026. 200+ prefixes still active. 4 named operators sanctioned. Successor ASN (AS209847) operational.
View Profile ↗
ZS
AS197414 (de-registered)
ZServers / XHost seized server equipment — Dutch police, Amsterdam datacenter, February 2025
Disrupted
Sanctioned
BPH-05 / Russia / 3 Sanctions Authorities
ZServers / XHost
Active ~2010 to February 2025. Barnaul, Altai Krai, Russia. 127 servers seized. $5.2M+ on-chain activity. 6 individuals sanctioned. ASN de-registered. Most thoroughly disrupted BPH profiled.
View Profile ↗