Behaviors and Patterns of Bulletproof and Anonymous Hosting Providers - USENIX Enigma Conference - 2017

Explore the intricate world of bulletproof and anonymous hosting providers in this 21-minute conference talk from USENIX Enigma 2017. Delve into the key enabling factors of cybercrime operations, including ransomware and phishing, as Principal Engineer Dhia Mahjoub from OpenDNS Research Labs examines the blurred lines between bulletproof hosters and anonymous offshore providers. Gain insights into how these services leverage internet anonymity, cross-border legal complexities, and jurisdictional loopholes to operate. Focus on The Netherlands as a case study to understand criminal hosting in Dutch IP space, combining network and field research findings. Learn about threat detection models, relevant features for identifying such providers, and the challenges faced in combating cybercrime. Discover the jurisdictional complexities and business perspectives involved, and explore potential solutions for addressing these issues. This talk, co-authored with Sarah Brown from Security Links/NATO, offers valuable knowledge for threat analysts, security researchers, and law enforcement professionals.

Introduction
Hosting Provider Technology
Outline
Threat Detection Model
Identifying Relevant Features
Tax Havens
Payment Methods
The Netherlands
Abuse complaints
Challenges
Evidence
Jurisdictional Complexity
Business Perspective
What can we do
Conclusion