Offshore domain services are paid services that supply domain names to threat actors without identity checks, which makes the real owner hard to trace. The post describes them as sold through web panels and Telegram bots, often bundled with bulletproof hosting. Criminals use them for phishing, ransomware and cryptocurrency theft.
Executive Summary
This report gives an overview of the offshore and anonymous domain service ecosystem. This ecosystem is a critical enabler of cybercrime, such as phishing, ransomware deployment and cryptocurrency theft.
The research looks at service providers, infrastructure patterns and how the underground market works. It shows how cyber threat actors use these services to keep their attacks going. The services also help them evade detection and legal accountability.
Key findings include:
- Q1 2025 data shows a steady increase in the offering of offshore domain services on underground platforms. This suggests a maturing, self-reinforcing cybercriminal ecosystem.
- Threat actors consistently rely on anonymous domain registration services to bypass Know Your Customer (KYC) protocols and avoid being traced.
- Services are actively promoted via Telegram bots, dark web forums, and web panels, often bundled with bulletproof hosting options.
- Providers offer features such as SSL certificates, anti-bot protections, domain rotation methods, and cryptocurrency-based payments to stay up and running.
- Prominent ransomware groups, including Conti, Medusa, and RansomedVC, have been observed using offshore domain services, especially those linked to providers.
- The infrastructure behind these services is built to resist takedown attempts. It is often hosted in permissive jurisdictions.
| Disclaimer |
| This report is classified as TLP:WHITE, allowing for full public distribution. A more detailed TLP:AMBER:STRICT version containing technical indicators and actor-attributed infrastructure is available upon request through official communication channels. |
Introduction
Cyber threat actors use many advanced methods to keep their activity going and to evade detection. One such method is buying the domain names used in malicious actions. Threat actors often do not register domains directly. They rely on third parties who specialize in giving anonymous and offshore domain acquisition services.
The main motive behind this practice is more anonymity and less traceability. Direct registration increases the risk of linking domain ownership to threat actors. So they use intermediaries and bulletproof service providers. These are entities that intentionally disregard legal and regulatory takedown requests. This greatly reduces the risks for threat actors.
These services often involve domains registered with fabricated identities, compromised domains, or pre-existing active domains. They offer a secure and resilient foundation for malicious operations.
Another key driver for the use of such services is the evasion of Know Your Customer (KYC) requirements and regulatory scrutiny. Legitimate domain registrars often require proof of identity. This makes direct registration riskier for threat actors.
Anonymous and offshore services let them get around these controls. That makes it harder for law enforcement to trace malicious actions. This approach strengthens operational security. It also lowers exposure to legal risks for illicit actions.
Some offshore providers openly advertise that they can resist takedown efforts by cybersecurity firms and law enforcement. This is especially true for domains used in phishing campaigns that target financial institutions or government entities. It reflects a shift from plain anonymity services to active anti-intervention positioning as part of what they sell.
Our research found that these services are marketed and sold mainly through two channels: web-based panels and Telegram bots. Evidence also suggests that the offshore and anonymous domain service ecosystem, often intertwined with bulletproof hosting operations, has been active since the early 2000s:
Offshore Domain Service Sector
The offshore domain service sector plays a critical role in enabling and sustaining malicious activity. It offers domain registration and hosting tools that stress anonymity, operational security, and flexibility. The sector directly supports actions such as phishing campaigns, ransomware distribution, cryptocurrency theft, and many black-market services. It does so by making attacks harder to trace and by getting around traditional detection methods.
Offshore domain providers often work together with bulletproof hosting services. Together they create robust infrastructures that are highly resistant to legal takedown efforts and automated security controls.
3.1. Purpose and Use Cases of Offshore Domains
Offshore domain services are mainly used for the following purposes:
- Phishing and Bank Login Attacks: Threat actors register domains that closely mimic legitimate companies (e.g., banks, e-commerce platforms). They use them to deceive victims and harvest sensitive credentials.
- Ransomware Campaigns: Domains help with payload delivery, victim communication, ransom payment collection, and C2 (command-and-control) infrastructure operations.
- Cryptocurrency Drainers: Dedicated offshore services cater to drainer groups that focus on stealing cryptocurrencies from compromised wallets.
- Bulletproof Hosting Support: Certain providers offer “red page prevention,” anti-bot methods and rapid domain replacement services. These keep malicious operations running even after exposure.
- Malware Delivery and Botnets: Domains are used to distribute malware payloads and to coordinate botnet communications securely.
- Phishing and bank login attacksDomains that mimic banks and e-commerce platforms to harvest credentials
- Ransomware campaignsPayload delivery, victim communication, ransom collection and C2 infrastructure
- Cryptocurrency drainersServices for groups that steal cryptocurrency from compromised wallets
- Bulletproof hosting supportRed page prevention, anti-bot methods and rapid domain replacement
- Malware delivery and botnetsDistributing payloads and coordinating botnet communications
3.2. Service Providers on Underground Platforms
Many threat actors in the offshore domain market present their services through websites that, at first glance, look like real hosting and domain registration companies. A closer look shows who they serve. These platforms mainly serve cybercriminals seeking anonymity, operational security, and resilience against takedown attempts.
These service providers often highlight features such as “No KYC“, “Bulletproof policies,” and “instant provisioning.” These appeal directly to actors involved in phishing, malware distribution, ransomware operations, and other illicit actions.
During our intelligence research, we found a threat actor openly advertising “Bulletproof domains” and “DMCA ignored” policies. The actor offers domain services for high-risk actions such as affiliate programs, warez, torrents, and scam pages.
The threat actor stresses support for a wide range of controversial and illicit actions. These include warez distribution, gambling operations, scam pages, and black-hat marketing campaigns. Prices for domain registration vary depending on the TLD. Payments are accepted in cryptocurrencies such as Bitcoin (BTC), Monero (XMR), and Ethereum (ETH).
A threat actor offers offshore domain registration with explicit claims of bulletproof protection and 24/7 customer support through encrypted communication channels.
One such provider sets itself apart by offering a “content-neutral” hosting policy, along with fast domain replacement options for flagged or seized domains.
Figure 8: Homepage of an anonymous domain registration platform
Some offshore providers promote themselves as “trusted platforms for red teamers and private projects,” offering domain registrations without any verification requirements.
Besides regular websites, some services use Telegram bots. The bots automate ordering and keep buyers anonymous.
Most offshore providers have no content limits. A minority set selective limits to avoid unwanted attention or manage risks. For example:
| Analyst Note |
| Some providers set content limits. This shows they try to balance staying in business for the long term against what they see as ethical lines. They aim to avoid unwanted scrutiny from law enforcement or regulators. |
Besides independent websites, many service providers actively advertise their offerings through dark web forums. These posts often include:
- Descriptions of available domain and hosting packages
- Direct links to their service portals or Telegram bots
- Screenshots of the user interface and service dashboards
- Testimonials or customer reviews to build credibility
Example structure observed during research:
- Forum Advertisement: A detailed post outlining service features and pricing
- Service Redirection: A URL or Telegram link provided for direct access
- Service Interface: Screenshots showing the service ordering panel or domain management dashboard
- Forum advertisementA detailed post outlining service features and pricing
- Service redirectionA URL or Telegram link is provided for direct access
- Service interfaceScreenshots show the ordering panel or domain management dashboard
Our investigation found that underground bulletproof domain and VPS services are often promoted via Telegram. The marketing language closely mirrors that of legitimate infrastructure providers. One such example, originating from a channel, is shown below:
Offshore domain services are also used for many other illicit trade actions. These range from counterfeit goods and fraudulent services to unlicensed pharmaceuticals. The services make them accessible on the clear web under a veil of anonymity:
3.3. Services Offered by Threat Actors
Threat actors offering offshore domain services provide a range of features that improve operational security and ease of use:
- Anonymous Domain Registration: Domains are registered without KYC (Know Your Customer) verification, or with fake or stolen identity data.
- Automated Panels and API Access: Threat actors offer web-based panels and APIs to streamline domain management and automate registrations.
- Free SSL Certificates: Providers often include free SSL certificates to make malicious domains look legitimate and avoid browser warnings.
- Blacklist Avoidance: Domains are automatically checked against blacklists every few hours to prevent blocking.
- Resilient DNS Services: Providers advertise “semi-bulletproof” or “unbreakable DNS” tools to ensure domain uptime.
- Anti-Bot Tools: Advanced anti-bot measures filter out unwanted traffic, such as security crawlers and Google Safe Browsing bots.
- Geo-Targeted Traffic Filtering: Anti-bot tools restrict traffic to specific regions (e.g., mobile devices in target countries) to evade spam detection.
- Cryptocurrency Payments: Payments in cryptocurrency leave no financial trail.
- Domain Rotation and Expiration Alerts: Services include domain cycling to replace flagged domains and extend malicious campaigns.
- Free Cloudflare Integration: Services include integration with Cloudflare to shield domains from takedowns and DDoS attacks.
- Domain Transfer Skills: Domains can be transferred between users without verification.
| Analyst Note |
| These features create a robust ecosystem for threat actors. They can set up resilient infrastructure that supports many cybercrime operations. |
Technological Infrastructure of Service Vendors
Offshore and bulletproof hosting service providers often run on privacy-oriented, highly resilient infrastructures. This is not only theory. Our team saw it first-hand during a case investigation of a known service that supplies domains to ransomware groups.
Their infrastructure is built on the following technical pillars:
- High-performance servers hosted in jurisdictions with limited regulatory oversight.
- Backup power systems, access control methods, and environmental monitoring tools keep the service running.
- Network architecture is reinforced through multi-homing, BGP routing, and DDoS mitigation.
- Standard security protocols include HTTPS, full disk encryption, and intrusion detection systems (IDS).
- Anonymous payments (e.g., cryptocurrency) and WHOIS protection services are provided to preserve user privacy.
4.1. Observed Technologies in Offshore Infrastructure
In our OSINT-based scanning of servers the following technologies were most often observed:
Browser Trust Level: Endpoints are often marked as “Trusted”, despite their use in illicit operations.
Web Server: Nginx – one of the most widely used HTTP servers.
Admin Panel: Webmin – a Linux server management interface, accessible via port 10000.
Remote Access: OpenSSH – standard for secure server connectivity.
WAF/Security Layer: F5 Big-IP Access Policy Manager.
These technologies are widely used open-source and commercial tools. No uncommon or advanced parts were found; the systems are generally built on mainstream, reliable infrastructure choices.
| Analyst Note |
| Threat actors set up their infrastructure with common parts like Nginx and Webmin. This gives them both performance and camouflage. Browsers label these systems “Trusted”. This delays first detection and hinders reputation-based filtering methods. |
Offshore Domain Services, Trends, and Crime
Based on our analysis, we found more than 10 popular offshore domain service providers, each responsible for registering over 1,000 domains. Most ransomware groups and dark web forums also use services from offshore domain providers.
During our investigation, we also discovered dedicated providers that exclusively serve crypto drainer groups:
Our findings show that the two most often used offshore domain providers by threat actors are Offshore Service Provider 1 and Offshore Service Provider 2.
Domains registered via these entities often appear under the names linked to their respective corporate fronts. The total number of domains registered under these two providers is around 300,000 overall.
A steady increase was observed in offshore domain service activity across Q1 2025, with March showing a more than 50% rise compared to January:
This pattern suggests growing demand for quickly deployable infrastructure, often used to help phishing, malware delivery, and command-and-control operations.
The upward trend reflects a growing reliance of threat actors on offshore and bulletproof hosting providers. It also points to an acceleration in underground trade between these actors.
Our findings reinforce the link between domain infrastructure services and ransomware. They show that threat groups function as part of a mutually reinforcing ecosystem. In it, service provisioning, data extortion, and monetization tactics depend more and more on each other.
(Note: In the TLP:WHITE version of this report, the real names of these providers are anonymized.)
5.1. Usage Patterns of Offshore Domain Providers
To show the scale and consistency of usage, we found a representative sample of domain names registered under Offshore Service Provider 1 and Offshore Service Provider 2.
The full domain names and registrar data are restricted in this version. Still, the sample clearly reflects a recurring pattern of registrations linked to suspicious or malicious operations.
- Both providers show domain creation dates clustered within recent years, suggesting ongoing malicious activity.
- Several domain names appear structurally similar or themed around cryptocurrency, anonymization, or underground services.
- In total, over 90,000 domains are attributed to Offshore Service Provider 1. More than 200,000 domains are attributed to Offshore Service Provider 2. Both figures are based on reverse WHOIS data.
Note: Full domain details are presented only in the classified version of this report.
Our analysis of the Black Basta chat leak supports this view. It showed that domains used in their operational actions had been registered via the “Provider 1” offshore service provider. This provider has known ties to bulletproof infrastructure.
This finding reinforces a broader trend. Cyber threat actors deliberately use privacy-focused and jurisdictionally distant registrars. This hides who owns the infrastructure and makes it harder to attribute.
5.2. Registrar Abuse Response Gap
One key reason offshore domain services last is the lack of timely and effective abuse handling by certain domain registrars. Some registrars receive many abuse complaints, including those about phishing, ransomware, and crypto scams. They still consistently fail to take down malicious domains or respond only after long delays.
Our research revealed that most domains used by offshore providers were registered via two major registrars. We refer to them here as Registrar 1 and Registrar 2.
Both entities appear often across infrastructure used by ransomware groups, crypto drainers, and phishing campaigns. These registrars are often characterized by:
- No real-time abuse reporting systems
- No automated domain suspension policies
- Delayed or manual ticket-based takedown processes
- Geographical or legal insulation from Western law enforcement
Past abuse reports about these registrars show repeated patterns of delayed or absent takedown responses. This reinforces their position as preferred intermediaries in the underground domain ecosystem.
| Analyst Note |
| The abuse response gap is a weakness in global domain governance as a whole. Threat actors are well aware of this policy blind zone and actively register domains through non-cooperative registrars to make campaigns last longer. |
The following table shows the observed links between ransomware groups and the top five offshore domain providers. It reflects how they line up with infrastructure acquired via lenient registrars.
| < | Offshore Provider 1 | Offshore Provider 2 | Offshore Provider 3 | Offshore Provider 4 | Offshore Provider 5 |
| RansomedVC | ✓ | ||||
| Abraham’s Ax | ✓ | ||||
| Karakurt | ✓ | ||||
| Black Basta | ✓ | ||||
| Hunters Internationals | ✓ | ||||
| Inc Ransom | ✓ | ||||
| Conti | ✓ | ||||
| Dispossessor | ✓ | ||||
| Malek Team | ✓ | ||||
| Medusa | ✓ | ||||
| Mosesstaff | ✓ | ||||
| Nullbulge | ✓ | ||||
| Radar | ✓ | ||||
| Snatch | ✓ | ✓ |
| Analyst Note |
| These service providers, often used for illicit actions, host hundreds of thousands of domain names. This wide use of infrastructure shows the critical role such providers play. They support large-scale phishing and ransomware operations, as well as many other cybercriminal campaigns. |
Conclusion and Evaluation
Offshore domain services keep growing and stay available. This greatly helps cybercriminal activity to last. These services act as both a shield and an enabler. They protect the identities of malicious actors. They also give them the technical skills for attacks that last and can grow.
Our analysis of Q1 2025 data reveals a clear upward trend in the underground offering of such services, especially those related to domain provisioning. This growth reflects an increasing dependency on offshore infrastructure among cybercriminal groups, especially in ransomware and data extortion campaigns.
Key takeaways:
- Regulatory blind spots and lack of global cooperation allow these services to thrive.
- Threat actors increasingly automate domain buying via bots and APIs. This lowers the barriers to entry for cybercrime.
- Ransomware groups and crypto drainers depend on resilient infrastructure. This is why mitigation efforts should target these ecosystems.
- The offshore domain ecosystem is part of a mutually reinforcing underground economy. Service providers, attackers and monetization tools feed each other’s growth.
| Distribution Notice |
| This blog is classified as TLP:WHITE, allowing for unrestricted sharing. To access the full TLP:AMBER:STRICT version with actionable threat intelligence, contact our team through the designated secure channels. |
Why Brandefense?
Cybercriminal groups exploit your company’s weaknesses to reach sensitive data, run phishing actions and break into your company. They aim to make money or damage your reputation.
The Brandefense module gives proactive protection against cyber threats. It constantly monitors possible risks to your brand, staff, executives and customers.
- For over a decade, Brandefense has been at the forefront of the cybersecurity sector.
- We have been protecting over 600 brands since this time.
- Through our extensive experience in this field, we developed a deep understanding of cybersecurity concepts.
How Does Brandefense Help You?
- Get ongoing and real-time cyber intelligence from Dark Web & Surface Web.
- Cut false-positive records by using machine learning and analysts’ expertise.
- Integrate your security devices like firewalls, SIEM, and SOAR with incidents and intelligence indicators.
1. Brandefense Tools
1.1. Brand Protection
- Breach Monitoring
- Dark Web Monitoring
- Phishing Monitoring
- Compromised Device Detection
- Data Leak Monitoring
- Executive Protection
- Social Media Monitoring
1.2. Cyber Threat Intelligence
- Threat Intelligence
- Key Intelligence
- Fraud Intelligence
- Operational Intelligence
- Tactical Intelligence
- Threat Reports
1.3. 3rd Party Risk Management
- 3rd Party Vendor Risk Assessment
- Secure Snap
1.4. External Attack Surface Management
- Attack Surface Management
- Vulnerability Intelligence
- Security Scan
1.5. Fraud Monitoring
- Fraud Protection
- Global Stolen Credit Card Database
- TTP Reports
2. What Brandefense Provides?
2.1. Risk-Free Exploration
Protect your sensitive data and avert access without permission, without venturing into the perilous dark web realm.
2.2. Key Intelligence Power
Guard against threat actors and attacks that target your sector and region, and do it early. That helps you avoid possible harm to your business.
2.3. Controlled Attack Surfaces
Assess the risks of possible attacks and new applications on our servers with little effort. Keep tabs on their ever-changing, openly accessible surfaces.
2.4. Guard Against Fraud
Detect stolen cards and alert your staff and customers to stolen data. Stop fraudulent actions carried out in your name online.
2.5. Secure Critical Staff
Monitor data breaches that affect people who have access to key data. Protect your company’s reputation by monitoring suspicious activity and fake accounts.
2.6. Protection from CVEs
Prevent possible ransomware attacks to stop the chain of attacks. Vulnerability intelligence lets you take timely action against vulnerabilities.
