Submitted 1 year ago by ALostInquirer@lemm.ee to nostupidquestions@lemmy.world
Besides proxying to try to mask their activities, wouldn’t those playing host to bad actors have to have some insight or notice some abnormal activity that might give away that someone may be abusing their services?
Or is it that there’s a mix of a financial & legal advantage to remaining as ignorant to that activity as possible for as long as possible up till push comes to shove & they’re being served a warrant?
Yeah, it depends on what you mean.
In many cases malware and phishing is hosted off other compromised sites. They build a list of Wordpress sites with vulnerabilities and host their files onto them. So for example “legitimate-medical-site.net.com” is a real site, so they’ll Chuck malicious files in there somewhere like “legitimate-medical-site. net. com/qwertasdf/invoice.pdf”.
If the site gets blocked or shutdown it’s no loss to them.
Another technique, especially phishing wise, they will have a semi-plausible domain name (e.g. youbank-security-server .con). But they will register heaps of these. There are tonnes of top level domains that do next to no checking again, these things cost a few bucks so having it taken down is not a problem.
The combination of burner sites and domains mean they have a window of opportunity to run their attacks and scams before other protections kick in.
It’s the latter. As long as the bad actor gives money to the hosting company they don’t really care (and for legal reasons they either can’t or won’t monitor things too tightly) what you do with the capacity you paid for. And when it becomes annoying enough they’ll suspend the account. Rinse and repeat.
Fosheze@lemmy.world 1 year ago
That depends on what you mean by “bad actors”. If you’re just talking about illegal content then it’s just that the law isn’t universal. They just find a host somewhere where whatever they want to host is legal.
ALostInquirer@lemm.ee 1 year ago
Well, not just content, but also activity like making fake sites to steal credentials, send out phishing emails/texts, and that kind of thing. I guess that may fall under the same point though, of the law not being universal regarding these activities, e.g. talk of some governments ignoring bad actors so long as their activities only target other nations’ citizens.