Besides proxying to try to mask their activities, wouldn’t those playing host to bad actors have to have some insight or notice some abnormal activity that might give away that someone may be abusing their services?
Or is it that there’s a mix of a financial & legal advantage to remaining as ignorant to that activity as possible for as long as possible up till push comes to shove & they’re being served a warrant?
Well, not just content, but also activity like making fake sites to steal credentials, send out phishing emails/texts, and that kind of thing. I guess that may fall under the same point though, of the law not being universal regarding these activities, e.g. talk of some governments ignoring bad actors so long as their activities only target other nations’ citizens.
Those schemes are more fly by night and don’t last long.
Websites that sell illegal products are almost always based in a place where the product isn’t illegal or enforced.
It’s pretty common for that sort of activity to use stuff like botnets or compromised servers. In other words, the actual owner isn’t aware of what their resources are being used for: they got hijacked. There’s lots of stuff on the internet with very lax security so unfortunately it’s not really hard to do.