Daniel's Hosting (DH) is one of the largest free web hosting provider for dark web services. And it has shut down after getting hacked for the second time in less than two years.
The result of this affected 7,600 dark web websites.
The thousands of websites have been taken offline, after the hacker deleted the web hosting portal's entire database.
The incident happened on March 10, at around 3:30 am UTC, according to a message posted by Daniel Winzen, the German software developer behind DH's now-defunct portal.
Winzen said that an attacker accessed the DH backend and deleted all hosting-related databases. After successfully removing all of DH's clients, the hacker then deleted Winzen's database account and created a new one to use for future operations.
Winzen only discovered about the hack in the next day early in the morning, at which time most of the data was already lost.
DH hosting doesn't keep backups, and that is by design. In cases like this, things are unfortunate for those who had their dark web websites hosted at DH.
Winzen said that he maintained DH as a hobby, saying that he didn't look too much into it.
"I am currently very busy with my day-to-day life and other projects, I decided to not spend too much time investigating," he said.
Winzen pointed out that the hack only affected the DH backend database account, and not the accounts of users who had been hosting sites on the DH hosting platform.
However, Winzen said that users should consider the passwords they used on DH as "leaked" and change them as soon as possible if ever users used the same password for other accounts.
For the foreseeable future, Winzen said he has no intention to turn on DH.
"This is a free-time project I do next to my full-time job, and it's very time consuming to try and keep the server clean from illegal and scammy sites," Winzen said. "I spend 10 times more time on deleting accounts than I can find time to continue development," he added. "At this time I do not plan on continuing the hosting project."
As alternatives to DH, Winzen said that users who need free hosting for dark web websites can use others similar, like Freedom Hosting Reloaded, Ablative Hosting, OneHost or IBHost .
"I'm still planning on relaunching the service at a later time with new features and improvements," Winzen said, adding that "not having to administrate the services all the time will hopefully give me more time for actual development. However, it may take months before I'm ready to relaunch."
This hacking incident is DH's second after previously hacked in November 2018.
At that time, hacker similarly breached DH's backend database server and deleted all hosted websites, which accounted to more than 6,500.
Daniel's Hosting became the largest web hosting provider for dark web services after the Anonymous hacker collective breached and took down Freedom Hosting II, another popular dark web hosting provider, after discovering that the hosting provider was housing child abuse portals.
DarkOwl, a darknet cybersecurity intelligence tools analyzed DH, and found the following statistics:
- 657 of the hidden services had the title “Site Hosted by Daniel’s Hosting Service” and little else.
- More than 4,900 websites were in English, 54 were in Russian and two of the oldest were in Portuguese.
- 457 of the hidden services contained content related to hacking and/or malware development.
- 304 of the websites were classified as forums.
- 148 were classified chatrooms
- 136 had drug-specific keywords.
- 109 contained content related to counterfeiting.
- 54 specifically mentioned carding information.
- More than 20 of the sites referred to weapons and explosives.
