Libre Advertises No-KYC “Abuse-Resistant” VPS and VDS Hosting With XMR Payments
Overview
An actor using the handle "Liberland" is advertising a hosting service branded as Libre, offering what it describes as “bulletproof” or abuse-resistant VPS and VDS servers. The listing says customers can rent one server at a time for terms starting at one month and renew afterward.
The advertisement claims no registration, no email, no KYC and no logs, with cryptocurrency payments including XMR. It also advertises full root access, support for multiple operating systems, RDP/VNC/SSH connectivity, additional IP addresses, virtualization support, server-management software and technical support. The service, its infrastructure, privacy claims and abuse-resistance claims have not been independently verified.
Post details
What the post advertises
- “Abuse-resistant” VPS and VDS servers
- One server per customer
- Rental terms starting at one month
- Renewal option
- Cryptocurrency payments, including XMR
- No registration claimed
- No email required
- No KYC claimed
- No logs claimed
- Exclusive server access
- Full root privileges
- Windows, Linux, Kali, Ubuntu, Debian and CentOS support
- Custom ISO installation advertised
- RDP, VNC and SSH connectivity
- Additional IP addresses available
- Virtualization support
- Server-management software installation
- Technical support and troubleshooting
The listing also advertises graphics-enabled servers for Android emulators, control-panel installation, system reinstalls and installation of additional software. These are service claims made in the advertisement and are not independently validated.
Screenshots
IOCs & contact identifiers
Identifiers directly visible in the advertisement. These support correlation and do not independently verify the provider's infrastructure or claims.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | Liberland | Screenshot 1 |
| Service domain | libreservice[.]se | Screenshot 1 |
| Telegram bot | @LibreAssistanceBot | Screenshot 1 |
The service domain and Telegram bot are identifiers associated with the advertisement. This report does not reproduce direct purchase/order links. No malware hash, Tox ID, Session ID or attacker-controlled IP address is visible in the supplied material.
Mapped techniques
Claimed identifies behavior explicitly described in the advertisement. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the service is confirmed to be used in a specific intrusion.
- Resource DevelopmentT1583.003Acquire Infrastructure: Virtual Private ServerInferredThe advertisement offers VPS/VDS infrastructure with full root access, cryptocurrency payments and privacy-focused provisioning, characteristics that could be used to acquire infrastructure for malicious operations.
Potential impact
If the service operates as advertised, its combination of no-KYC provisioning, cryptocurrency payments, claimed no-logging, full administrative access and flexible operating-system deployment could make it attractive for infrastructure used in phishing, malware hosting, command-and-control, credential theft, fraud or other abusive activity.
Status Unverified
Dark Web Informer has not independently verified the provider's ownership, infrastructure, abuse-handling practices, no-KYC policy, logging claims, technical capabilities or availability. The supplied screenshot documents the advertisement and visible identifiers only.
