Use Claude and Interisle’s data to dive deep into cybercrime activities
Dave Piscitello
Interisle publishes quarterly phishing, spam, and malware activity reports at our Cybercrime Information Center. We post rankings of the Top-level Domains (TLDs), Domain Registrars, and Hosting operators (by ASN) with the most activity.
Our rankings only identify “Top 20” operators, but we also publish aggregate records of all operators that meet certain minimum activity criteria in CSV format.
Feeding this publicly available data into an AI agent reveals findings beyond those that we typically publish at Substack, at the Cybercrime Information Center, or in our studies. Here, I’ll share some experiences using Claude AI that caused me to follow the data to see where it might lead.
Using Claude AI to Join Interisle Data with External Sources
The CSV file Malware-Hostingstats-Apr2026-Jun2026.csv at our Cybercrime Information Center contains over 1800 hosting operators for which we processed malware reports from our contributing feeds. I uploaded this file into a project and prompted Claude with
What ASNs had the highest ratio of unique malware addresses to routed IPv4 addresses?
Claude first generated a top 10 table.
Top ASNs by ratio of unique malware addresses to routed IPv4 addresses (a proxy for how “poisoned” a network’s tiny address space is):
Using other external sources, Claude offered additional findings. One was intriguing enough to pursue.
Bulletproof Hosts?
Claude “flagged” three ASNs as potential bulletproof hosting providers:
· “Several names (Offshore LC, SnTHostings, Bucklog SARL, various ‘LLC/SRL’ shell-style names) are consistent with bulletproof or loosely regulated hosting providers.”
In any serious exercise involving AI, I ask the agent to explain the basis on which it made a determination. Often, the agent will explain its inference model. In this case, I asked Claude, “what did you use to conclude that Offshore LC, SnTHostings, and Bucklog SARL are bulletproof sites”, and it admitted, “I should be more precise about this, because that conclusion was inference, not something the data directly confirms”.
Whenever I’m the least bit unconvinced, I’ll turn to data or sources that I trust. In this case, I added (non-public) malware metadata that Interisle curates to my Claude project. I also did some site visits, searches and added public sources that I trust.
Here’s what I found.
Offshore.LC
If you try to visit the Offshore.LC domain, you’ll be redirected to Kagehost.com. A curl confirms the redirect:
C:\Users\investigate>curl https://offshore.lc<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>
And Kagehost is quite open about its business model:
Turning to malware reports we process from our contributors, I found that addresses in this ASN and reported as malicious were associated with 1700 IoT bots (mostly Mirai), over 500 malicious executables, and over 120 Gafgyt loaders.
VPSVAULT.HOST
VPSVAULT.HOST is a UK hosting operator with centers worldwide. It also uses Cloudflare reverse proxy. Again running a curl, I see a redirect:
C:\Users\secur>curl vpsvault.host
<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>cloudflare</center>
</body>
</html>
While VPS Vault does not overtly self-promote as “operating in jurisdictions that mind their own business” as Kagehost does, the phrase “No TOS issues” raises questions: the hosting operator is saying that they won’t suspend your account for policy (terms of service) reasons.
To learn what’s being hosted here, I used our malware metadata. Our sources indicated that addresses reported as malicious were associated with over 300 IoT bots (again, Mirai), over 300 malicious executables, and a handful of Gafgyt loaders. I also asked my colleagues at Spamhaus, and they pointed to their free ASN Don’t Route or Peer list. ASNs are added to DROP lists when investigators and forensics specialists determine that they are controlled by cybercrime groups or by bulletproof hosters
There I found VPS Vault listed.
{”asn”:215925,”rir”:”ripencc”,”domain”:”vpsvault.host”,”cc”:”GB”,”asname”:”VPSVAULTHOST”}[i]
While I had the benefit of our curated data to make a judgement regarding VPSVAULT, in this case anyone could have made a judgement using a trusted, free data source.
Bucklog SARL
I could not find a public web site for Bucklog SARL. ChatGPT, Claude and Gemini could only find business registry listings. Bucklog is a French limited liability company (SARL, Société à responsabilité limitée). The stated corporate purpose of the company is “business and other management consultancy activities”.
I did find a March 2026 analysis by Grey Noise Labs that associated Bucklog SARL with a large-scale scanning operation: “a purpose-built, Kubernetes-orchestrated scanning cluster running from a single /24 in Paris that generated 13 million sessions over 90 days”.
Our sources reported that 150 addresses reported as malicious were associated with traffic injectors. Bucklog SARL’s not on the ASN DROP list.
What did I learn during this exercise?
If you use AI for research or investigations, remember:
Inferences are not ground truths. Always question an AI agent’s findings. Ask for specific sources. Ask for the rationale behind a conclusion.
Inference models are only as reliable as the data upon which they are trained. If you don’t know or trust the data an agent used, look until you find data that you can trust and verify, or use curated data.
Force AI to do academic quality research and you should improve the accuracy of and your confidence in your findings or assertions.
An observation I made after the exercise: by following where the data took me, I deviated from the industry tendency to prepare rankings based on large activity numbers. By looking at reported malware activity from a different perspective, I learned something about malicious activity that fell outside our typical focus.
In this case, we investigated three operators that exhibited malicious activity that’s characteristic of bulletproof hosting, but of the three ASNs that Claude inferred from public sources and Interisle data:
Only Offshore.LC appears to truly fall into the bulletproof category.
VPSVAULT.HOST is not strictly a bulletproof host, but there’s enough troublesome activity hosted there to justify a listing in the Spamhaus ASN DROP list.
The operation described by Grey Noise Labs is concerning but there’s no direct intel available to confidently label Bucklog SARL as bulletproof.
The most important operational security takeaway? Any time you find your network being aggressively scanned from a small ASN, you should pay close attention.
Fully human written.
[i] From the JSON file, the metadata record is {”type”:”metadata”,”timestamp”:1785779042,”size”:37428,”records”:420,”copyright”:”(c) 2026 The Spamhaus Project SLU”,”terms”:”https://www.spamhaus.org/drop/terms/”}
Note: When I prompted Claude with “how many ASNs in the file Malware-Hostingstats-Apr2026-Jun2026.csv are also in the Spamhaus asndrop.json file”, Claude found 74 matches. That might be an interesting homework assignment:-)