B is for Bulletproof — The Host That Never Answers

TI-2026-071B · Series: 🕰️ The Alphabet of Harm · Letter B · TLP:WHITE · 2026-07-09

The alphabet of harm continues. A was for APT, and its verdict was MUTATED — the apex predator became the weather. B is the opposite finding. Some harm does not mutate at all. It simply refuses to end, in nearly the same form, for two decades, because the thing that produces it never changes. This is the letter where the archive photograph and the present weather are the same picture.

📋 The Short Version

A bulletproof host is defined by a single behavior: it does not answer. Send an abuse complaint — a spam report, a malware URL, a notice that a phishing kit or a child-exploitation site is running on its IP space — and nothing happens. No takedown, no reply, no consequence. It is hosting sold specifically on the promise of that silence, sited in a jurisdiction that will not compel the provider to break it.

The archive remembers this modality's birth. It has names and dates: the Russian Business Network, operating out of St. Petersburg around 2007, and the McColo takedown of November 2008, after which the world's spam volume fell by roughly two-thirds in a single day. That day proved bulletproof hosting is a real, hittable chokepoint. The weeks after it proved something worse: hit it, and it grows back.

Nineteen years later, our own intelligence graph flags more than two dozen live autonomous systems as bulletproof at risk scores of 98 to 100 — and the roster is no longer Russian. It is global, and it has an American address. The names have cycled a dozen times. The function has not changed at all.

Verdict: CONTINUES. Bulletproof hosting did not end and was never structurally defeated. Individual hosts were caught — McColo, REvil — and every time the tier regenerated under a new name. Of all the letters in this alphabet, this is the one whose 2007 photograph and 2026 weather report are nearly identical. Only the disguise mutated: from a name you could point at, to a lease you cannot resolve. Confidence: HIGH on the present census and the archived enforcement actions. MEDIUM on the strong claim of causal continuity — that today's tier descends from RBN rather than being repeatedly re-invented by the same permanent incentives (§9).

1. The Refusal

Every other harm in this alphabet is defined by an action — a technique, a theft, a wiretap. Bulletproof hosting is defined by an inaction. It is the business of not responding.

Understand what a normal host does. It has an abuse desk. When a complaint arrives — your IP is sending malware, hosting a phishing page, running a botnet controller — a legitimate provider investigates and, usually, suspends the customer. This is the immune system of the internet: distributed, imperfect, but real. Abuse reporting works because most hosts, most of the time, act on it.

A bulletproof host is the deliberate removal of that immune response. It advertises, sometimes explicitly on criminal forums, that it will ignore abuse complaints, resist law-enforcement requests, and keep your content online through the storm. It charges a premium for the silence. The customer is buying not a server but an absence of consequences — and that absence is the single most valuable commodity in the criminal supply chain, because every other crime in this alphabet has to run somewhere.

That is why B comes so early. Nearly every other letter — the ransomware, the credential harvester, the surveillance vendor, the darknet market — needs a floor to stand on that will not open beneath it. Bulletproof hosting is that floor. Kill it and everything above it falls. Which is exactly why people have tried.

2. The First Names

The archive's memory of this modality begins with a company that barely pretended.

The Russian Business Network (RBN), active around 2007 from St. Petersburg, is the archetype every later analysis measures against. It sold hosting to spammers, malware operators, phishing crews, and child-exploitation sites, and it operated on the principle that has defined the tier ever since: complaints went into a void. RBN did not have a compliant abuse desk that was slow. It had, functionally, no abuse desk at all — and a jurisdiction that made that a viable business model rather than a crime.

The archive's first great counterexample came a year later. On 11 November 2008, the upstream providers of McColo — a bulletproof host operating, notably, from the United States — cut it off the internet. The effect was instantaneous and staggering: global spam volume dropped by approximately two-thirds overnight. For a few weeks, the inbox of the entire planet got quieter, because a single chokepoint had been pulled.

Hold both of those facts, because together they are the whole story of this letter:

• RBN proves the modality is old and structural. It was not a glitch; it was a business, documented and named nearly two decades ago.
• McColo proves the modality is real and hittable. Bulletproof hosting is not an abstraction. It is concrete infrastructure with a plug, and pulling the plug measurably reduces harm across the whole internet.

And then the weeks after McColo prove the third fact, the one that turns this into a CONTINUES verdict rather than an ENDED one: the spam came back. Not from McColo — from its successors, who had learned the lesson and spread their eggs across more baskets. The takedown removed a company. It did not remove the demand, the jurisdictions, or the market. The floor was rebuilt somewhere else within a month.

3. The Caught Column

It would be dishonest to write this letter as if enforcement never lands. It does, and the library holds the receipts. The alphabet promised a ledger with a "caught" column, and bulletproof hosting has real entries in it.

The great disconnection (2008). McColo itself is the caught column's finest hour — a bulletproof host removed from the internet by coordinated upstream action, with a globally measurable drop in harm. It remains the proof-of-concept that the tier is not untouchable.

The ransomware arrests (2021-2022). US Treasury's 2022 National Money Laundering Risk Assessment records the November 2021 action in which the DOJ charged a Ukrainian national and a Russian national with breaking into victim networks and deploying ransomware. The DOJ seized $6.1 million traceable to ransom payments; an arrest was made in Poland, with interviews and searches across Latvia, Estonia and elsewhere; and OFAC designated both individuals. Arrest, seizure, and sanction, together — the full apparatus, actually reaching two named human beings.

The cash-out sanctions (2022). OFAC's designations of the Tornado Cash and Blender.io cryptocurrency mixers extended the same reach to the layer beneath the hosting — the plumbing through which extortion and theft proceeds are washed. When the hosts themselves sit beyond jurisdiction, sanctioning their money rails is the enforcement apparatus's alternative lever.

These are genuine wins, and they matter. But notice their shape. Each one reaches a specific, identified target — a company with a plug, two named humans, two named mixers. Each is a precision strike on a node. And the tier is not a node. It is a market, and a market does not die when you arrest one of its vendors. It reprices, reroutes, and reopens under a new name — which is precisely what the present census shows.

4. Why It Always Comes Back

The reason bulletproof hosting refuses to end is not that enforcement is weak. It is that the modality sits on two permanent foundations, and neither can be arrested.

The demand is permanent. Every profitable cybercrime needs infrastructure that will not be pulled out from under it mid-operation. As long as ransomware, phishing, credential theft, and darknet commerce are profitable — and they are enormously profitable — there is a bid for hosting that ignores abuse reports. You cannot indict a demand curve.

The jurisdiction is permanent. Bulletproof hosting is, at bottom, a regulatory-arbitrage business. It exists wherever a provider can operate abusively without the local state compelling it to stop — whether because the state cannot, will not, or quietly benefits. There will always be somewhere on earth where that is true, and the tier migrates to wherever it currently is. McColo taught operators to distribute; every takedown since has taught them to distribute further, front more, and name themselves more innocently.

So the pattern is not a failure of the caught column. It is a structural property of a market built on permanent demand and permanent arbitrage. Enforcement can raise the cost, disrupt a season, seize a fortune — and it should. But it is fighting weather, not an enemy. The verdict CONTINUES is not a criticism of anyone. It is a description of a system that regenerates by design.

4b. The Price of Silence

There is one more permanent foundation, and it is the one that ties the demand and the jurisdiction together: silence is expensive, and someone is always willing to pay for it. Bulletproof hosting is not sold at the price of hosting. It is sold at the price of hosting plus the price of a guarantee \u2014 that when the abuse reports come, and they will, the provider will absorb them rather than act on them. A criminal operator paying a large multiple over normal hosting rates is not buying better hardware. They are buying an insurance policy against the internet\u2019s immune system, and the premium is the whole margin of the business.

That pricing is why enforcement cannot win on cost alone. Raise the risk to the provider \u2014 through takedowns, sanctions, upstream pressure \u2014 and the provider simply raises the premium, because the demand is inelastic: a ransomware crew mid-campaign will pay almost anything to keep its infrastructure online for another week. The cost of a takedown is passed straight through to the customer as a higher rent, and the tier keeps clearing the market at a new, higher price. This is the quiet engine underneath the CONTINUES verdict. It is not that the modality resists disruption by hiding. It is that it resists disruption the way any profitable market does: by repricing. You can make bulletproof hosting more expensive. You have never been able to make it unprofitable, because the thing it sells \u2014 the absence of consequence \u2014 is worth more to a criminal than any takedown costs them.

5. The Present Census

Here is the modality in the present tense, as our own intelligence graph sees it: more than two dozen autonomous systems flagged bulletproof at risk scores of 98 to 100. And the single most important thing about the list is its map.

Read the bold row again. Some of the highest-risk bulletproof ASNs on earth are registered in the United States. This is the finding that breaks the intuitive model. Bulletproof hosting is popularly imagined as a Russian export — something that happens "over there" and can be filtered at the border. The census says otherwise. It is a global service tier with domestic shells in the very countries whose enforcement apparatus runs the caught column. The RBN of 2007 was in St. Petersburg; its 2026 cousins are in Delaware-adjacent paperwork.

This is why geography-based defense fails against bulletproof hosting. "Block the bad country" cannot work when a bulletproof ASN can be registered anywhere, including next door. The flag on the ASN is not the signal. The behavior — the abuse tolerance, measurable as sustained high-effective-bad-rate traffic that no one upstream ever chokes off — is the signal.

6. The Ones We Actually Catch

The census is the landscape; the wire is the encounter. The bulletproof hosts our own sensors observe striking the edge are not abstract — they are the recurring cast of this entire corpus:

• TechTies Inc. (AS197170) — a Seychelles-registered shell allocated barely a week before it began appearing, the durable bulletproof base beneath the credential secret-harvest (dossier 059A). Registry-fresh, Spamhaus-listed, and immediately operational.
• Omegatech LTD (AS202412) — Seychelles again, appearing across multiple malware families as shared distribution substrate.
• Private Layer INC (AS51852) — Panama, the 179.43.128.0/18 block, one of the highest-volume attacker networks in the honeypot record.
• w1n ltd (AS42237) and PIO-Hosting (AS198584) — the German and offshore shells this corpus has profiled repeatedly.

These are live sources of credential-harvest and scan traffic right now. The archive's RBN and the wire's TechTies are the same animal at nineteen years' distance — a host in a permissive jurisdiction, freshly incorporated, that will not answer for what runs on its IPs. The name changed. The refusal did not.

7. The New Disguise

If the function is unchanged, one thing genuinely has evolved: the camouflage. And it is measurable.

RBN was a name you could point at. It was more or less openly a criminal ISP. Its modern heirs have learned that being nameable is a liability, and they have dissolved into the IP-leasing structure — the one place where ownership itself becomes unresolvable. Per the ownership-conflict layer of this corpus (dossier 068B), when you ask who owns a contested IP, the network announcing it via BGP is a different legal entity than the one it is registered to in RDAP — and that mismatch appears in 79% of contested-ownership IPs. The registrants are frequently the IP brokers themselves (PrefixBroker, IPXO, IPv4 Superhub, Leaseweb), leasing blocks to differently-named operators.

This is bulletproof hosting's mutation, and it is elegant. The modern abuse-tolerant host does not look criminal. It looks like a normal lease. A broker holds the deed; a tenant flies a bland flag; the announcing network says "we only route it"; the registrant says "we only lease it"; the operator says "we only rent it." Accountability is shredded across three or four parties by design, so that an abuse report has no single place to land. RBN ignored your complaint. Its heir has arranged that there is no longer a coherent "it" to complain to.

The function — silence in the face of abuse — is exactly what it was in 2007. The mechanism for producing that silence upgraded from a defiant refusal to a diffuse, deniable, legally-adjacent fog. That is the only thing about bulletproof hosting that mutated. Everything else CONTINUES.

8. The Verdict

Set the archive beside the wire and, for once, they show the same photograph.

• Did it end? No. Twenty-five-plus live ASNs sit at 98-100 risk today, on five continents.
• Was anyone caught? Yes — genuinely. McColo was disconnected; REvil operators were arrested, seized from, and sanctioned; mixers were designated. The caught column has real entries.
• What did it become? The same thing it always was, wearing a better disguise. The function — refusal — is unbroken since 2007. Only the mask evolved, from a nameable criminal ISP to an unresolvable lease.

Verdict: CONTINUES. This is the letter that establishes the alphabet's second law, the counterpart to A's first. A (naming is not consequence) explained why the archive's harms mostly went unpunished. B explains why some of them, even when they were partly punished, still did not end: because where the incentive is permanent — permanent demand meeting permanent regulatory arbitrage — no takedown is more than a season's disruption. The tier is not an enemy to be defeated. It is a market to be perpetually managed, and managing it means giving up the fantasy that the next McColo will be the last one.

There is a strange comfort buried in that. A was a story of a monster diffusing into everything. B is a story of a monster that never even bothered to change, because it never had to. And a harm that has not changed in nineteen years is, at least, a harm we understand completely. We know exactly what it is: the host that never answers. We know exactly where it lives: wherever answering is optional. And we know exactly how to see it, even through the leasing fog: not by its name or its flag, but by the one thing it cannot fake — the sustained, unpunished, high-bad-rate traffic that no upstream ever chokes. Behavior over reputation, one more time, all the way back to 2007.

9. Method Note — The Honest Limit

Two honest limits close the letter.

First, "bulletproof" is a risk label, not a court verdict. The 98-100 risk scores in the census are our graph's assessment of abuse-tolerance from observed behavior, spamhaus/feed signals and network characteristics — not a legal finding that each provider is a knowing criminal enterprise. Some high-risk ASNs are negligent rather than complicit; some are budget hosts overwhelmed by abuse they lack the resources to police. The behavior — sustained tolerance of high-bad-rate traffic — is what the label captures, and behavior is what should drive a defensive block. The label is a hypothesis about intent; the traffic is the fact.

Second, continuity of form is not proof of continuity of lineage. That today's TechTies resembles 2007's RBN does not mean a direct organizational thread runs between them. The stronger, well-supported claim is that the same permanent incentives — criminal demand plus jurisdictional arbitrage — keep re-producing the same form, whether or not any operator descends from any earlier one. The modality CONTINUES; the genealogy of any single host is a separate and weaker question, held at MEDIUM. As always: the vectors do not lie about what the host is doing now. They are more careful about who its grandfather was.

Investigation Metadata

Cross-references: TI-2026-071A (A is for APT — MUTATED, the companion verdict) · TI-2026-068B (The Deed and the Tenant — the modern leasing disguise) · TI-2026-059A (The Secret Harvest — TechTies as the bulletproof base) · TI-2026-066E (The Bulletproof Midtier) · TI-2026-024 / 026 series (the offshore bulletproof ecosystem).