Loading story…
Dutch police have seized approximately 250 physical servers and thousands of virtual servers belonging to an unnamed bulletproof hosting provider operating out of The Hague and Zoetermeer. This hosting service, active since 2022, was used exclusively by cybercriminals and has been linked to over 80 cybercrime investigations both in the Netherlands and internationally. The provider advertised complete anonymity, did not enforce Know Your Customer (KYC) policies, and refused to cooperate with law enforcement, making it a popular choice for threat actors.
The infrastructure supported a range of illicit activities, including ransomware operations, malware distribution, phishing campaigns, botnet control, and the hosting of child abuse content. The takedown blocks further criminal use of the service and enables forensic analysis of the seized servers to identify operators and clients. No arrests have been announced yet, but the operation is expected to provide valuable intelligence for ongoing and future investigations into cybercrime facilitated by bulletproof hosting services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After the seizure, Dutch police said they would conduct forensic analysis of the confiscated infrastructure to identify the hosting service's operators and customers. Authorities did not confirm the provider's identity at the time of the announcement.
Dutch police seized infrastructure supporting an unnamed bulletproof hosting provider, taking about 250 physical servers and thousands of virtual servers offline. Authorities said the service had appeared in more than 80 cybercrime investigations in the Netherlands and abroad, and no arrests were announced.
Reporting cited by BleepingComputer indicated the impacted infrastructure may be connected to CrazyRDP, a no-KYC, no-logs VPS/RDP provider that reportedly went offline around November 12. Dutch authorities did not confirm that attribution.
Dutch authorities said the unnamed bulletproof hosting provider had been active since 2022, offering anonymity and refusing cooperation with law enforcement. Investigators later linked the service to ransomware, botnets, phishing, and child abuse content distribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat intelligence reporting identified bulletproof hosting as a key enabler of long-running cybercrime campaigns, with providers such as **Void Griffon** offering dedicated servers, VPS/VDS instances, domain registration, API access, and **FastFlux** services that kept malicious infrastructure online for years. Researchers found that multiple malware families and phishing operations relied on these resilient services, while broader analysis showed criminals also combining compromised servers, cloud assets, botnets, proxies, VPNs, Tor, dynamic DNS, and decentralized DNS to support command-and-control, spam, fraud, data exfiltration, and ransomware deployment. Additional investigations tied shared hosting patterns to coordinated malicious infrastructure used for **Magecart**, **IcedID**, **Qakbot**, **Ursnif**, and brand-spoofing phishing campaigns, with synchronized IP rotation and recurring registrar and nameserver choices suggesting infrastructure-as-a-service for cybercrime. Intrinsec later linked a reused SSH fingerprint across about **138 servers** to **ShadowSyndicate**, connecting that infrastructure to **LockBit**, **Cl0p/TrueBot**, **RansomHub**, **Cicada3301**, **Atomic macOS Stealer**, and **RustDoor**, and assessed that the group likely depended on Russian-operated bulletproof hosting designed to resist takedowns while continuing to scan for vulnerabilities and deliver payloads.
Aug 15, 2026
Dutch financial crime investigators arrested two IT entrepreneurs and seized more than 800 servers, laptops, phones, and business records in raids targeting hosting infrastructure allegedly used for **cyberattacks, interference operations, and disinformation campaigns** linked to Russia. The suspects, identified in reporting as Andrey Nesterenko and Youssef Zinad, are accused of violating EU sanctions by providing economic resources to sanctioned entities. Authorities said the operation began on 18 May and included searches in Enschede and Almere and data centers in Dronten and Schiphol-Rijk. The investigation focuses on **Stark Industries**, a hosting provider sanctioned by the EU in 2025, and on Dutch-linked firms including **WorkTitans B.V.**, **`THE.Hosting`**, and **MIRhosting**, which investigators believe helped keep sanctioned infrastructure online after restrictions took effect. Multiple reports tied the network to infrastructure used by the pro-Russian group **NoName057(16)** and the **Doppelgänger** disinformation operation, while Dutch and European reporting also linked related services to attacks on Danish government bodies during municipal elections. MIRhosting denied knowingly supporting illegal activity and said it cooperated with authorities, but customers of related brands reported widespread outages and loss of access after the seizures.
Jun 29, 2026
International cybersecurity agencies have intensified efforts to dismantle bulletproof hosting providers (BPH), which supply resilient internet infrastructure to cybercriminals and ransomware groups. Authorities from the U.S., U.K., Australia, Canada, the Netherlands, and New Zealand have issued joint advisories and sanctions targeting BPH services that enable malware delivery, phishing, and illicit content hosting by ignoring abuse reports and law enforcement takedowns. The U.S. Office of Foreign Assets Control (OFAC) has sanctioned entities such as Media Land and its affiliates, which are linked to major ransomware groups including LockBit, BlackSuit, and Play. These coordinated actions aim to degrade the operational capabilities of cybercriminals by disrupting the infrastructure that underpins their activities. Guidance has been released to help internet service providers (ISPs) and network defenders identify and block malicious infrastructure associated with BPH services. The crackdown is part of a broader strategy to protect critical infrastructure, financial institutions, and other high-value targets from persistent cyber threats. The move underscores the growing recognition that disrupting the technical enablers of cybercrime is essential to reducing the global impact of ransomware, data breaches, and other forms of cyber-enabled fraud. Authorities emphasize the need for industry collaboration to effectively mitigate the risks posed by bulletproof hosting and to enhance the resilience of the digital ecosystem.
Jun 29, 2026