Bulletproof Hosting Providers Exploit Legitimate ISPs to Power Cybercrime Servers

**Executive summary:** Researchers discovered that ISPsystem VMmanager's default Windows hostnames are identical across thousands of servers; many of these machines are concentrated at abuse-tolerant "bulletproof" hosting providers and have been used as infrastructure by major ransomware gangs (WantToCry, LockBit, BlackCat/ALPHV, Conti, Qilin), creating both a useful fingerprint for detection and a large, anonymized pool that criminals exploit.