I think the "new meta" is sketchy popup/popunder ad providers that pay BTC/USDT, njal.la/nic.ru/some Chinese registrar paid with crypto or a virtual card, DDOS-

I think the "new meta" is sketchy popup/popunder ad providers that pay BTC/USDT, njal.la/nic.ru/some Chinese registrar paid with crypto or a virtual card, DDOS-guard/Cloudflare to make getting the origin IP annoying, and hosting in an ex-USSR country (and sometimes even mainstream Western providers like Leaseweb or OVH). But that's just the impression I got by occasionally using these sites, looking at domain/IP whois and using one of those Cloudflare deanonymizer sites when it was still up.