[Bulletproof Hosting Takedown]

In this blog series we spotlight one of the stories from our cybersecurity newsletter, Beacon.

Following an investigation that lasted over a year, Dutch police have dismantled a “bulletproof” hosting provider. During the raid, 127 servers from ZServers/XHost were seized by law enforcement.

According to the Dutch National Police, the ZServers/XHost stood out because they were advertising that cybercriminals were welcome to exploit illicit activities from its servers, and promised the servers would remain anonymous to law enforcement agencies.

Hosting companies of this kind are referred to as “bulletproof” hosters. They provide hosting services to cybercriminals promising to protect users from law enforcement agencies, helping them remain anonymous on the internet. This allows criminals to host and distribute ransomware and host illicit materials without fear of server shutdown.

Dutch police raided the company on February 12th with the investigation revealing that the servers contained ransomware, botnets, and other malicious software, including tools from Conti and LockBit.

Law enforcement emphasized the dangers of bulletproof hosters. "A bulletproof hoster is not just any shadowy company that ignores rules; it is the backbone of global cybercrime. Without these 'safe havens,' many criminals would have nowhere to host their hacking tools, stolen data, and fake websites. Cybercriminals from all over the world pay a lot of money to have their illegal operations run here undisturbed. Bulletproof hosters ensure that malicious individuals can continue to hack, scam, and blackmail with impunity, and others pay the price for that." the police said in a statement.

While no suspects have been arrested to date, websites hosted on the seized servers have been made inaccessible. In accordance with the Public Prosecution Service, the Cybercrime Team of the Amsterdam police will continue to investigate the data found on the seized servers.