Mohammad Tareq Sahebzadah, a Dutch national of Afghan descent, operated “CrazyRDP”—the largest seized bulletproof hosting service. His platform knowingly provided infrastructure for criminal activities, including malware, financial scams, and the distribution of child sexual abuse material.

When Dutch police seized 250 servers from Serverion at ColoCenter’s datacenter, they had no idea what they had captured. Only later did they realize their operation had inadvertently taken down CrazyRDP, one of the world’s largest bulletproof hosting services.

This discovery led us to a pivotal question: who was operating CrazyRDP?
The answer came quickly. The owner had made a series of critical operational security errors, and the key clue was found in the SSL certificate of one node, which read:

CN=crazynodenl52, emailAddress=avsbv.nl@gmail[.]com

Our investigation found that Mr. Sahebzadah’s “AVS” was an acronym for  “Anonymous Virtual Server.” Further OSINT revealed more incriminating links: he had registered the domain bluerdp[.]com using his personal iCloud email. This definitively connected him to a second bulletproof hosting service, BlueRDP, for which we located an advertisement online. His involvement now spanned two platforms: CrazyRDP and BlueRDP.