Topic starter
27/10/2026 7:04 pm
TL;DR: The decline of dominant bulletproof hosting providers has produced a more fragmented market of upstarts, resellers and mixed-use infrastructure, while law enforcement pressure, sanctions and customer migration are redistributing rather than eliminating abuse-resistant capacity, according to Intel 471 research. For defenders, infrastructure disruption now demands cluster-based tracking and behavior-based controls, not simple IP blocking.
Editorial analysis by NHI Mgmt Group, based on content published by Intel 471: “A New Era of Bulletproof Hosting Providers Emerge”.
Key questions
A: Treat the disruption as partial until you verify that the infrastructure graph has collapsed.
Q: Why do attackers keep abusing Microsoft SharePoint for phishing and credential theft?
A: Attackers prefer SharePoint because it combines legitimate authentication, trusted user relationships, and widely recognized URLs and templates.
Q: What are the signs that bulletproof hosting is being replaced rather than eliminated?
A: Watch for customer domains moving to new providers, private or referral-only service models, short-lived VPS usage, rotating DNS patterns and public forum chatter about outages or bans.
Practitioner guidance
- Track infrastructure clusters rather than single IPs Correlate passive DNS, certificates, autonomous system data and domain registration records so migrated services remain visible after IP rotation or provider changes.
- Use behavior-based blocking for mixed-use providers Block malicious domains and infrastructure patterns, not an entire hosting brand, unless you have evidence that the specific asset cluster is abusive.
- Preserve historical telemetry for post-disruption analysis Retain DNS resolutions, WHOIS, hosting relationships and certificate history so you can identify rebranded services and customer migration after enforcement actions.
Bottom line: Bulletproof hosting disruption rarely ends malicious operations outright, because customers and operators can migrate to new providers or existing infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/10/2026 9:26 pm
Bulletproof hosting is now an infrastructure governance problem, not just a takedown problem. The market is fragmenting because enforcement actions remove operators faster than the ecosystem removes demand. That means defenders must assume replacement capacity will appear quickly through resellers, private arrangements or mixed-use cloud services. The practical implication is to govern malicious infrastructure as a moving cluster, not as a single host or ASN.
A question worth separating out:
A: A legitimate hosting brand can still carry malicious tenants, so the decision should rest on the specific domain, certificate, DNS and behavior profile. The operational question is whether the exact asset cluster is being used for abuse, not whether the broader provider is well known or widely used.
👉 Read our full editorial: Bulletproof hosting fragmentation is reshaping cybercrime infrastructure