Deep Hosting

Deep Hosting, also known as Dhostpwned, operates as a dark web hosting service that provides shared hosting accounts to customers seeking to publish content on the anonymised part of the internet. The company’s headquarters is located in the United States of America. Its core offering enables users to deploy websites, forums, and marketplaces that require the privacy and anonymity associated with dark web infrastructures. By offering hosting environments that support common web technologies such as PHP, the service facilitates the operation of various illicit and legitimate hidden services. Clients typically use the platform to host sites that are not accessible through conventional search engines or standard web browsers.

In July 2017, the service suffered a security breach when an attacker registered a shared hosting account and exploited an unblocked PHP function to execute limited commands on the server. This intrusion allowed the attacker to exfiltrate data from multiple hosted sites, including potential database leaks, and prompted the provider to initiate a server lockdown, conduct forensic analysis, patch the vulnerability, and enforce password resets for all user accounts. The attacker claimed to have gained access to ninety‑one dark web platforms, many of which were illicit marketplaces and forums, and reported that several of these sites became inaccessible following the incident. The breach also highlighted an unrelated VPS compromise that used default credentials, which inadvertently disrupted the operations of a specific marketplace. These events underscored the service’s reach across a notable segment of the dark web ecosystem.

Deep Hosting’s distinguishing attribute lies in its specialization in providing hosting solutions tailored for the dark web, a niche that demands heightened anonymity and resistance to conventional takedown measures. The provider’s infrastructure supports the deployment of hidden services that rely on Tor or similar anonymity networks, positioning it within a sector that serves both illicit actors and privacy‑seeking users. Its technical environment, which permitted the execution of PHP functions that were later blocked, reflects a focus on compatibility with common web applications rather than hardened, security‑first configurations. The incident response described in the breach report—server lockdown, forensic review, patching, and mandatory password resets—demonstrates a standard operational procedure for handling security events. While no explicit ownership or parent‑subsidiary relationships are disclosed in the available sources, the company functions as an independent hosting provider headquartered in the United States.