Hosting providers face a broad range of security threats. Attackers may rent servers directly to use for C2 or phishing operations, compromise legitimate users, or launch large-scale DDoS attacks against their servers to take them offline. Each of these threats can take many forms, requiring constant vigilance to detect and shut down before significant harm is done to their customers or wider internet users.
In general, there are three categories of attack that we believe are most challenging for VPS providers: ones with exceptional scale, stealth, or access. To illustrate this point, we’ll cover three of the largest threats to VPS infrastructure over the past twelve months and explore why they’ve been so effective.
In late 2025, Cloudflare reported a record-breaking distributed denial of service (DDoS) attack that reached a staggering 31.4 Tbps. Comprised of an estimated 1-4 million infected hosts, it targeted primarily telecom providers that host large gaming communities to cause maximum disruption.
Yet while this attack was the most headline-grabbing one, in some ways it can be seen as little more than an advertisement of the botnet’s capabilities. In fact, the botnet had been operating since at least 2024 and continues to be a significant threat today. A July 2026 report by Arelion found that Aisuru was still responsible for over a third of all DDoS attacks observed on its network. It noted that the botnet “fundamentally changed the entire DDoS threat landscape”.
But what made Aisuru so successful, and why is it a threat to VPS providers?
Two things stand out about Aisuru when compared to previous large-scale DDoS attacks: sophistication and scale. Its botnet reached that scale primarily through Kimwolf, its Android variant designed to infect and operate Android TV boxes and mobile devices at massive scale using security-lax residential proxy services.
Aisuru’s massive scale allows it to perform “carpet bombing” attacks — high-volume, short-duration attacks that target multiple IP addresses at once. By distributing its attack across multiple IP addresses controlled by one provider, it might fall below the threshold to be considered an attack on a per-IP basis, yet still manage to exhaust the network’s bandwidth with the combined force of the attack. Notably, many of these infected devices live in the US, which makes it more difficult for US-based service providers to separate attacks from legitimate traffic. This combines with heavy randomization of packet attributes to attempt to dodge detection.
VPS providers face threats from Aisuru from three angles: inbound DDoS attacks against their infrastructure, Aisuru operators using their servers to host C2s, and customer servers being compromised for use in the botnet.
Mitigating inbound attacks usually comes down to implementing or upgrading DDoS protection across your servers, ideally as a default, free offering rather than an add-on the customer has to pay for. In particular, VPS providers should look to move away from basic DDoS protection and instead use advanced, heuristics based models. This allows them to better detect and mitigate unusual and zero-day attacks rather than relying on specific, known patterns for detection.
While IoT devices form a large part of the botnet, another common target, as reported by Cloudflare, is cloud-hosted VMs. This poses a bit of a dilemma for VPS providers. Their whole business model is allowing users to manage their own server. As a result, some users fail to update regularly or secure their server well. If their server gets compromised and used in a botnet, they also may not run the monitoring tools required to realise it’s happening. This is a difficult problem to solve entirely, but it can be mitigated by monitoring outgoing traffic, cross referencing with reports from DDoS providers, and investigating abuse complaints.
C2s are perhaps an even bigger concern for VPS providers, since morally and legally they don’t want to be viewed as allowing attackers to directly purchase and use their infrastructure for harm. Prevention starts at the payment level — performing fraud checks for fiat currency or banning known dirty wallets for crypto. Realistically, however, criminals are going to find ways around this. To detect and shut down C2s, providers need to keep a close eye on threat intelligence feeds and abuse reports, scan exposed services, monitor network traffic, and investigate further.
A tool like BLNWX’s open-source IOC-Scanner can help with the scanning and threat intelligence parts of that mitigation by checking configured IPv4 ranges against threat-intelligence feeds and scanning exposed ports for malicious indicators, including TLS certificate fingerprints and JARM signatures. It won’t identify every C2, and it may not necessarily catch them before abuse occurs, but it’s a useful tool in a provider’s arsenal to flag servers for further investigation.
Research by Bitdefender Labs found that 84% of high-severity attacks it analysed in 2026 used LOTL techniques. Attackers are increasingly exploiting tools and systems already present on servers to compromise them with a much reduced attack footprint.
LOTL attacks are very difficult for traditional, signature-based antivirus to detect because they piggyback on trusted services and don’t necessarily use a signature, byte pattern, or hash the scanner can detect. The same tools used by an admin to troubleshoot a server may be abused by an attacker that has gained access.
This doesn’t mean LOTL attacks are always fileless, though they often are; attackers may still write files to the disk or install malware. Regardless, catching the initial infiltration and mapping out the attack can be very challenging and often requires behavioural monitoring, endpoint telemetry, and analysing detailed system logs.
LOTL attacks are a dilemma for VPS providers because customers usually have administrative control over their VMs. The provider doesn’t typically have visibility over the commands, processes, or logins occurring inside a customer’s OS. Without this, a customer could be compromised and remain undetected for some time.
Addressing LOTL attacks therefore needs to happen on multiple levels. The first is encouraging good security hygiene from customers, including regular updates,, restricted admin access, regular log analysis, and the use endpoint detection and response (EDR) where appropriate.
Providers can complement these measures by keeping their own systems updated, monitoring network traffic, investigating abuse reports and potentially offering additional security monitoring to customers who need it. IOC-Scanner may help in some cases through its TLS and JARM fingerprints, plus IPv4 matching to threat intelligence feeds to flag potential malicious behaviour. Ultimately, though, the main mitigations happen on the user side, and must be enabled via good technical support and robust guidance on server security.
We couldn’t finish this list without covering PHP2Shell. A family of vulnerabilities that received mainstream news coverage in October 2026. The flaws exist in unpatched versions of the PHP programming language and allow attackers to execute remote code on servers and read sensitive data such as passwords and authentication tokens directly from the server’s memory.
PHP2Shell is a direct threat to any unpatched VPS server running PHP, and is already being exploited in the wild. One attempted exploitation came from a variant of the Mirai botnet, a precursor to Aisuru, though thankfully the attacker was unable to successfully deliver the payload.
PHP powers around 70% of websites and is used widely in self-hosted apps, content management systems, and more. Many of these services are hosted on VPS servers, with unpatched servers a tempting entry point for attackers. If the PHP version remains unpatched, every one of those servers could be infected with malware, suffer a data breach, or be used as a foothold for further attacks.
The difficulty for VPS providers is that most VPS servers are unmanaged. Customers are generally responsible for maintaining their own operating systems and ensuring their packages and tools are up to date, with VPS providers often unable to update services without direct user permission.
That, however, does not mean providers are powerless or have no responsibility. If providers can’t patch servers directly, they should clearly communicate to customers which updates to apply and provide technical support.
Many VPS providers also offer “one-click” apps that enable users to quickly launch a VPS with pre-installed, PHP-based services such as WordPress, Drupal, LAMP/LEMP, Nextcoud/ownCloud, phpMyAdmin, and more. VPS providers should ensure that these scripts deploy patched versions of PHP on all new servers. Providers also need to patch any of their own systems that use PHP, which could include billing and server management tools.
Despite these efforts, some servers are likely to remain vulnerable for months or even years if customers fail to apply available patches. While providers should of course continue to encourage customers to update, infrastructure scanning offers some additional visibility should customers be compromised. A tool like BLNWX’s IOC-Scanner can check IPv4 ranges against threat intelligence feeds and scan exposed services for known malicious indicators. The provider can then investigate and inform the customer, or, if their instance is causing harm, temporarily pause the server until it is resolved.
Aisuru, LOTL attacks, and PHP2Shell are just a few examples of the threats facing VPS providers and their customers on a daily basis. As AI tools become more accessible, it’s likely that attackers will be able to automate more of their operations, scale more effectively, and discover more zero-day exploits. This is going to make effective detection and response even more important. Providers will need to further prioritise customer education, network monitoring, timely patching, DDoS protection, and abuse investigation tools.
BLNWX’s IOC-scanner is designed to contribute to this approach by helping providers to centralise threat intelligence matches from various sources to flag potentially malicious infrastructure for further investigation. Ultimately, no VPS provider is going to be able to stop every malicious party from signing up or every server compromise. Tools that enable you to have the visibility to identify these and act are therefore essential to reducing harm not only to the VPS provider’s customers but also to wider internet users.
BL Networks provides IP addresses and related services to internet companies. BL Networks may not necessarily be the direct operator of any equipment and/or service currently or historically using a given IP address.
For more information, contact legal@blnwx.com