Threats · 109 days ago
Taking down a bulletproof host's boxes is not the same as taking down the host. If the routed network block stays live, the operation can keep scanning, reselling capacity, and supporting abuse under the same Internet identity after the raid.
Dutch investigators arrested two operators and seized more than 800 servers tied to THE.Hosting on May 18. But researchers still saw scanning activity at nearly the same level a week later, and the host's core AS209847 remained intact. AS numbers are the routing layer that tells the Internet where to send traffic, so keeping that piece alive preserves reach even after hardware is gone.
That leaves a clear limitation in standard takedowns: server seizure alone does not break a bulletproof hosting service if the upstream connectivity and address space survive.
7 sources covering this story
Risky Bulletin: Dutch police take down 17m device botnet
Dutch police take down a botnet of 17 million devices, US military staff have been tracked with ad-tech location data, a Google engineer i [Read More
Dutch Raid Fails to Dent Russian Bulletproof Host
Dutch law enforcement seized 800 servers and arrested two operators of THE.Hosting but left the hosting provider's core IP address space intact.
Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands
The two own Dutch companies that allegedly provided bulletproof hosting services to Russia-aligned threat actors.
The Record from Recorded Future
Dutch authorities arrest men suspected of providing infrastructure for Russian cyber operations
Investigators seized more than 800 servers as they arrested two men suspected of violating European sanctions and assisting pro-Russian cyberattacks and disinformation campaigns.
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union.
Authorities seize 800 servers used for cyberattacks and disinformation - Help Net Security
Dutch authorities arrested two men and seized more than 800 servers linked to Russian-linked infrastructure tied to cyberattacks.
Netherlands seizes 800 servers of hosting firm enabling cyberattacks
Financial crime investigators in the Netherlands (FIOD) arrested two men and seized 800 servers linked to a web hosting company that enabled cyberattacks, interference operations, and disinformation campaigns.
Part of the PlainSec briefing for 2026-05-25