Bulletproof hosting

Executive Summary

Bulletproof hosting is a service used by threat actors to host malicious infrastructure. It is designed to be resilient against takedowns and disruptions, allowing threat actors to maintain a persistent online presence. This service supports various malicious activities, including hosting C2 servers and phishing sites.

Bulletproof hosting refers to a type of hosting service that is designed to be highly resilient against takedowns, seizures, or disruptions. These services are often utilized by threat actors to host malicious infrastructure, such as command and control (C2) servers, phishing sites, or other types of malicious content. The use of bulletproof hosting allows threat actors to maintain a persistent online presence, even in the face of law enforcement or cybersecurity efforts to disrupt their operations. This type of hosting is typically characterized by its ability to withstand or evade detection and shutdown attempts.

Key Capabilities

• Resilience against takedowns
• Evading detection
• Hosting malicious infrastructure
• Supporting command and control operations
• Facilitating phishing and other types of cybercrime

ATT&CK Techniques

Recommended Actions

• Monitor for suspicious network activity indicative of malicious hosting
• Implement DNS and IP blocking for known bulletproof hosting services
• Conduct regular threat intelligence updates to stay aware of new bulletproof hosting services
• Collaborate with law enforcement and cybersecurity agencies to share information on bulletproof hosting services

Suggested Tags