TL;DR: The decline of dominant bulletproof hosting providers has produced a more fragmented market of upstarts, resellers and mixed-use infrastructure, while law enforcement pressure, sanctions and customer migration are redistributing rather than eliminating abuse-resistant capacity, according to Intel 471 research. For defenders, infrastructure disruption now demands cluster-based tracking and behavior-based controls, not simple IP blocking.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Intel 471's research: The collapse of older bulletproof hosting leaders has accelerated a fragmented market of new providers, resellers and mixed-use infrastructure that still supports phishing, malware, extortion and fraud operations.
Why it matters: It matters because security teams cannot treat takedowns as permanent fixes when adversaries can rapidly migrate to new hosting, rebrand services and hide behind legitimate infrastructure.
Context
Bulletproof hosting is abuse-resistant internet infrastructure rented to cybercriminals, usually with weak abuse handling, layered resellers, jurisdictional insulation and fast rotation that make takedowns difficult. The problem is not just where malicious content is hosted, but how the hosting market itself preserves attacker continuity and complicates attribution.
That matters for identity, credential theft and fraud operations because the same infrastructure hosts phishing kits, credential-harvesting pages, C2 servers and extortion portals. When the hosting layer is resilient, campaigns can survive longer, rotate faster and keep operating after partial disruption.
Key questions
A: Treat the disruption as partial until you verify that the infrastructure graph has collapsed. Continue monitoring the same domains, certificates, name servers and passive DNS history, because malicious operators often migrate rather than disappear. The response goal is to preserve detection continuity and remove remaining service paths, not to assume the original takedown ended the campaign.
Q: Why do attackers keep abusing Microsoft SharePoint for phishing and credential theft?
A: Attackers prefer SharePoint because it combines legitimate authentication, trusted user relationships, and widely recognized URLs and templates. That makes malicious messages harder to spot and easier to trust. Once a user authenticates, the attacker can steal credentials, access documents, and potentially move laterally. The platform’s legitimacy becomes part of the attack path.
Q: What are the signs that bulletproof hosting is being replaced rather than eliminated?
A: Watch for customer domains moving to new providers, private or referral-only service models, short-lived VPS usage, rotating DNS patterns and public forum chatter about outages or bans. Those signals usually indicate redistribution of demand, not the disappearance of the underlying abuse ecosystem.
A: A legitimate hosting brand can still carry malicious tenants, so the decision should rest on the specific domain, certificate, DNS and behavior profile. The operational question is whether the exact asset cluster is being used for abuse, not whether the broader provider is well known or widely used.
Technical breakdown
How fast-flux hosting keeps malicious services online
Fast-flux hosting rotates front-end IP addresses and supporting infrastructure quickly enough to frustrate blocklists, seizure actions and simple reputation-based controls. In practice, the attacker points a domain to many changing IPs, often spread across multiple providers and autonomous systems, while the underlying domain, DNS and certificate patterns remain stable enough for the operator to keep control. This model does not require a single durable server. It requires durable coordination across disposable infrastructure, which is why the hosting layer becomes part of the criminal operating model rather than just a delivery mechanism.
Practical implication: Track the infrastructure cluster, not the individual IP, and correlate DNS, certificate and hosting changes before you rely on block decisions.
Why legitimate cloud services still appear in abuse infrastructure
Abuse infrastructure often migrates into legitimate or mixed-use hosting because that environment offers scale, availability and less obvious suspiciousness than classic underground providers. The security issue is not that the provider is malicious by default. It is that adversaries can place hostile domains, reverse proxies and phishing content inside ordinary hosting ecosystems and blend into normal traffic patterns. That makes enforcement harder, because defenders must distinguish the service provider from the specific assets, certificates, domains and behaviors being abused.
Practical implication: Apply domain, certificate and behavior-based detection rather than blocking an entire hosting brand when only a subset of assets are malicious.
What customer migration reveals about abuse-resistant infrastructure
When a bulletproof hosting provider is disrupted, customers rarely disappear with it. They migrate to other providers, move behind different reverse proxies or continue operating through previously configured infrastructure if the operator is merely sidelined rather than fully removed. The result is displacement, not eradication. In the article's case, a large portion of domains remained active even after the operator's disappearance, which shows that the technical substrate can outlive the public brand or forum presence that originally exposed it.
Practical implication: Preserve historical telemetry so you can follow migrations and continue detection after the original provider or operator disappears.
Threat narrative
Attacker objective: Keep criminal services available long enough to support phishing, malware delivery, fraud and extortion while reducing the chance of takedown or attribution.
- Entry begins with abuse-resistant infrastructure, including VPS, proxies and domain services, that allows criminal operators to host phishing, malware and extortion services with low takedown risk.
- Escalation happens when operators add fast-flux rotation, reseller layers and jurisdictional insulation so blocklists, seizures and abuse reports cannot reliably remove the service.
- Impact is the continued availability of credential theft, malware distribution, fraud panels and command-and-control infrastructure even after law enforcement pressure disrupts individual providers.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Bulletproof hosting is now an infrastructure governance problem, not just a takedown problem. The market is fragmenting because enforcement actions remove operators faster than the ecosystem removes demand. That means defenders must assume replacement capacity will appear quickly through resellers, private arrangements or mixed-use cloud services. The practical implication is to govern malicious infrastructure as a moving cluster, not as a single host or ASN.
The criminal hosting supply chain now mirrors legitimate resilience engineering. Fast-flux rotation, multiple upstream providers and layered resellers create redundancy that frustrates response and attribution. That architecture does not just support malware delivery. It also extends the lifespan of credential-harvesting pages and extortion portals, which is why identity security teams should treat hosting resilience as part of phishing and credential-theft risk. A provider may be neutral, but the abuse pattern is not.
Disruption without infrastructure removal produces migration, not closure. The article's migration data shows that a large share of customer domains stayed active after the original service was disrupted, which is a clear signal that operator-focused actions alone are incomplete. This is the same failure mode defenders see when adversaries retain their DNS, certificates or proxy stack after a takedown. The governance lesson is to measure continuity across infrastructure, not just public operator status.
Identity and fraud teams should pay attention to the hosting layer because it carries the delivery environment for credential abuse. Phishing kits, fake marketplaces and credential-harvesting pages depend on accessible hosting just as much as they depend on stolen identities. When those services can move quickly between providers, incident response slows and fraud operations gain time. That makes infrastructure mapping a necessary input to identity threat intelligence, not a separate exercise.
Abuse-resistant hosting is becoming a recurring control gap in cybercrime disruption strategy. Authorities can sanction, seize or indict operators, but the underlying network of domains, certificates and proxy services can remain functional. That gap is why defender programs need better linkage between infrastructure telemetry and abuse reporting. The practitioner conclusion is simple: target the service graph, not the headline event.
What this signals
Abuse-resistant hosting is becoming a continuity layer for cybercrime. The practical consequence is that defenders need to plan for reappearance, not just removal, because displaced infrastructure can reconstitute under new brands, resellers or legitimate providers.
Infrastructure mapping now sits alongside identity threat intelligence. Phishing and credential theft campaigns depend on hosting durability as much as they depend on stolen credentials, which makes passive DNS, certificate history and domain lineage essential signals in fraud and IAM-adjacent investigations.
Service displacement is the new normal: when operators lose one hosting channel, the campaign often survives through customer migration, private service models or mixed-use cloud infrastructure. That means response teams should measure continuity across the service graph, not just the status of a single provider.
For practitioners
- Track infrastructure clusters rather than single IPs Correlate passive DNS, certificates, autonomous system data and domain registration records so migrated services remain visible after IP rotation or provider changes.
- Use behavior-based blocking for mixed-use providers Block malicious domains and infrastructure patterns, not an entire hosting brand, unless you have evidence that the specific asset cluster is abusive.
- Preserve historical telemetry for post-disruption analysis Retain DNS resolutions, WHOIS, hosting relationships and certificate history so you can identify rebranded services and customer migration after enforcement actions.
- Monitor fast-flux indicators continuously Alert on rapidly changing IP pools, low TTL values, shared name servers and frequent provider switching because these patterns often indicate abuse-resistant hosting.
- Coordinate abuse reports with complete evidence packages Share domains, IPs, timestamps and related malicious activity with registrars, hosting providers, CERTs and law enforcement so takedown efforts can follow the service graph.
Key takeaways
- Bulletproof hosting disruption rarely ends malicious operations outright, because customers and operators can migrate to new providers or existing infrastructure.
- The article shows that a large share of previously tracked customer domains remained active after disruption, which is strong evidence of partial rather than total impact.
- Defenders should focus on infrastructure clusters, DNS and certificate lineage, and behavior-based blocking instead of relying on IP-only takedowns.
Related NHI Mgmt Group resources: CNAPP Guide · Password Spraying and Credential Stuffing Defence Guide · Third-Party AI Risk Guide · Sisense breach 2024
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0003; TA0010; TA0040 — Persistence; Exfiltration; Impact | The article describes criminal infrastructure that preserves attacker persistence and enables downstream impact. |
| Recommendation — Map abuse-hosting patterns to persistence, exfiltration and impact tactics to guide detection and disruption priorities. | ||
| NIST CSF 2.0 | DE.AE-02 — Anomalous Activity Detected | Fast-flux rotation and migration require anomaly detection across DNS, hosting and certificate telemetry. |
| RS.MA-01 — Incidents are Managed | The article shows takedowns and sanctions need coordinated response across providers and authorities. | |
| Recommendation — Correlate DNS and hosting anomalies to identify malicious infrastructure that survives simple blocklists. Coordinate abuse reporting and incident management across registrars, hosts and law enforcement to disrupt the full service graph. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | The recommendations stress coordinated takedown, evidence sharing and post-disruption monitoring. |
| Recommendation — Build abuse-reporting and post-disruption monitoring into incident response so replacement infrastructure is caught quickly. | ||
| OWASP API Security Top 10 | API9 — Improper Inventory Management | The core challenge is maintaining inventory of shifting malicious infrastructure and its linked assets. |
| Recommendation — Maintain an inventory of domains, certificates and hosting relationships so migrated abuse assets remain detectable. | ||
Key terms
- Bullet-Proof Hosting: Bullet-proof hosting is hosting designed to resist takedowns, complaints, and law enforcement pressure. Operators use it to keep malicious sites, command infrastructure, or payment services online for longer periods. In cybercrime ecosystems, this kind of resilience supports ransomware, malware delivery, and other abuse that depends on persistent access.
- Fast-Flux Hosting: Fast-flux hosting is a rotation technique that rapidly changes the IP addresses behind a domain to make blocking and seizure harder. The domain often stays stable while the underlying network shifts, which helps keep malicious services online and complicates attribution and infrastructure tracing.
- Passive DNS: Passive DNS is historical DNS observation data used to understand how domains and subdomains have resolved over time. Security teams use it to uncover assets that may not appear in current scans or certificate logs. That makes it valuable for identifying hidden, legacy, or previously exposed infrastructure.
- Abuse-Resistant Infrastructure: Abuse-resistant infrastructure is hosting and network capacity designed, repurposed or tolerated to remain available despite security complaints or enforcement pressure. In cybercrime ecosystems, it preserves attacker continuity by absorbing takedowns, supporting rapid migration and reducing the operational cost of rebuilding campaigns.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org