50 Shades of Bulletproof Hosting – BPH Landscape on Russian-Language Cybercrime Forums.

This report analyzes the 2024 landscape of bulletproof hosting (BPH) on Russian-language forums XSS and Exploit, cataloging 40 active services, their offerings (VPS/dedicated, domains, VPN/proxies, FastFlux), terms of service, infrastructure (including LIR/AS/IP ownership), pricing, and reputations. It synthesizes threat-actor feedback, outlines common pain points (stability, support, blacklisting), proposes a three-tier classification of BPH maturity, and highlights operational nuances such as shell companies and regional restrictions (e.g., CIS no-targeting). Two anonymized case studies illustrate the spectrum: a highly professionalized, multi-brand Tier 3 provider (Alpha) with significant infrastructure and revenue, and an opportunistic, smaller operation (Beta) that rents infrastructure and pivots across illicit services. The report emphasizes that while BPH enables cybercrime (including ransomware), it is neither uniform nor always necessary when alternative obfuscation strategies are used.