What is criminal infrastructure-as-a-service?¶

Criminal infrastructure-as-a-service supplies hosting, proxies, delivery, access, communications or storage for offending. Provider, reseller, customer and end operator may all be different people or organisations.

Map the service relationship¶

Preserve the supplied resource, stable accounts, assignments, customer panel, marketplace listing, support messages, payment and access records. Identify whether the same service served several customers or victims.

Shared branding and infrastructure do not prove those customer campaigns had one controller. Use customer-specific IDs and resource allocations.

Assess knowledge and participation¶

Neutral infrastructure can be abused, while a service may deliberately offer criminal support, replacement resources or advice for avoiding complaints. Service rules and support interactions can inform provider knowledge.

Buying one component does not make the customer the provider, and supply does not automatically attribute every customer's act to the operator. Report provider, reseller, customer, end use and knowledge at their evidenced levels.