Bulletproof Hoster or Proxy Provider? Wrong - It’s Both, or Even More. | SLEUTHCON 2025
Demonstrates bulletproof Hoster or Proxy Provider? Wrong - Its Both, or Even More. | SLEUTHCON 2025 and evaluates key implications for security practitioners.
Summary
Mapping bulletproof providers
Ste, a Team Cymru threat researcher, reframes his Sleuthcon talk as lessons on bulletproof hosting and proxy abuse. He outlines underground forums, jurisdiction-shopping operators, and comparison-site-listed providers that enable crime without advertising it openly.
PSB Hosting case study
He walks through PSB Hosting, a Russian-linked operator UK-incorporated in 2024, traced via Companies House, a leaked phone number, Apios OSINT, Discord/Telegram aliases, and personal Telegram activity including crypto and biking posts.
Proxy infrastructure scale
Team Cymru maps AS/netblocks tagged as proxies—about 10,000 IPs for PSB alone—linked to resellers like RapidSeedbox, IPRoyal, and SigmaProxy, with Leaseweb Netherlands colocation appearing in the chain. He notes 16 million newly tagged proxy IPs in one week, making attribution and blocking difficult.
Related talks
RSAC Cybersecurity·18 min
Marcus Ranum
Marcus Ranum investigates You're Doing it Wrong!.
37th Annual FIRST Conference·29 min
Analysts investigate attack surfaces and defenses concerning Anti-Forensics - You are Doing it Wrong (Believe Me, I'm an IR Consultant).
37th Annual FIRST Conference·35 min
Analysts investigate attack surfaces and defenses concerning All Ransomware Economic Models are Wrong, But This One is Useful.