Investigative reporters at BIRN have identified a network of small web-hosting firms registered in Serbia and Montenegro that are routing clusters of IP addresses through the Western Balkans on behalf of Russian bulletproof hosting operators — companies that sell specialised server infrastructure designed to help cybercriminals evade detection. At the centre of the investigation is eServer, a firm registered in Kruševac (a mid-sized city in central Serbia) in April 2022 by Russian national Maxim Azarov, whose IP ranges have been traced through entities linked to Aeza Group and Stark Industries Solutions, both sanctioned by the United States and European Union respectively for supporting ransomware attacks, cyberattacks, and hybrid warfare operations. Security researchers say such "disposable" front companies are deliberately rotated to buy time against enforcement actions, making the infrastructure difficult to shut down — and the findings matter because the same IP blocks have been linked to Russia's GRU military intelligence service, the FIN7 financial crime group, and the Doppelganger influence campaign targeting Western audiences.