I doubt they use only "paid for" services in their chain. There are very likely normal user-boxes (like your moms) and "forgotten" servers involved as well. It

I doubt they use only "paid for" services in their chain. There are very likely normal user-boxes (like your moms) and "forgotten" servers involved as well. It's not easy to back trace when you have to send in someone to do forensics on a computer.