The Supply Underneath: The Recidivists' Landlords Were Already in the File

The Recidivists — Part 6 (Synthesis)

Five letters have looked at the recidivists from the demand side: the attackers who kept coming back, the ladder that punished them, the crowd that already knew them, the blocks that answered for their fleets, the cloud that hid them. This closing letter turns the picture over and looks at the supply side — the providers who rented these operators the ground they attacked from — and finds something that reframes the whole series.

The dedicated-hosting providers behind the subnet bans of Part 4 are not new names. Take the seven of them — Advin, NextGenWebs, Bucklog, Zkillu, VPS Dedicated LLC, Data Campus, PIO-Hosting — and run each against this investigation's own accumulated corpus of published dossiers, and five of the seven are already there, woven through months of earlier work on the bulletproof-hosting economy that had nothing to do with any escalation ladder. The perimeter's blunt little counter, banning /24s off one apartment's inbound logs, had been quietly pointing the entire time at the same enabler network that the forensic corpus reached by an utterly different road.

This is the last and largest instance of the pattern that has run through the series: the ladder discovers nothing that the wider record did not already hold — and that convergence is exactly its value. Part 3 found it against AbuseIPDB's crowd. This letter finds it against our own case files. The recidivists' landlords were, most of them, already under investigation.

The seven, cross-checked against the record

For each provider I pulled the pipeline's bulletproof assessment — an automated read of an ASN's abuse posture — and its cross-corpus count: how many previously published dossiers already cite that provider's infrastructure. The result is a spectrum, not a verdict, and the spectrum is the finding.

Read it top to bottom and the seven sort into three tiers. Four are assessed bulletproof — PIO-Hosting and VPS Dedicated LLC flagged outright, Data Campus and NextGenWebs by their critical-and-high average threat. Two are high-risk but not bulletproof — Advin and Bucklog, budget hosts scoring in the high seventies to mid-eighties, the grey midtier rather than the hardcore article. One, Zkillu, is entirely new — zero prior dossiers, a provider that no earlier investigation had ever touched and that only the recidivist ladder surfaced.

The bulletproof flag is a heuristic, not a court finding, and it deserves to be held as one; a provider "not flagged" can still be an abuse sink, as Advin's nine-dossier history proves. But even held loosely, the table says something clean: the ladder's dedicated-hosting catch is not a random assortment of VPS shops. It is concentrated, at the top, on providers this investigation had already condemned, and it tapers down into grey resellers and one genuine frontier discovery.

The bridges, provider by provider

The cross-corpus counts are abstract until you read which dossiers. Then the recidivists' landlords resolve into specific, already-documented pieces of the enabler network.

PIO-Hosting GmbH (AS198584) is the deepest bridge — cited in nineteen prior dossiers, and not peripheral ones. It appears in the bulletproof alphabet's opening argument, B is for Bulletproof — The Host That Never Answers; in the Phantom-ASN synthesis, TI-2026-026Q — The Convergence; in the Romanian-corridor mapping of TI-2026-022B — The Corridor Map and TI-2026-022E — The German Gateway; and in TI-2026-028A — The Geography of Nowhere. A German-registered host threading the German gateway of a Romanian bulletproof corridor is not a coincidence the ladder stumbled into; it is a load-bearing node of a network this investigation spent months mapping, and the subnet ban on 176.65.131.0/24 was a thread running straight back into it.

Advin Services LLC (AS22295), though not flagged bulletproof, carries the second-heaviest history — the "midtier" work: The Bulletproof Midtier — Hiding Above Consequence, The Harvest — A Budget Host Where Nearly Everything Is an Attacker, The Reseller Stack — Who Is Behind the Harvest, and the credential-scanning of TI-2026-046A — The .env Harvesters. Advin is the documented archetype of the grey budget host where, in the corpus's own words, nearly everything is an attacker — which is exactly what an eighteen-IP sensitive-file fleet in one of its /24s (Part 4) looks like from the inside.

NextGenWebs S.L. (AS41608) bridges to the costume work — The Browser Costume — How Datacenter Attackers Forge the Identity of a Human and The Wardrobe Rack — Seven Crawler Masks in One Cloud Tenant — the investigation into user-agent forgery and crawler impersonation. The operator running twenty-two sensitive-file hunters across NextGenWebs's 88.151.32.0/22 (Part 4) rents from a provider already on record as a wardrobe of forged identities.

VPS Dedicated LLC (AS197769) — the provider that put dedicated in its own name and earned an outright bulletproof flag with twenty locally-observed attackers, ten of them critical — connects to TI-2026-029B — The Virtualine Connection. Its SSH-brute-force block, 130.12.182.0/24, the honeypot-fed subnet ban of Part 4, sits on infrastructure already tied into the Virtualine cluster.

Data Campus Ltd (AS215929) bridges to the reconnaissance-mapping work — The Cartographers of the Web and the WordPress xmlrpc.php amplification studies — and, fittingly, to The Repeat Offenders itself: this series' own Part 2, which named 62.164.177.222 before this synthesis knew whose block it sat in.

Hiding above consequence: the midtier doctrine

Advin deserves a longer look, because it is the clearest specimen of a category the corpus named and this series keeps colliding with: the grey midtier. Advin is not flagged bulletproof — no Spamhaus listing, no "flagged" signal in the assessment — and that is precisely the point of it. The dossier that documents it is titled Hiding Above Consequence, and the phrase is exact. A hardcore bulletproof provider advertises its indifference and pays for it in reputation: its ranges get wholesale-blocklisted, its ASN acquires a Spamhaus record, and defenders learn to drop it on sight. The midtier host occupies the safer ground above that consequence — mainstream enough to carry legitimate customers and stay off the wholesale blocklists, abuse-tolerant enough that, in the corpus's own measurement, nearly everything on it is an attacker.

That combination is worth more to a fleet operator than raw bulletproofing. A block on a Spamhaus-listed bulletproof ASN is half-dead on arrival — many targets already refuse the whole range. A block on Advin arrives clean: its reputation is mediocre-not-damning, its score sits in the seventies rather than the hundreds, and a casual defender waves it through exactly as they wave through the reputation-dampened cloud of Part 5. The midtier is the dedicated-hosting analogue of hyperscale's reputation discount — a way to attack from ground that has not yet been condemned in bulk. When Part 4 found eighteen sensitive-file hunters concentrated in a single Advin /24, it was watching this doctrine in practice: a fleet renting the grey midtier precisely because it is grey, and getting block-banned here only because a perimeter that keeps its own count does not consult the wholesale blocklists the operator was hiding from.

The midtier is why the bulletproof flag, taken alone, undercounts. Four of the seven providers tripped it; but Advin (nine dossiers) and Bucklog (the first block ever banned) did not, and they are not innocent for failing to — they are successful at the specific evasion the midtier is for. The honest reading of the table is not "four bulletproof, three not." It is "four condemned outright, three hiding above the condemnation," which is a spectrum of the same trade, not a boundary between guilt and innocence.

The corridor and the gateway

PIO-Hosting earns the same closer reading from the other direction — not as a category, but as a specific node in a specific, already-mapped structure. Its nineteen prior appearances are not scattered; they cluster on one earlier investigation's geography. The Corridor Map (TI-2026-022B) and The German Gateway (TI-2026-022E) documented what that series called the Romanian corridor: a lane of abuse-tolerant infrastructure running through Eastern-European registrars and resellers, with a set of German-registered hosts acting as its gateway to the wider internet. The Convergence (TI-2026-026Q) tied that corridor into the Phantom-ASN synthesis; The Geography of Nowhere (TI-2026-028A) mapped the deliberate jurisdictional smearing that lets such a corridor exist — registrant in one country, ASN in another, servers in a third, accountability in none.

PIO-Hosting GmbH is a German-registered host, and it appears in exactly the German-gateway role that corridor investigation described. So when the escalator banned 176.65.131.0/24 on the strength of a couple of sensitive-file hunters, it was not banning a random German VPS. It was, without knowing it, placing a block on a documented gateway of a corridor this investigation had already traced end to end — the same corridor that carried the Phantom ASN and the bulletproof estates of the 026 and 088 work. The recidivist ladder and the corridor map reached the same address from opposite ends of the case: one from a victim perimeter's inbound logs, the other from registrar records and BGP archaeology. That they meet on PIO-Hosting is the strongest single vindication in this letter that both methods are tracking something real.

The ladder as a supply-side sensor

Step back from the individual bridges and the structural claim is this: an escalation mechanism built purely to keep attackers off one perimeter turns out to be an instrument for mapping the hosting economy that supplies them. It was never designed to be. It has no notion of "bulletproof," no registrar graph, no corpus; it counts bans in a /24 and trips a firewall rule. And yet, by the simple physics established in Parts 4 and 5 — that only a rented attack block concentrates three hostiles in one /24 — every subnet ban it fires is, necessarily, a finger laid on a provider that rents to fleets. The trigger condition is a supply-side detector.

There is a further reason the two windows keep framing one picture, and the corpus named it too. Among PIO-Hosting's prior appearances is The Full Brood — One Reseller Substrate Beneath Three Investigations, whose finding was that providers presenting as separate companies frequently sit on a shared reseller substrate — the same underlying network capacity, re-sold under different brands, so that three investigations chasing three "different" hosts were in fact circling one substrate. That earlier result reframes this letter's seven: they need not be seven independent landlords for the pattern to hold. Some fraction of them are plausibly resold slices of a smaller number of upstreams, which is exactly why the same names keep surfacing across unrelated cases. This letter does not attempt to re-derive that substrate from the escalator data — it lacks the registrar and BGP depth to do so responsibly — but it flags the connection, because a demand-side sensor that keeps landing on providers a supply-side investigation already tied to one substrate is not producing seven coincidences. It is producing seven readings of the same underlying thing.

That is why the demand side and the supply side keep turning out to be the same picture seen from two windows. The recidivists of Parts 1–3 are the tenants; the blocks of Part 4 are the leases; the providers of this letter are the landlords — and the corpus had already been investigating the landlords from the property records while the ladder was investigating the tenants from the inbound logs. When the two meet on PIO-Hosting, on Advin, on NextGenWebs, the meeting is not redundancy. It is the same triangulation Part 3 celebrated against AbuseIPDB, now internal: two independent methods, one conclusion, and therefore a conclusion worth trusting.

What co-appearance does, and does not, prove

Before the frontier, the discipline. The bridges in this letter rest on two signals — the pipeline's bulletproof assessment and the cross-corpus count — and both have limits that an honest reading must carry openly, because it would be easy to overstate what they show.

The bulletproof flag is a heuristic, computed from average threat score, Spamhaus status, and a handful of behavioural signals. It is a good prior, not a finding of fact; a "flagged" provider is a provider whose observed traffic looks like an abuse sink, which is strong evidence about the ranges and weaker evidence about the intent of the company behind them. A provider can be flagged because it was heavily abused by tenants it would happily evict, not only because it courts them. This letter has treated the flag as what it is — a well-calibrated suspicion — and has leaned harder on the corpus bridges, which are concrete, than on the flag, which is statistical.

The cross-corpus count means co-appearance, not complicity. When it reports that Advin's ASN is cited in nine prior dossiers, that means nine independent investigations, on nine different subjects, found Advin infrastructure worth naming. That recurrence is itself strong — a provider whose ranges surface again and again across unrelated cases is, at minimum, a persistent host of the thing being investigated — but it does not by itself distinguish a knowing enabler from a merely convenient one. The distinction matters, and neither this letter nor the ladder that produced it can settle it. What both can do is say, with confidence: these providers' address space keeps showing up where attacks come from, by two independent methods, across many months. That is a supply-side pattern worth naming and worth pursuing; it is not, and is not offered as, an accusation against a named company's intent.

One narrower trap deserves a flag of its own, because the entity graph invites it. Several of these ASNs share a listed maintainer object — RIPE-NCC-END-MNT — in their registration. It would be a mistake to read that as a hidden link between them: RIPE-NCC-END-MNT is RIPE's generic default maintainer, shared by many thousands of unrelated end-user allocations. It is the registry equivalent of two houses having the same building code, and this letter claims no shared operator on that basis. The bridges asserted here are the documented dossier ones, not the generic-registry artefacts — the same shared-artifact-is-not-shared-operator discipline that governed the OTX co-listings of Part 3.

The frontier: what the ladder found that the file did not

Convergence is the headline, but the divergence is where the next work lives. Two of the seven providers are not fully accounted for in the existing record, and they mark the edge of the map.

Zkillu SAS (AS215599) — a French-registered host behind 31.56.58.0/24, a five-IP credential-harvesting fleet — appears in zero prior dossiers. It carries a high risk score (82) and a star-prefixed vanity org name in the entity graph (★ ZKILLU) of the kind that recurs among grey resellers, but no earlier investigation reached it. The recidivist ladder found it first. It is a genuine new lead: a provider surfaced not by tracing registrar graphs or abuse feeds, but by the raw fact that five of its rented boxes attacked one apartment often enough to earn a block ban.

Bucklog SARL (AS211590) sits half-on the map — cited in two prior dossiers, high-risk at 84, but not assessed bulletproof and not central to any earlier synthesis. Its 185.177.72.0/24, the very first subnet the escalator ever banned (Part 4, March 2026), is a lead the corpus had brushed against but never pursued.

These two are the deliverable of this letter that is not a recapitulation: a provider the record had never seen (Zkillu) and one it had underweighted (Bucklog), both handed up by the escalation ladder as candidates for the same treatment the corpus gave DMZHOST, the Phantom ASN, and the Costume Catalog. The demand-side sensor has produced supply-side targets.

The whole arc

The Recidivists began with a systemd timer counting bans on one perimeter and ends pointing at the global infrastructure of abuse-tolerant hosting. That arc is the argument. A single well-kept vantage point, applying a mechanical rule with no intelligence of its own, produced: a roster (Part 2) that the world's largest abuse database confirmed twenty-three times over (Part 3); a set of block bans (Part 4) that land only and exactly on rented attack ranges; a map of cloud evasion (Part 5) that explains why the worst offenders can never be block-banned at all; and now (Part 6) a set of landlords, most of them already in this investigation's files under the heading of bulletproof hosting, plus two new leads the files did not have.

None of it required the perimeter to be large, or the sensor to be clever. It required only that someone keep count, keep the memory longer than the attacker's patience, and then read the ledger honestly — for what it confirms, for what it cannot see, and for the two or three threads at its edge that lead somewhere the map does not yet go. The recidivists were never just a list of nuisances to be blocked. Read correctly, they were a directory of an economy — and the ladder that banned them was, all along, quietly writing down its addresses. Two of those addresses, Zkillu and Bucklog, are new work waiting to be done; the rest are old work confirmed from a new direction. Either way the ledger points onward, which is the only thing a good ledger is ever asked to do.