Jingle Shells: How Virtual Offices Can Give Malicious Hosting a Facade of Legitimacy
Summary
Team Cymru links a Metasploit C2 IP and seven high-risk ASes to UK-registered hosting firms using virtual offices and overseas infrastructure, finding opaque records and leased IPv4 may enable abuse; it recommends stronger vetting and monitoring.
Key points
- Team Cymru identifies 2.57.122.72 as a Metasploit C2 server based on an X.509 certificate and inbound traffic to TCP/3790, then traces its network and hosting associations.
- Company and WHOIS records connect the case to UK-registered businesses; one shared virtual-office address had over 1,000 active companies, many using the broad business code 96090.
- As of December 1, 2024, seven of the 30 Risknet networks associated with malicious activity had a GB country code; three were among the top five, including the top two.
- Six of the seven highlighted firms used virtual offices, while their associated infrastructure was largely geolocated outside the UK, including in Mauritius and the Seychelles.
- WHOIS records linked three providers to Neterra Cloud IPv4 leasing. The article says there is no evidence that Neterra is complicit, while noting that leased address space may be abused.
- The article recommends using Risknet tags, investigating suspicious businesses and hosting practices, and strengthening due diligence and KYC requirements.
Article Details
- Attack Vectors
- Virtual office addresses and shell companies can obscure the people and operations behind hosting infrastructure; the article describes multiple companies sharing registered addresses.
- Leased IPv4 space, offshore hosting, and limited KYC checks may enable hosting environments used for phishing and malware command-and-control.
- Team Cymru identified 2.57.122.72 as a Metasploit C2 server based on an X.509 certificate and inbound TCP/3790 traffic.
- The article reports that several hosting networks associated with high concentrations of malicious activity used infrastructure geolocated to jurisdictions including Mauritius and the Seychelles.
- Defensive Notes
- Use Team Cymru Risknet tags in Pure Signal Recon and Scout to identify and investigate networks with high concentrations of malicious activity.
- Regularly scan for flagged IP addresses and consider blocking high-risk autonomous systems, using threat intelligence to assess exposure.
- Cross-reference suspicious IP addresses and domains with business-registration records and shared virtual-office addresses.
- Assess partners' hosting practices, public-facing presence, and regulatory compliance as part of due diligence.
- Support stronger KYC requirements and greater transparency for virtual offices, IPv4 leasing, and business registrations.
- Share intelligence and abuse patterns with other stakeholders across the hosting ecosystem.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 2[.]57[.]122[.]72 | Identified by Team Cymru as a Metasploit C2 server based on an X.509 certificate and inbound TCP/3790 traffic. |
Vendors
DMZHostAccording to the RIPE database, the /24 subnet containing this IP address is associated with the domain name dmzhost[.]co.DOLPHIN 1337 LIMITEDAS215208 Dolphin 1337 Limited (Rank 11)EMANUEL HOSTING LTDAS215766 Emanuel Hosting Ltd (Rank 26)MARIO NETWORKS LIMITEDAS50580 Mario Networks Limited (Rank 5)MORTALSOFT LTDAS216240 MortalSoft Ltd (Rank 1)NeterraNeterra is a Bulgarian ISP that, through its Neterra Cloud division, leases and sells IPv4 space.PARTNER HOSTING LTDAS215826 Partner Hosting Ltd (Rank 28)PSB HOSTING LTDAS214927 PSB Hosting Ltd (Rank 21)SILENT CONNECTION LTDAS215240 Silent Connection Ltd (Rank 2)Team CymruTeam Cymru’s Risknet project provides valuable context by identifying hosting providers with the highest concentrations of malicious activity at any given time. It measures the percentage of IP addresses within aUNMANAGED LTDThis IP address is assigned to AS47890, operated by UNMANAGED LTD, with geolocation data suggesting the company is based in the United Kingdom.
Products
Tools
Metasploit FrameworkIP 2.57.122.72 is identified as a Metasploit C2 server; based on an X.509 certificate hosted on the server and corresponding inbound network traffic to TCP/3790—the default Metasploit service port.RisknetTeam Cymru’s Risknet project provides valuable context by identifying hosting providers with the highest concentrations of malicious activity at any given time. It measures the percentage of IP addresses within a
Countries
BulgariaMORTALSOFT LTD has one /24 netblock geolocated to Bulgaria and is associated with anonvm[.]wtf, advertising cloud hosting services.Mauritiusin jurisdictions like the UK, operate infrastructure in regions with less regulatory oversight, such as Mauritius and Seychelles, which can make it easier to circumvent stricter compliance requirements.MontenegroPARTNER HOSTING LTD has eighteen /24 netblocks geolocated across Russia (11), Montenegro (3), Panama (2), Seychelles (1), and the UK (1). It is associated with altawk[.]com, advertising cloud hosting services.PanamaPARTNER HOSTING LTD has eighteen /24 netblocks geolocated across Russia (11), Montenegro (3), Panama (2), Seychelles (1), and the UK (1). It is associated with altawk[.]com, advertising cloud hosting services.RussiaPARTNER HOSTING LTD has eighteen /24 netblocks geolocated across Russia (11), Montenegro (3), Panama (2), Seychelles (1), and the UK (1). It is associated with altawk[.]com, advertising cloud hosting services.Seychelleslike the UK, operate infrastructure in regions with less regulatory oversight, such as Mauritius and Seychelles, which can make it easier to circumvent stricter compliance requirements.United Kingdomin the context of cloud hosting providers. While the analysis centers on activities observed in the United Kingdom—where business registration rules are notably lax, even for individuals residing overseas—the
Industries
Business registration servicesdeeper, we identified another company, PARAMOUNT COMPANY FORMATIONS LIMITED, which offers business registration services. These services include the provision of a business address at 35 Firs Avenue for a nominalInternet hostingThis highlights the broader issue of unclear responsibility within the Internet hosting ecosystem. Nevertheless, stakeholders across the Internet hosting ecosystem must take proactive steps to minimize abuse and denyVirtual office servicesVirtual office services are increasingly leveraged to establish shell companies, sometimes with multiple entities registered at the same address, creating an appearance of legitimacy while obscuring the true nature of