Taking down a bulletproof host's boxes is not the same as taking down the host. If the routed network block stays live, the operation can keep scanning, reselling capacity, and supporting abuse under the same Internet identity after the raid.
Dutch investigators arrested two operators and seized more than 800 servers tied to THE.Hosting on May 18. But researchers still saw scanning activity at nearly the same level a week later, and the host's core AS209847 remained intact. AS numbers are the routing layer that tells the Internet where to send traffic, so keeping that piece alive preserves reach even after hardware is gone.
That leaves a clear limitation in standard takedowns: server seizure alone does not break a bulletproof hosting service if the upstream connectivity and address space survive.
Dutch authorities arrest men suspected of providing infrastructure for Russian cyber operations
Investigators seized more than 800 servers as they arrested two men suspected of violating European sanctions and assisting pro-Russian cyberattacks and disinformation campaigns.