How hosting providers can battle fraudulent sign-ups

Spamhaus provides actionable guidance for hosting providers to detect and prevent fraudulent sign-ups used to host spam, malware, and botnet controllers. The document describes attacker methods (stolen payment credentials, disposable emails/SMS, VPN/back-end nodes, Tor usage), the operational impact on providers, and recommends defenses including identity and payment verification, blocklists, AUP/ToS enforcement, active traffic/netflow monitoring, IP/DNSBL checks (SBL/XBL/Tor), DROP/EDROP routing, geo-specific customer restrictions, and fast abuse desk response.