The withdrawn version of this article presented a worked OSINT methodology for mapping ransomware infrastructure, built around a case study that labelled a mainstream CDN as bulletproof hosting without a source, and parsing code for the RIPEstat API that did not match how the API actually responds. Both are gone. In their place: two real, independently reported cases of ransomware infrastructure being traced through a shared hosting pattern, and what they show about how that kind of attribution actually gets done.

[INFO]
This article summarises public reporting from Sophos and ELLIO, relayed in part by BleepingComputer and Dark Reading. No infrastructure mapping, pivot or IP list here is this site's own research.

//Case One: A Hostname That Kept Reappearing

Sophos published research, in early 2026, describing how it traced a pattern across several incidents involving WantToCry ransomware in late 2025. SophosLabs noticed that the attackers' machines in each incident shared auto-generated NetBIOS hostnames - strings like WIN-J9D866ESIJ2 and WIN-LIVFRVQFMKO - that traced back to Windows VM templates supplied by ISPsystem, a legitimate virtualization management platform that bulletproof hosting providers were renting out pre-provisioned.

Sophos's Counter Threat Unit then searched for those same hostnames across other internet-exposed systems and found them tied to a wider set of activity: LockBit, Qilin and BlackCat/ALPHV ransomware deployments, a NetSupport RAT delivery, and - via BleepingComputer's coverage of the same report - older campaigns including Conti, RedLine and Ursnif. One of the hostnames, WIN-LIVFRVQFMKO, even turned up in a 2021 Jabber chat between members of the Conti and TrickBot groups, a conversation originally exposed in the 2022 ContiLeaks operation.

Why one hostname connects so many incidents

The root cause, per Sophos, is mundane: VMmanager's default Windows templates reuse the same hostname and system identifiers on every deployment unless an operator bothers to change them. That quirk, intended to make rapid VM provisioning convenient, means thousands of unrelated machines - legitimate and malicious - can share a fingerprint. It makes a hostname search a genuinely useful pivot (Sophos used it to connect disparate incidents), and it also means a hostname match alone cannot distinguish one operator renting the same provider repeatedly from several unrelated criminal customers who all rented from the same template.

//Case Two: Following the ASN After a Takedown

ELLIO, a threat intelligence vendor, published a report dated 26 May 2026 titled "Sanctioned, Seized, Still Scanning," tracking a Russian bulletproof hosting network over a trailing 12-month window using its own honeypot network, IP geolocation and live RIPE BGP routing data pulled from RIPEstat at the time of the report.

Three weeks before that report, on 18 May 2026, Dutch fiscal crime investigators (FIOD) seized more than 800 servers and arrested two people connected to WorkTitans B.V., trading as THE.Hosting. Per ELLIO's report, the underlying network had already moved once before the raid - from AS44477 (first Stark Industries Solutions, then PQ Hosting Plus S.R.L.) to AS209847 under THE.Hosting. After the seizure, the old ASN stopped announcing any address space, while the new one continued announcing 485 prefixes. Dark Reading, reporting on the same ELLIO data, said scanning activity from the network held at roughly the same levels more than a week after the raids - the takedown disrupted the legal entity, not the scanning traffic.

The caution ELLIO itself raised

Both of these are pivot-based attribution methods - a shared hostname, a shared ASN - and both carry the same structural caution: a hosting provider is one company, but the traffic riding on its infrastructure can belong to many unrelated tenants. Attribution built on infrastructure alone risks conflating a landlord with every one of its tenants. Neither report found for this rewrite claims to have fully solved that problem; both treat the pivot as a lead to investigate further, not a conclusion in itself.

//What a Real Methodology Looks Like

What both cases actually show, stripped of any specific tooling claim: infrastructure attribution in practice is pivot-driven - start from one confirmed indicator (a hostname, an ASN, a certificate), search broadly for anything sharing it, and treat each new match as a hypothesis to check rather than a confirmed member of the same operation. Neither Sophos's nor ELLIO's report, as found for this rewrite, describes using Shodan or RIPEstat in combination, and the withdrawn version of this article's claim to do exactly that - with working code - was unsupported and has not been replaced with a substitute claim.

[WARNING]
No IP range, hostname list or infrastructure map in this article is this site's own data. Current indicators should come from Sophos or ELLIO's own reporting, not from this summary.