Infrastructure Layer

Bulletproof Hosting Profiles

Structural profiles of bulletproof hosting providers serving Russia/CIS-linked ransomware and cybercrime networks, covering ASN infrastructure, operator attribution, sanctions exposure, and disruption history.

Read first  ·  Cross-cutting analysis
The Enablement Layer
Every provider below depends on a commercial chain it does not own: upstream transit carriers, address registries, datacenters, and formation agents. This analysis covers why that layer permits them to operate, and where the leverage sits. State protection is assessed separately in Section 07 of each profile.
Upstream transit RIPE freeze, not revoke EU mere conduit Formation agents Cross-profile upstream map
Read the analysis ↗
Provider Profiles
BH
AS200593 // AS198953
Russian bulletproof hosting server infrastructure, Proton66 / PROSPERO / Bearhost network
Active
BPH-01 / Russia / No Sanctions
Bearhost / Underground / Voodoo Servers
Active since ~2019. PROSPERO OOO (AS200593) and PROTON66 OOO (AS198953). 3 brand identities. 10+ documented malware families. No law enforcement action to date.
View Profile ↗
DD
AS203834
BPH landscape on Russian-language cybercrime forums, Cybercrime Diaries research, 2024
Active
BPH-02 / Estonia Reg / No Sanctions
DEDBROPRO
AS created 2022, active from at least 2024. Vault Dweller OU, Estonia registration. Bulgaria-hosted infrastructure. 307 ThreatFox IOCs on ASN. Advertised on Carder.su (2026).
View Profile ↗
ML
AS206728
Yalishanda / Media Land, Analyst1 Infrastructure in the Shadows investigation, January 2026
Degraded
Sanctioned
BPH-03 / Russia / Sanctioned + Indicted
Media Land LLC / Yalishanda
Active since ~2009. St. Petersburg, Russia. AS206728 (~2,048 IPs). Sanctioned by the US, UK and Australia November 2025 and by the EU July 2026. Three principals indicted in the Northern District of Ohio, unsealed July 2026, with a $10M reward offered. None in custody.
View Profile ↗
SI
AS209847
Stark Industries Solutions homepage, KrebsOnSecurity investigation, May 2024
Degraded
Sanctioned
BPH-04 / Netherlands / EU RUSDA Sanctioned
Stark Industries Solutions
Founded Feb 2022. Amsterdam/The Hague operators. 800+ servers seized May 2026. 200+ prefixes still active. 4 named operators sanctioned. Successor ASN (AS209847) operational.
View Profile ↗
ZS
AS197414 (de-registered)
ZServers / XHost seized server equipment, Dutch police, Amsterdam datacenter, February 2025
Disrupted
Sanctioned
BPH-05 / Russia / 3 Sanctions Authorities
ZServers / XHost
Active ~2010 to February 2025. Barnaul, Altai Krai, Russia. 127 servers seized. $5.2M+ on-chain activity. 6 individuals sanctioned. ASN de-registered. Most thoroughly disrupted BPH profiled.
View Profile ↗
AZ
AS210644 (ASN-DROP)
Disrupted
Sanctioned
BPH-06 / Russia / 3 Sanctions Authorities
Aeza Group
St. Petersburg. MskHost successor. OFAC, UK, and AU sanctioned 2025. 6 individuals sanctioned, core leadership arrested in Russia April 2025. Infrastructure migrated to Hypercore (AS211522). Spamhaus ASN-DROP listed.
View Profile ↗
VL
AS214943 // AS202412
Active
BPH-07 / Kentucky Front / No Sanctions
Virtualine
Russia-linked cluster advertised as "DMCA & Abuse Ignored." Railnet LLC (Kentucky) backbone, ~95% routed via German upstream aurologic. OMEGATECH front and a fraudulently registered AS209800 (metaspinner impersonation). No named operator, no sanctions as of July 2026.
View Profile ↗