CommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
summary
Large-scale threat intel uses 150 billion DNS lookups/day and a Hadoop + Elasticsearch pipeline with ML and graph algorithms to turn raw lookups into high‑fidelity IOCs; analysis highlights a repeatable “bulletproof” recipe costing roughly $2k–$5k to set up offshore companies (Belize, Seychelles, Panama), acquire ASN/IP space, and rotate prefixes via leaf/stub ASN patterns. Case graphs link Dutch colo upstreams (e.g. Ecatel → Altis Host → hostsplay.com) to dump shops, porn and C2; recommended actions are monitoring, shared graph intelligence, colocation scrutiny and faster cross‑border law enforcement workflows.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:43Cyber Threat Landscape
- 2:37Categories of Hosting Providers
- 3:27Threat Intelligence Cycle
- 4:35Threat Intel Ecosystem Focus Areas
- 5:03Requirements
- 5:33Our stakeholders
- 6:17Collection
- 6:27Umbrella Investigate Intel Production Cycle
- 8:41Processing
- 9:54Autonomous System Number (ASN)
- 11:04Analysis
- 12:13Indicator: Offshore Business Registration
- 13:19Anonymous Payment Methods
- 13:51Helping customers to maintain operations
- 14:45Sample Rogue Hosters with a Dutch footprint (April 2018)
- 19:58Dissemination
- 22:27Law enforcement: Cross Jurisdictional Business Model
- 23:25Law enforcement: Taking Down Bad Content
- 24:22Law Enforcement Recommendations
- 24:56Security Community Recommendations
- 27:22Policy makers: Recommendations
- 28:02Hosting Community Recommendations
- 30:15Summary
- 30:46References
- 31:02Additional Related Work
related talks
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
59mCatching Malware En Masse: DNS and IP Style
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
32mSomething’s Phishy: See the Hook Before the Bait
52mInvestigating DDOS - Architecture Actors and Attribution
28mFerris Bueller's Guide to Abuse Domain Permutations
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
47mDNS On Fire