Realizing the market segment potential of bulletproof hosting services in a post-Russian Business Network (RBN) world — although it can be easily argued that as long as its operators are at large they will remain in business — cybercriminals continue supplying the cybercrime ecosystem with market-relevant propositions. It empowers anyone with the ability to host fraudulent and malicious content online. A newly launched Virtual Dedicated Server (VDS) type of bulletproof hosting vendor is pitching itself to prospective cybercriminals, offering them hosting services for spam, malware, brute-forcing tools, blackhat SEO tools, C&C (command and control) servers, exploit kits and warez. In addition to offering the “standard cybercrime-friendly” bulletproof hosting package, the vendor is also excelling in terms of the hardware it relies on for providing the infrastructure to its customers.

Let’s take a peek inside the infrastructure ‘facility’, and discuss the vendor’s business model in the over-populated market segment for bulletproof hosting services, currently available to prospective cybercriminals.

Sample screenshot of the currently offered bulletproof hosting options:

Cybercrime_Bulletproof_Hosting_VDS_Virtual_Dedicated_Server

Sample screenshots of the used HP Smart Arrays in the service’s infrastructure, and the DIY self-monitoring interface:

Cybercrime_Bulletproof_Hosting_VDS_Virtual_Dedicated_Server_01

Sample screenshots of the actual infrastructure ‘facility’ as featured by the vendor of the bulletproof hosting service:

Cybercrime_Bulletproof_Hosting_VDS_Virtual_Dedicated_Server_02

Cybercrime_Bulletproof_Hosting_VDS_Virtual_Dedicated_Server_03

Cybercrime_Bulletproof_Hosting_VDS_Virtual_Dedicated_Server_04

Cybercrime_Bulletproof_Hosting_VDS_Virtual_Dedicated_Server_05

This service and its infrastructure are a great example of ‘purely malicious in-house infrastructure’ purposely set up to facilitate fraudulent and malicious online activity. The “even if it’s there we still don’t care” mentality results in a situation where despite the fact that the vendor’s infrastructure remains online, it can still get blocked by the industry, consequently preventing hundreds of millions of users from (unknowingly) interacting with it. Unfortunately, as we’ve already seen in previous cybercrime-friendly ISP shut downs, this doesn’t really present a problem to the cybercriminals operating it, thanks to the contingency planning in place, allowing them to quickly restore service to their customers.

In retrospect: How cybercrime-friendly ISPs got affected by successful take downs over the years:

We’ll continue monitoring this market segment, and post analyses of newly launched/competing services, in particular the ones differentiating their UVP (unique value proposition) to prospective cybercriminals.

Blog Staff

About the Author

Blog Staff

The Webroot blog offers expert insights and analysis into the latest cybersecurity trends. Whether you’re a home or business user, we’re dedicated to giving you the awareness and knowledge needed to stay ahead of today’s cyber threats.

Share This