Inside the Bulletproof Hosting Network Behind 16,000+ Fake Shops
Essential information
- Published
- 27/04/2026 18:16
- Modified
- 27/04/2026 16:31
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- afrinic autonomous systems bulletproof hosting counterfeit goods e-commerce fraud fake shops fibergrid shell companies stolen ip addresses
- Tags
- 2026-04-27 afrinic autonomous systems bulletproof hosting counterfeit goods e-commerce fraud fake shops fibergrid shell companies stolen ip addresses
- Related entities
- 9 indicators, 9 observables, 15 techniques (mitre), 10 others
Description
Fibergrid has operated as a bulletproof hosting provider for nearly a decade, currently hosting 16,700 active fraudulent e-commerce sites. The network exploits stolen African IPv4 address space worth $20-25 million, originally acquired through improper AFRINIC registrations. Despite claiming Seychelles-based operations, multilateration analysis reveals infrastructure concentrated in the United States, United Kingdom, Netherlands, Canada, and other Western countries, primarily within Equinix data centers. Fibergrid operates through a complex web of UK and Estonian shell companies using multiple autonomous systems to evade detection and enforcement. Fake shops constitute 70% of malicious activity on this infrastructure, targeting consumers through search engines and social media with counterfeit goods and payment fraud schemes. Disruption opportunities exist through upstream provider intervention, regional internet registry action, domain-level takedowns, and indicator sharing with security providers.