The Bulletproof Shelf: Where the Armory Is Stored

TI-2026-075V · The Armory, Part V Confidence: HIGH — direct honeypot ASN risk ranking + multi-source corroboration Classification: TLP:WHITE

Somewhere to keep the weapons

Every tool the census has catalogued has to live somewhere. A scanner runs from a host; a payload is staged on a server; a C2 node occupies an address. The armory is not abstract — it is stored, on real infrastructure that someone rents and someone operates. This letter is about that storage: the networks the offense keeps its tools on, and one particular shelf that is built for the purpose.

The honeypot's ASN risk ranking surfaces it clearly. A distinct set of networks score at or near the maximum — 100 — and carry a bulletproof flag: NOVACONN SRL (AS203462, Italy), Grand Tel (AS142063, Pakistan), CDS Global Cloud (AS63199, US), HOSTIGGER (AS205399, US), CYBERCON (AS7393, US), Host9x (AS203144, Hong Kong), Digit One LLC (AS8905, Russia), and others. These are the "bulletproof" providers — networks that, by reputation and observed behaviour, rent to whoever pays and do not act on abuse complaints. They are the reinforced storage of the offense, the shelf built to hold weapons that someone might come looking for.

But the interesting thing about the bulletproof shelf is not that it exists. It is how little of the armory actually sits on it.

Most of the armory is not here

The series has already, across its infrastructure letters, established where the tooling really lives — and it is mostly not on bulletproof networks.

The Cloud Contractor (075B) found the pentest arsenal concentrating on ordinary Google Cloud (AS396982) — a mainstream, reputable hyperscaler, not a bulletproof provider. The Tenant of Fifty-Six Networks (075G) dispersed 124 nodes across 56 mainstream commercial providers — OVH, Hetzner, DigitalOcean, Scaleway — none of them bulletproof. The Resident (075H) squatted on Vietnamese consumer broadband, hardware it did not even rent. Add these up and the overwhelming bulk of the armory's storage is disposable, reputable, ordinary cloud — the same providers a legitimate startup uses.

So the bulletproof shelf is not the main warehouse. It is the reinforced back room: smaller, more expensive, and chosen for a specific reason by a specific minority. A defender who equates "malicious hosting" with "bulletproof ASNs" — the intuitive move — will miss most of the armory, because most of the armory is sitting in plain sight on networks with excellent reputations. The bulletproof list is a real thing, but it is the exception, and mistaking it for the rule blinds you to the majority.

Who pays for the reinforced shelf, and why

If most operators are content with cheap disposable cloud, why does anyone pay the bulletproof premium? For exactly one reason: they expect takedown pressure, and they need infrastructure that will not fold under it.

The commodity floor treats hosting as disposable. Burn an address, rent another; the operation is designed so no single takedown matters (this is the whole logic of The Tenant, 075G). Those operators do not need bulletproof hosting because they do not need any particular host to survive — the fleet's resilience is in its disposability. The operators on the bulletproof shelf are making a different bet. They need persistence. Their infrastructure — a long-lived C2 server, a staging host, a control panel — is worth defending against complaints, worth paying extra to keep alive when the abuse reports start arriving.

That makes the choice of the bulletproof shelf a signal of intent. An operator who invests in takedown resistance is telling you something: that their operation is committed enough, persistent enough, and valuable enough to be worth protecting. The disposable-cloud majority is transient by design; the bulletproof minority is dug in. For a defender triaging threats, presence on the reinforced shelf is a coarse but real prior — the operators who paid to persist are, on average, the ones worth watching.

"Bulletproof" oversells the product

The name promises more than the product delivers, and the distinction matters for defence. A bulletproof flag and a near-100 risk score are descriptions of behaviour, not immutable properties. They mean the network has, historically, ignored abuse complaints and hosted malicious activity. They do not mean the network is indestructible.

Providers on this shelf do get taken down. They get de-peered, lose upstreams, get re-registered under new names, and re-appear with fresh ASNs — and the census tracks exactly these lifecycle events, watching bulletproof operations rise, get canonicalised, and sometimes get marked taken-down. The Cloud Contractor argued that operator reputation is not a packet-level trust signal — that a respectable ASN guarantees nothing about the traffic. The same holds in reverse: a provider's bulletproof reputation is not a packet-level guarantee of safety for the attacker, nor of permanence for the defender's blocklist. The shelf is reinforced, not eternal. An operator who trusts it completely is trusting a reputation with a shelf life, and a defender who blocklists it as a fixed fact is building on ground that shifts under re-registration.

A dial, not a fourth pole

It is tempting to add the bulletproof shelf to the infrastructure triptych as a fourth topology, but that would be a category error. Concentration (075B), dispersion (075G), and residence (075H) are three ways to shape a fleet. Bulletproof hosting is not a shape — it is a property of where the storage sits, and it cuts across all three shapes.

An operator can concentrate their tooling on a single bulletproof provider. They can disperse across several bulletproof networks. Or they can avoid bulletproof hosting entirely and run their whole shaped fleet on disposable mainstream cloud, as the Tenant did. The takedown-resistance of the hosting and the topology of the fleet are independent choices. So the cleanest way to model the bulletproof shelf is as a dial of commitment — how much an operator is willing to pay to make their storage resistant to complaints — turned independently of the dial that sets the fleet's shape. Profiling an operator means reading both dials: how their fleet is shaped, and how hard they have paid to keep its storage alive.

Reading the bulletproof shelf — for defenders

• Do not scope malicious-hosting detection to bulletproof ASNs. Most tooling lives on reputable, disposable cloud. Detect by behaviour and fingerprint across all hosting; ASN reputation is one signal among many, not the boundary of the threat.
• Read bulletproof hosting as a commitment prior. Operators who pay for takedown resistance are more persistent than the burn-and-re-rent floor. Presence on the reinforced shelf warrants extra attention.
• Treat bulletproof reputation as time-limited. These providers are taken down and re-registered. Refresh ASN reputation; do not build durable defence on the assumption a bulletproof ASN stays fixed.
• Track two dials, not one. Fleet shape (concentration/dispersion/residence) and hosting resistance (bulletproof/disposable) are independent. Profile both to understand an operator's commitment and topology together.

The armory has to be kept somewhere, and the intuitive picture — that dangerous tools live in dangerous, bulletproof corners of the internet — turns out to be mostly wrong. Most of the offense is stored in plain sight, on the same reputable cloud everyone else uses, because disposability is cheaper and better than shelter. The bulletproof shelf is real, but it is the small, expensive, reinforced back room where the committed operators keep the tools they cannot afford to lose — and even that room, for all its name promises, is one takedown away from being re-registered somewhere else.

Indicators (TLP:WHITE)

Cross-references

• TI-2026-075B — The Cloud Contractor — most tooling on ordinary cloud; disposability over shelter.
• TI-2026-075G / 075H — The Tenant / The Resident — fleet shapes that avoid bulletproof hosting entirely.
• TI-2026-075A — The Armory: What 12,000 Attackers Carry — the hosting dimension of the census.
• TI-2026-075I — The Weapon Is Never the Point — reputation (of tool or host) is not a packet-level guarantee.

This dossier documents observed malicious-hosting infrastructure for defensive purposes. ASN reputation is a time-limited behavioural signal; indicators are published to help defenders weight, not exclusively scope, hosting-based detection. TLP:WHITE.