Executive Summary and Provider Overview

Quick-Reference Attributes

Overall Assessment

DEDBROPRO (operating as dedbro.pro, brand handle "DedBro") is a newer bulletproof hosting (BPH) entrant offering dedicated servers, NVMe VPS, and VPN services on an explicitly anonymous and abuse-tolerant basis. The provider's infrastructure is registered under the Estonian company Vault Dweller OU (AS203834, dedbropro-as), with operational address-space activity observed primarily in Bulgaria. As of June 2026, DEDBROPRO is actively advertising to criminal audiences via Carder.su and maintains a public English-language commercial website at dedbro.pro that markets services without KYC requirements and accommodates clients whose "projects might encounter issues or complaints." [2][3]

Abuse telemetry from abuse.ch's ThreatFox identifies 307 indicators of compromise hosted on AS203834 over the trailing twelve months, with confirmed SectopRAT and Remcos remote access trojan (RAT) command-and-control (C2) infrastructure in the 195.82.147.x space, and generic malware distribution (unattributed PE executables) from 195.82.146.34 documented by URLhaus beginning March 2025. Criminal forum advertising on Carder.su (March 2026) explicitly endorses use for "scan, brute force and other projects," placing this provider unambiguously in the bulletproof hosting category rather than the privacy-hosting or grey-area hosting categories. [1][7][8][9][2]

No law enforcement actions, arrests, indictments, seizures, or sanctions designations targeting DEDBROPRO, Vault Dweller OU, or identified operators have been documented as of June 2026. The provider's single /24 address block, Estonian entity registration (EU regulatory jurisdiction), and dual upstream routing through a Bulgarian transit provider and a Russian ISP (RASCOM, AS20764) represent the primary structural leverage points available to investigators and network operators seeking to degrade this provider's operational capability. [11][13][14][15]

DEDBROPRO // Website Presence

DEDBROPRO public commercial website (dedbro.pro), operated on the Tilda platform, offering dedicated servers from $149, NVMe VPS from $5, and VPN from $5 per month, with explicit no-KYC and anonymity marketing. Billing panel at cp.dedbro.pro (ISPmanager/billmgr). Copyright footer reads "© 2024 DEDBRO.RPO."

dedbro.pro/eng.html, fetched June 2026

ThreatFox // AS203834 IOC Record

ThreatFox ASN report for AS203834 (dedbropro-as) documenting 307 indicators of compromise with confirmed Remcos and SectopRAT C2 tags. The DEDBROPRO-AS tag page shows 23 discrete tagged sightings between 2024-10-16 and 2025-05-30. Note: direct screenshot unavailable; ThreatFox pages are JavaScript-rendered. Gallery placeholder shown.

abuse.ch ThreatFox, threatfox.abuse.ch/asn/203834 / threatfox.abuse.ch/browse/tag/DEDBROPRO-AS/

Carder.su // March 2026 Advertisement

Carder.su thread "Dedbro.pro - Bulletproof Dedicated Servers, VPS, VPN" (posted March 2026), advertising brute force and scanning tolerance, cryptocurrency payments, and 24/7/365 support. Explicit CIS-exclusion policy. Contacts: [email protected] (Jabber) and @dedbropro (Telegram).

carder.su/threads/dedbro-pro-bulletproof-dedicated-servers-vps-vpn.1044/, March 2026

drb_ra // Remcos C2 Disclosure

X (Twitter) post by researcher @drb_ra (May 2025) disclosing Remcos C2 endpoint 195.82.147.97:443 hosted on DEDBROPRO-AS. Classified as unverified in ThreatFox. First open-source attribution of DEDBROPRO to Remcos infrastructure in researcher-facing channels.

@drb_ra, x.com/drb_ra/status/1922545078054047899, May 2025

Lineage and Organizational Heritage

Predecessor and Sibling Analysis

No public evidence links DEDBROPRO or Vault Dweller OU to prior-generation BPH brands (such as Maxided, Yalishanda, Media Land LLC, McColo, or 3FN) or to currently active BPH brand clusters (such as PROSPERO/Bearhost, Zservers, or Stark Industries). AS203834 was created on 2022-07-19, making this a relatively recent autonomous system without the multi-year lineage typical of established BPH conglomerates. The provider is assessed as a newer, independent market entrant rather than a rebrand or shell of an existing criminal infrastructure operation. Confidence: Credible (absence of evidence with moderate search depth; deeper WHOIS history and criminal forum cross-referencing could revise this). [1][11][12][13]

Brand Continuity and Entity Structure

Evidentiary Pillars

Operator Profiles

No named individual, sanctioned person, or indicted defendant has been publicly linked to DEDBROPRO, dedbro.pro, or Vault Dweller OU as of June 2026. The sole operator-attributable identifier is the forum handle "DedBro" used on Carder.su. All operator information below reflects an unknown individual or individuals behind the Vault Dweller OU entity.

2.1 Handle: "DedBro"

2.2 Entity: Vault Dweller OU

Disputed Assessments

No major security vendors have published assessments specific to DEDBROPRO as of June 2026. Primary attribution and infrastructure data derive from abuse.ch community feeds (ThreatFox, URLhaus), a researcher disclosure on X (@drb_ra), and direct site and forum analysis. No vendor-to-vendor disagreements exist because no vendors beyond the abuse.ch community have formally assessed this provider in the open. This is an intelligence gap rather than a dispute. Gap: No Formal Vendor Assessments

Operational and Business Model

Service Model

DEDBROPRO operates as a direct-to-criminal bulletproof hosting provider, selling compute infrastructure (dedicated servers, NVMe virtual private servers) and VPN access on an anonymous, no-KYC basis with explicit tolerance for abuse-prone use cases. The service model combines a public English-language commercial website (dedbro.pro) with direct outreach channels (Telegram @dedbropro, Jabber [email protected]) and criminal forum advertising (Carder.su). The provider's stated value proposition centers on: (1) anonymity ("We do not request KYC, phone number verification, or any other personal identification"), (2) abuse accommodation ("If your project might encounter issues or complaints, please let us know"), (3) DDoS resilience ("Free 500Gbps DDoS Protection"), and (4) round-the-clock human support. [2][3]

The Carder.su advertisement specifies tolerance for "scan, brute force and other projects upon agreement," confirming that the service model explicitly accommodates network scanning, credential brute-forcing, and unspecified additional attack infrastructure, with the euphemism "upon agreement" likely referring to advance disclosure to avoid automated abuse detection by upstream providers. [2]

Verbatim Advertising Copy

Pricing and Service Tiers

Discounts are offered for ordering three or more services or for prepayment of three months or more. [3]

Onboarding and Client Acquisition

Onboarding is explicitly low-friction: customers may place orders via the commercial website (cp.dedbro.pro running ISPmanager/billmgr) or "directly through our contacts without registration." The no-KYC and no-phone-verification policy is stated twice across the commercial site and the forum advertisement. Contact channels include the Telegram handle @dedbropro (public, indexed) and Jabber XMPP ([email protected]), the latter providing encrypted messaging for operationally sensitive discussions. This structure mirrors standard BPH onboarding patterns: a public commercial face for discovery, chat-based sales for friction-free provisioning of abuse-tolerant resources. [2][3]

Abuse Handling and LE Posture

DEDBROPRO's stated abuse posture contains an internal tension that is common to BPH operators seeking to maintain partial legitimacy:

• The Carder.su ad explicitly accommodates "scan, brute force and other projects" — confirming criminal use tolerance.
• The same ad states "We do not hold Spamhaus. In case of receiving SBL, the service will be suspended" — indicating willingness to remove some abusive clients under narrow, blocklist-driven conditions.
• The public website includes an "Abuse report" link and the abuse contact [email protected] — providing cosmetic compliance infrastructure without evidence of meaningful abuse response.

The practical posture, as evidenced by 307 ThreatFox IOCs and sustained malware C2 and distribution hosting from late 2024 through at least May 2025, is abuse-tolerant with selective (and probably rare) enforcement when Spamhaus SBL pressure would threaten the provider's ability to maintain upstream peering relationships. [1][2][3][7]

OPSEC

Operator-level OPSEC indicators: anonymous advertising via forum "Guest" account on Carder.su; Jabber/XMPP contact (encrypted, no phone-linked identity); Telegram (pseudonymous). No Russian-language linguistic slippage visible in available advertising copy. The CIS-exclusion policy functions as a LE-risk management mechanism, reducing the probability of Russian-language victim complaints that could draw domestic attention. Estonian RIPE registration as an LIR adds a layer of apparent legitimacy (recognized regional registry member) while placing the entity in EU jurisdiction where direct law enforcement requests could theoretically be served. [2][3][13]

Technical Capabilities and Infrastructure Footprint

ASN Registration

IP Ranges and Geolocation

Data Center Footprint

DEDBROPRO's marketing claims "high-quality equipment located in the world's leading data centers" and offers hardware configurations consistent with a dedicated server reseller or colo customer rather than a facility owner. IP geolocation data (Bulgarian geolocations for C2 IPs) is consistent with the Belcloud (AS44901) upstream peering, which is a Bulgarian transit provider. No specific facility names or addresses in Bulgaria or Estonia are documented in open sources. Given the single /24 address block and startup-scale pricing structure, DEDBROPRO almost certainly leases rack space or individual server units from one or more wholesale providers rather than owning physical data center infrastructure. [3][6][11]

Upstream Transit Provider Chain

AS203834 (dedbropro-as) peers with two upstream transit providers, confirmed via BGP data: [11][14][15]

Resilience Techniques

DEDBROPRO's resilience posture, as evidenced by the available data, relies primarily on: (1) DDoS mitigation (500 Gbps claimed, likely via upstream scrubbing or a commercial DDoS protection service); (2) moderately persistent IP allocations (SectopRAT and Remcos C2 endpoints documented over multiple months rather than hours, suggesting slow-burn resilience rather than fast-flux techniques); and (3) a consolidated ASN and addressing structure that allows the operator to re-provision customer services within the same IP space when individual IPs are burned. No fast-flux DNS, domain generation algorithms, or Tor-based resilience mechanisms are documented for the DEDBROPRO platform itself, though individual criminal clients may use such techniques independently. [2][3][7][8]

Hosted Activity Types

Blocklist Standing

Known Weaknesses and Single Points of Failure

• Narrow address space: Single /24 allocation (195.82.146.0/24, confirmed) with documented adjacent activity in 195.82.147.x. Null-routing or de-peering this block by either upstream (Belcloud or RASCOM) would effectively terminate the provider's connectivity. [11]
• Single ASN: All operations run through one AS (AS203834). No backup ASN identified. Compared to mature BPH operators who maintain multiple ASNs and routing diversity, this represents a significant operational single point of failure.
• EU-registered entity: Vault Dweller OU is a legal entity in Estonia (EU), making it subject to Estonian company law, potential court orders, and EU regulatory action including Estonian CERT (CERT-EE) referrals to upstream providers. [13]
• Belcloud upstream (EU jurisdiction): AS44901 (Belcloud) is a Bulgarian provider operating within EU law. Documented abuse of AS203834 could support a formal de-peering request to Belcloud via CERT-EE, CERT-BG, or relevant EU coordination mechanisms.
• ISPmanager billing panel exposed: cp.dedbro.pro is a publicly accessible billing panel. Its existence and platform (ISPmanager/billmgr) are documented; legal or investigative access to this system would expose customer records, payment data, and provisioned server inventory.
• Known abuse contact: [email protected] is documented in RIPE records. Coordinated abuse reporting campaigns targeting this address, combined with upstream provider complaints, represent a low-cost disruption vector.

Financial Infrastructure

Payment Methods

DEDBROPRO explicitly accepts "bitcoin and other cryptocurrencies" per the Carder.su advertisement. No fiat payment methods (credit card, bank transfer), legacy e-money services (WebMoney, QIWI, Payeer), or mainstream payment processors are mentioned in available advertising or on the commercial website. The exclusive use of cryptocurrency is standard for BPH operations targeting criminal clientele, as it reduces KYC exposure for both provider and client and makes payment tracing more complex. [2]

The billing platform at cp.dedbro.pro (ISPmanager/billmgr) confirms automated invoicing infrastructure; the payment integration within billmgr for cryptocurrency typically uses third-party payment gateways (common examples include CoinPayments or NOW Payments in the CIS BPH space). No specific payment gateway has been identified for DEDBROPRO. [3]

Wallet Clusters and On-Chain Analysis

No publicly documented Bitcoin or cryptocurrency wallet addresses are specifically linked to DEDBROPRO, dedbro.pro, Vault Dweller OU, or the handle "DedBro" in available open sources. No publications from TRM Labs, Chainalysis, Elliptic, or Crystal Blockchain addressing DEDBROPRO on-chain activity were identified in this research pass.

Analyst Inference Typical BPH acquisition-layering-extraction patterns would suggest: direct BTC receipt from criminal clients to a provider-controlled address cluster (acquisition); movement through one or more hops using peer-to-peer exchanges, mixing services, or chain-hopping (layering); and conversion to fiat via OTC brokers or regulated exchange with lax controls (extraction). This pattern is speculative and not supported by direct evidence for DEDBROPRO specifically.

Sanctions and Risk Ratings

No sanctions designations have been imposed against DEDBROPRO, Vault Dweller OU, or the "DedBro" handle by any of the following as of June 2026: OFAC (U.S. Treasury SDN List), EU Official Journal (EU Consolidated Sanctions List), UK FCDO (UK Consolidated List), or any other national sanctions authority reviewed in this pass. The provider is de-facto high-risk for any counterparty (based on documented malware hosting and explicit criminal marketing) but is de-jure undesignated. No high-risk VASP classifications from FATF-aligned bodies or national financial intelligence units were identified. Financial risk is inferred from operational evidence; formal designation does not exist.

Client Profile and Hosted Operations

Crimeware Verticals by Evidence Tier

Client Geography and Target Profile

DEDBROPRO's CIS-exclusion policy ("Work on the CIS" is prohibited) has two practical implications: (1) it excludes victims in Russia, Ukraine, Belarus, Kazakhstan, and other CIS states, and (2) it signals the provider's likely target audience as CIS-based criminal operators who wish to avoid triggering domestic law enforcement scrutiny by harming their own constituencies. This pattern is consistent with the broader BPH norm in the CIS criminal ecosystem, where providers operating with Russian-language forums and Russian-origin operators routinely prohibit CIS-targeting to maintain a low-profile relationship with local authorities. [2]

The Carder.su advertising channel targets a Russian-language fraud and carding community. The confirmed RAT families (SectopRAT, Remcos) are general-purpose commodity RATs used across a wide range of criminal operations globally rather than being attributable to a specific nationality or criminal group.

Notable Hosted Cases

No law enforcement press releases, court documents, or major vendor case studies naming DEDBROPRO in connection with a specific criminal operation or high-profile incident have been identified in available open sources as of June 2026. Current documented evidence is limited to abuse.ch feed telemetry and a single researcher disclosure on X. This reflects the provider's relatively recent operational history and comparatively low profile relative to larger BPH operators with years of documented client activity. Intelligence Gap: No Named Client Cases

State Nexus Assessment

State Nexus Tier Assessment

Evidence Supporting Tolerated Safe Harbor Assessment

• AS203834 has operated with documented abuse (RAT C2, malware distribution) from at least October 2024 through May 2025 without any documented enforcement action by Estonian authorities, Bulgarian CERT, upstream providers, or RIPE NCC. [1][7][8][9]
• The dual-upstream structure (Belcloud / Bulgaria; RASCOM / Russia) routes DEDBROPRO through Russian network infrastructure despite Estonian entity registration, which is unusual and warrants monitoring. RASCOM (AS20764) is a Russian ISP serving many legitimate clients, and its provision of upstream transit to DEDBROPRO does not by itself establish state coordination.
• CIS-exclusion policy is consistent with an operator seeking to avoid triggering CIS-region law enforcement, which is a standard self-protective measure for operators of CIS origin rather than a signal of state direction.

Negative Evidence (Expected Indicators Absent)

The following indicators that would be expected if a higher-tier nexus existed are not present in available open sources:

• No documented selective protection by Russian or Estonian authorities following formal abuse complaints.
• No state-aligned APT infrastructure (e.g., GRU/SVR/FSB-attributed tooling) documented on DEDBROPRO. All observed activity is commodity crimeware (SectopRAT, Remcos), which is not characteristic of state-directed operations.
• No whistleblower reports, leaked communications, or vendor assessments asserting state coordination.
• No politically sensitive clients (e.g., hacktivism, influence operations, election interference infrastructure) identified on DEDBROPRO in open sources.
• No court filings or sanctions packages that would reveal state-protection relationships.

RASCOM Upstream: Significance and Limitations

Analyst Inference The presence of RASCOM (AS20764, Russia) as one of two upstream transit providers for AS203834 is notable. RASCOM provides connectivity to Cogent, Level3, Beeline, MTS, TTK, and Rostelecom, meaning DEDBROPRO traffic routes through Russian network infrastructure on the RASCOM path. This creates a technical visibility opportunity for Russian intelligence services that would not exist for a purely EU-routed provider. However, RASCOM serves thousands of legitimate commercial clients, and routing through Russian infrastructure is common for Eastern European providers with Russian commercial relationships. This indicator alone is insufficient to elevate the state nexus assessment above Tolerated Safe Harbor. It should be documented as a monitoring flag.

Law Enforcement and Regulatory Response

Documented LE and Regulatory Actions

No law enforcement arrests, indictments, criminal charges, civil actions, infrastructure seizures, domain takedowns, or sanctions designations specifically targeting DEDBROPRO, dedbro.pro, Vault Dweller OU, AS203834, or the "DedBro" handle have been documented in open sources as of June 2026. The provider appears to be fully operational across all documented channels (website, billing panel, Telegram, criminal forum advertising) with no disruption indicators observed. Gap: No LE Actions Documented

Post-Disruption Client Migration

Not applicable as of June 2026 — no disruption events have occurred.

Regulatory Leverage Points

Analyst Inference The following regulatory and network-level leverage points are available to investigators or network defenders, in approximate order of accessibility:

• RIPE NCC abuse process: Vault Dweller OU holds LIR status under RIPE. Documented and repeated abuse without response to [email protected] could support a RIPE member-conduct complaint, though RIPE does not directly revoke allocations for abuse.
• Estonian company law / CERT-EE: Vault Dweller OU is an Estonian company subject to Estonian law. CERT-EE referral of abuse complaints to Estonian police and the Estonian Data Protection Authority represents a legitimate pathway. Estonian membership in EUROPOL and EU law enforcement cooperation frameworks may enable international case coordination.
• Belcloud (AS44901) de-peering: A coordinated campaign of abuse reports from national CERTs (CERT-EE, CERT-BG) and major security vendors directed at Belcloud could support a de-peering request under Belcloud's acceptable use policy. Loss of Belcloud as upstream would force DEDBROPRO to route exclusively via RASCOM, degrading connectivity quality and increasing its dependency on Russian infrastructure.
• OFAC sanctions designation: If sufficient financial flow evidence (wallet addresses, transaction clusters) linking DEDBROPRO to U.S.-nexus crimes is developed, an OFAC SDN designation of Vault Dweller OU is possible under existing cybercrime-related Executive Orders.

Connected Groups and Ecosystem Relationships

The following connected entity assessments apply two independent confidence tiers per the schema requirement. Every claim includes both Tier 1 (infrastructure relationship: did this BPH host their infrastructure?) and Tier 2 (operational relationship: did the BPH operator know the client identity or coordinate operationally?) assessed independently.

Entities with No Formal Assessment

The following security vendors and organizations have not published formal assessments of DEDBROPRO as of June 2026: Recorded Future, Mandiant (Google), CrowdStrike, Secureworks, Proofpoint, Microsoft MSTIC, Palo Alto Unit 42, Cisco Talos, Trend Micro, ESET, Kaspersky (public reporting), F-Secure/WithSecure, Group-IB, Team Cymru, SilentPush, DomainTools. This reflects the provider's relatively recent and lower-profile operational footprint compared to larger BPH operators that have attracted formal research attention.

Trajectory Assessment

Infrastructure Churn

Infrastructure churn for DEDBROPRO is assessed as LOW relative to more mature BPH operators. AS203834 has maintained a stable AS-name and single /24 allocation since creation in 2022 without documented rebranding, prefix changes, or upstream provider shifts. C2 infrastructure documented in the 195.82.147.x space showed persistence over months (ThreatFox first sighting 2024-10-16, last 2025-05-30) rather than days, indicating that clients are not being rapidly ejected or forced to rotate infrastructure. The Carder.su advertisement as of March 2026 uses identical contact details (Telegram, Jabber, website) as documented in earlier periods, confirming channel stability. [1][2][7]

Market Position

DEDBROPRO occupies the entry-level to mid-tier BPH market segment. Pricing ($5 VPS entry point, $149 dedicated server entry) is competitive with other smaller CIS-affiliated BPH providers but well below the scale of established large-capacity BPH operators (e.g., Media Land LLC, PROSPERO/Bearhost) with multi-ASN infrastructures and thousands of IPs. The addition of a 10 Gbps dedicated tier ($300+/month) since the Carder.su advertisement suggests incremental product expansion. The use of Carder.su — a well-established Russian-language carding forum — as the primary criminal advertising venue gives DEDBROPRO access to a large, established criminal audience without requiring invitation-only forum presence. [2][3]

Disruption History

No disruption events documented as of June 2026. The provider has not been subjected to LE-driven infrastructure seizures, upstream provider de-peering, domain takedowns, or sanctions designations. This is the baseline trajectory condition for an active, undisrupted provider.

Trajectory Direction

Mandatory Intelligence Gaps

Recent Reporting

Source Integrity Notes

Open-Source Researcher Disclosure

The most specific recent open-source reporting on DEDBROPRO beyond abuse.ch feeds is a May 2025 X post by researcher @drb_ra disclosing Remcos C2 infrastructure on DEDBROPRO-AS at 195.82.147.97:443. This is a single-source disclosure tagged as unverified in ThreatFox. No major security vendor has published a formal technical report or blog post on DEDBROPRO as of June 2026. The provider remains below the attention threshold of mainstream threat intelligence publication cycles. [6]

Sources