I think IDScan is still responsible for. You don’t typically go after hosting providers for failures like this, right?

Or are you referring to the practice of using shell companies to obfuscate responsibility? In that case, I think there’s history that says IDScan would still be responsible, questionable legal business nonsense be damned.