Executive Summary
Coverage of phishing tends to stop at the kit. But a reverse-proxy kit or a ClickFix page has to run somewhere, and the somewhere is the part of the operation that persists across campaigns. Bulletproof hosting providers — operations that deliberately ignore abuse complaints, law-enforcement requests, and takedown notices — are the durable layer of the phishing supply chain. The lure changes weekly, the kit is rented, the domain rotates daily; the provider that keeps the lights on regardless is the reusable asset.
Two developments in the first half of 2026 sharpen the picture for defenders. First, on May 18, 2026, Dutch investigators seized more than 800 servers from a hosting operation tied to pro-Russian activity, and the aftermath was instructive: one network went dark entirely while a linked network kept scanning the internet straight through the raid. Takedowns disrupt unevenly and rarely permanently. Second, CISA and partners published "Bulletproof Defense" in January 2026, reframing BPH as a problem for ISPs and network defenders to mitigate through reputation-aware filtering and information sharing rather than something to wait out until the next seizure. Alongside both is a quieter operational shift: operators routinely front bulletproof origins with mainstream content delivery networks, so the IP a defender sees is a reputable CDN edge, not the malicious host behind it. The defensible signal lives at the infrastructure layer, and it requires looking past the front.
AttackAttack Overview
In supply-chain terms, bulletproof hosting sits beneath the lure and the kit and supplies what operators actually need: continuity. A BPH provider tolerates phishing pages, credential-kit backends, malware staging, and command-and-control on the same infrastructure that a compliant host would suspend within hours of the first complaint. That tolerance is the product. It lets an operator amortize the cost of standing up infrastructure across many campaigns, because the host will not act on the abuse reports that would otherwise force constant rebuilding.
The abuse patterns that BPH enables are well understood. Fast flux — rapidly rotating the IP addresses behind a domain, and sometimes the name servers themselves — spreads a single malicious service across many short-lived addresses to frustrate IP blocking and takedown. The same infrastructure hosts phishing pages, delivers malware, and runs C2, so a domain seen serving a credential kit today may front a loader tomorrow. Spamhaus and others have long tracked BPH as the substrate under this activity; what has changed is less the model than its packaging.
AttackInfrastructure & Tradecraft
The most consequential packaging change is the CDN hop. Rather than expose a bulletproof origin directly, operators place a mainstream content delivery network in front of it. To a resolver and to many detection pipelines, the malicious domain now points at a large, reputable CDN's edge IP — an address that appears in front of countless legitimate sites and that no defender can safely block wholesale. The malicious hosting hides one layer back, at an origin the CDN faithfully proxies to. Spamhaus has observed domains migrating from raw BPH infrastructure to sit behind CDNs as a matter of routine, and the effect is reputation laundering: the origin keeps the bulletproof provider's tolerance while the front borrows the CDN's trust.
The resilience of the underlying networks is the other half of the tradecraft, and the May 2026 Dutch case illustrates it precisely. The seizure took more than 800 servers, and one autonomous system associated with the operation — AS44477, the Stark Industries lineage — now announces zero routes and is effectively gone from the internet. But a linked network, THE.Hosting (AS209847), kept hitting external sensors at its normal daily scanning rate straight through the raid and the days after, and still announced 484 IPv4 blocks afterward; a secondary THE.Hosting system (AS213999) sat dormant, and Russia-based channels such as UFO Hosting (AS33993) persisted untouched. Eight days on, roughly a third of the previously active ranges had been withdrawn — and not one of them reappeared under a different network number, which reads less like remediation than like an operator trimming exposure while keeping the core running. Danish authorities tied the infrastructure to the group tracked as NoName057(16) and to attacks on Danish government bodies during the November 2025 municipal elections, and the network's day job was systematic scanning for exposed databases (MongoDB, Redis, PostgreSQL), admin panels, and industrial control systems. A seizure of the servers did not equal a seizure of the capability.
DetectionDetection Opportunities
If the durable asset is the hosting, the durable detection is infrastructure-aware. Enrich observed phishing domains and IPs with autonomous-system context and hosting reputation, and score by the provider and ASN rather than the individual address. Ranges and ASNs with a persistent history of abuse tolerance are a signal that survives the daily domain rotation the operator relies on to evade name-based blocking. Threat-intelligence feeds and community trackers that publish BPH ASNs and known-abusive ranges are the raw material; the value is in joining them to your own resolver, proxy, and mail telemetry.
The CDN hop demands a specific adjustment: do not treat a CDN edge IP as exculpatory. A domain that resolves to a reputable CDN can still be malicious, so anchor detection on the domain and its behavior — newly registered, low-reputation, appearing in a lure — rather than on the front IP. Where a CDN offers origin visibility, abuse reporting, or hostname-level blocking, use it; a takedown request to the CDN can sever the front even when the bulletproof origin is untouchable. Fast flux remains detectable at the DNS layer as abnormally short TTLs, high IP churn for a single hostname, and rapidly changing authoritative name servers.
// Score resolved phishing infrastructure by hosting reputation / ASN
// rather than by individual IP, so the signal survives daily domain and
// address rotation. Treat CDN-fronted domains on their own merits — a
// reputable edge IP is not exoneration. Join to your ASN/BPH watchlist.
let bphAsns = dynamic([44477, 209847, 213999, 33993]); // example; maintain from feeds
DnsEvents
| where TimeGenerated > ago(24h)
| where isnotempty(IPAddresses)
| mv-expand ResolvedIp = split(IPAddresses, ",") to typeof(string)
| extend Asn = tolong(geo_info_from_ip_address(ResolvedIp).autonomous_system_number)
| where Asn in (bphAsns)
| summarize Hosts = make_set(QueryName), Hits = count() by ResolvedIp, Asn, DeviceName
| project DeviceName, ResolvedIp, Asn, Hosts, HitsValidationValidation Workflow
Confirm your enrichment pipeline actually produces the ASN and hosting-reputation context these detections assume. In a controlled test, resolve a set of known-benign domains across a mix of hosting providers and verify that autonomous-system number, hosting organization, and any reputation score are attached to the event and reach your analytics. An infrastructure-scored detection is only as good as the enrichment behind it, and a silent gap there fails open.
Then validate the CDN-hop handling explicitly. Take a benign domain fronted by a CDN and confirm your logic evaluates it on domain reputation and behavior rather than dismissing it because the resolved IP belongs to a trusted CDN. Separately, exercise the fast-flux heuristics against a stand-in with deliberately short TTLs and rotating records to confirm they fire. Keep this to benign test infrastructure — the objective is proving the enrichment and scoring work, not interacting with live malicious hosting.
GapsEvasion & Gaps
The model is built to outlast disruption. Abuse tolerance means complaint-driven takedown does not work at the provider level, and where a provider is finally seized, the operator's habit of running linked networks and Russia- or otherwise-jurisdiction-shielded channels means capability persists — as the THE.Hosting network's uninterrupted scanning through the May 2026 raid demonstrates. Fast flux defeats IP-based blocking, and the CDN hop defeats naive IP reputation by placing a universally trusted edge in front of an untouchable origin. Sanctions and seizures raise costs and remove some infrastructure, but they operate on timescales far slower than domain and IP rotation.
The gap on the defender side is over-reliance on the two approaches that map poorly to this layer: blocking individual indicators, which the operator rotates faster than feeds propagate, and waiting for takedowns, which are uneven and reversible. Organizations that treat a CDN edge IP as automatically safe, or that lack ASN and hosting-reputation enrichment entirely, cannot see the persistent asset at all — they see only the perishable front.
Defensive Recommendations
Shift the unit of tracking from the indicator to the infrastructure. Enrich phishing telemetry with ASN and hosting-reputation data, maintain and consume watchlists of abuse-tolerant networks, and score domains and IPs by the provider behind them so the signal survives rotation. Handle CDN-fronted domains on their own behavioral merits, and use CDN abuse channels and hostname-level blocking to sever fronts you cannot reach at the origin. Treat every takedown as temporary and keep detecting through it.
Engage the layer above your own network too. CISA's January 2026 "Bulletproof Defense" guidance — co-authored with the NSA, the Department of Defense Cyber Crime Center, the FBI, and international partners — frames BPH mitigation as a shared responsibility of ISPs and network defenders, and points toward reputation-based filtering of known-abusive providers and structured information sharing as the mechanisms that scale. For most defenders the practical translation is upstream pressure and community feeds: consume the ASN- and range-level intelligence that trackers and government partners publish, contribute back what you observe, and lean on providers and registrars to act where you cannot. The phishing lure is disposable by design; the hosting under it is not, and that is where sustained defensive attention pays off.