Bulletproof Hosting (BPH)

Bulletproof hosting (BPH) is internet hosting whose operators knowingly support malicious activity and resist efforts to disrupt it. Providers may ignore or obstruct abuse reports, conceal customers, or move infrastructure to keep operations running. "Bulletproof" describes the service's promise, not immunity from takedown.

The term bulletproof hosting appears in sanctions announcements, indictments and government security guidance. Criminals use this hosting for jobs such as running command and control servers that send instructions to infected devices, delivering malware (harmful software), hosting phishing pages and supporting ransomware attacks.

Explain It Like I'm 10

Picture a kid who hands out spare school lockers and knows that some of the things stored in them break the school rules. When a teacher asks about a locker, he either says nothing or moves the stuff to another locker and says it has been cleared out. Some of the lockers are his own. Others he has borrowed from classmates who do not know what he is doing with them. He tells everyone the lockers are unbreakable. They are not: the school can take the lockers back, and a classmate who finds out can stop lending.

What does bulletproof hosting do that an ordinary host does not?

A hosting provider rents out servers, the computers that keep websites and other online services running. When a customer's service harms someone, a victim or the police can send the provider an abuse report or a legal request. An ordinary provider investigates, acts on abuse it can substantiate, and checks that a legal request is genuine before it complies.

A bulletproof provider works differently. Joint guidance published in November 2025 by government agencies in the United States, Australia, Canada, the Netherlands, New Zealand and the United Kingdom defines it as a provider that knowingly and intentionally markets and leases its infrastructure to cybercriminals. The guidance says such providers can sell their service as bulletproof because they do not engage in good faith with legal process or with victims' complaints. One example is demanding onerous paperwork before acting on a law enforcement takedown request.

Checking that a request is genuine is normal; using paperwork to stall it is obstruction. The Australian Cyber Security Centre (ACSC) wrote in January 2025 that the word "bulletproof" is marketing: these services are as susceptible to disruption as other providers, but they refuse takedown requests and ignore abuse complaints.

The label turns on knowledge and intent, which no single sign can show. The guidance notes that legitimate hosting providers, data centers and cloud providers may unknowingly enable a bulletproof host, and a service that is abused without its operator's knowledge is not bulletproof hosting. Privacy protections, servers in another country or one unanswered complaint do not by themselves show that a provider knowingly supports crime.

How does a bulletproof host stay online?

The US Treasury Department's account of Zservers shows the basic move. The US, Australia and the UK sanctioned Zservers in February 2025 for its role in supporting LockBit ransomware attacks. In 2023, Treasury says, two Zservers administrators shut down an IP address, the numeric address that identifies a server online, after a Lebanese company complained that a Zservers-associated address had been used in a ransomware attack. They then assigned a new IP address to the same customer and told the complainant that the original address had been cut off. Treasury concluded that Zservers likely let ransomware attacks continue this way. The complaint named one address, so the complainant saw that address go dead while the customer carried on from another.

Obstructing complaints is only one tool. Several arrangements can contribute, and a provider may combine them:

• Where it operates: ICANN's security committee wrote in 2008 that many such providers operated where local authorities and laws offered a relatively safe harbor for illegal activity.
• Whose infrastructure it uses: some providers lease their own infrastructure to criminals. Increasingly, the guidance says, they resell infrastructure that they lease or steal from legitimate hosting providers, data centers, internet service providers (ISPs) or cloud providers that may unknowingly enable them. Spamhaus, which publishes lists of abusive networks, described a 2019 operation that rented virtual servers from legitimate hosts using stolen or fake identities.
• Technical measures: providers change the identifiers that point to a customer, such as IP addresses, network numbers and name records, may answer abuse reports from temporary email addresses, and may hide who their customers are. The ACSC also describes network switching methods that help obscure locations, identities and activities.

An upstream provider is the larger company that carries a network's traffic to the rest of the internet. An autonomous system number (ASN) identifies a network, or a group of networks, run as one unit. A bulletproof host needs an upstream provider to be reachable, and one that resells space sits inside other companies' networks, so both are pressure points.

Why is blocking a whole network not a clean fix?

One option is to block a bulletproof host's whole network by its ASN, refusing all traffic from that network's addresses. The joint guidance says this may be ineffective, for three reasons:

• Collateral damage: the filter may block legitimate traffic. Where the host resells space from a legitimate provider, the ASN may belong to that provider, so a block can also hit its other customers.
• Dilution: criminals often spread their infrastructure across several networks, so it forms only a small part of each.
• Replacement: the guidance reports that a bulletproof host can request a new ASN from an internet registry, receive it within two to five business days, and move its addresses to it.

The guidance does not tell defenders to block nothing. It asks them to weigh the risks first and then choose how narrowly to filter: a whole ASN, a range of addresses or individual addresses. It also asks them to record why each filter exists, review their lists regularly, remove entries that have moved to legitimate use, and refresh the mapping between ASNs and addresses, because the addresses behind an ASN can change. A filter built on a stale entry can keep blocking innocent traffic.

For internet service providers, the guidance offers examples and options, not fixed rules:

• Opt-outs: it suggests ISPs consider offering customers an opt-out from filtering.
• Blocking periods: it gives 90 days as an example of how long to block a network's malicious ranges before asking its operator, or its upstream provider, whether the abusive customers were removed.
• Customer vetting: to make it harder for bulletproof providers to lease the ISP's infrastructure, it lists identity documents and banking details as examples of what an ISP might collect from new customers, and adds that this should be done in line with relevant data privacy laws.

The guidance's stated aim is to reduce the effectiveness of this infrastructure and potentially push criminals toward providers that respond to complaints and takedown requests.

How do governments and companies try to disrupt bulletproof hosting?

Four kinds of measure act on different parts of the business, and they coexist: disconnection by an upstream provider, sanctions, seizure and prosecution.

Cutting off the upstream

In November 2008 the US hosting company McColo was disconnected from the internet. Richard Clayton of the University of Cambridge reported that this took the controllers of six major botnets (networks of infected devices run by criminals) offline, and that spam reaching one UK internet provider dropped sharply. He called the reduction substantial but temporary. Kaspersky reported that the decline was short-lived and botnet activity had resumed within a few days, and that McColo had used a backup arrangement with a Swedish provider, TeliaSonera, which cut it off less than two days later.

Sanctions restrict money and dealings, not servers

A sanctions designation is a legal and financial measure. Treasury's announcements say that, under a US designation, the designated party's property in the United States or under the control of US persons is blocked, US persons are generally barred from transacting with it, and others who deal with it risk sanctions or enforcement. A designation does not disconnect servers. Termination by an upstream provider, asset seizure and criminal charges are separate mechanisms.

Aeza Group shows what can follow. Treasury designated Aeza on 1 July 2025. On 19 November it said that Aeza's leadership had started a rebranding strategy to remove visible connections between Aeza and its new infrastructure, and it designated Hypercore Ltd, a UK company that Treasury describes as registered and used by Aeza after its designation to move its IP infrastructure and evade sanctions. Treasury designated Hypercore on the grounds that it was owned or controlled by Aeza or acted for it. A new company used to continue a business can therefore be designated as well.

Seizure: the Dutch case

In May 2026 the Dutch fiscal investigation service (FIOD) arrested two men on suspicion of violating the Dutch Sanctions Act by indirectly making economic resources available to entities the EU had sanctioned, and seized more than 800 servers. The FIOD says a large part of a sanctioned web hosting company's infrastructure was transferred, around the time of its EU listing in May 2025, to a new Dutch company that in reality acts as a front for the sanctioned entities. The men are suspects, and the announcement is not a court ruling.

The announcement names no company, but its dates (founded 10 February 2022, listed 20 May 2025) match the entry for Stark Industries Solutions Ltd in the EU's decision of 20 May 2025. That entry describes a UK-registered web hosting service providing services intended to hide the activities of state-linked Russian actors from European law enforcement.

What one security company saw after the raid

ELLIO, a security company, watched the network it linked to the case from its own sensors. It reported that scanning from the network continued at its usual daily rate through the raid and was still going a week later, while about a third of the address ranges it had seen in use in the previous 90 days had stopped being announced to the rest of the internet. In its 27 May 2026 post it described the operation, for now, as having shrunk rather than relocated.

Charges: what the Media Land indictment alleges

Treasury designated Media Land, a Russian hosting company, and its leaders in November 2025. A US indictment returned in December 2024 and unsealed in July 2026 charges two related companies, Medialand LLC and ML.Cloud LLC, and three Russian nationals. The defendants are charged, not convicted. Paragraph 141 alleges that they aided and abetted 17 of their customers by providing infrastructure that led to the theft, extortion and collection of more than $62 million from 44 victims.

What courts must prove

Courts also have to decide what an operator knew. In Germany, the Trier Regional Court convicted eight people in 2021 of membership of a criminal organization over a data center in a former NATO bunker, and the Federal Court of Justice largely upheld this in September 2023. The court found that they knew their servers were mainly used for crime and that the equipment was built for anonymous use protected from state access. The Federal Court rejected their argument that the liability exemption for web hosters made their activity lawful. They were cleared of the further charge of helping the users' crimes because they lacked sufficiently concrete knowledge of the acts charged.

Each measure can reduce a bulletproof host's capacity, reach or availability, but none promises permanent removal. Operators adapt, as the McColo and Aeza cases show.

What does a network match in your logs mean?

The guidance tells defenders to log ASNs and IP addresses and to raise an alert when traffic matches a list of malicious resources. A match is a lead to investigate, not proof that a device is compromised, because the guidance itself warns that filters can catch legitimate traffic and that addresses can move to legitimate use.

Blocked inbound scanning and an unexpected outbound connection are different. Blocked inbound scanning means an outside system probed your network and was stopped. An outbound connection means one of your own devices contacted the flagged address, which deserves a closer look. To judge it, check the time, the direction of the traffic, whether the connection succeeded, which device was involved, and what related DNS or endpoint records show.

Where does bulletproof hosting appear in MITRE ATT&CK?

MITRE ATT&CK, a public catalog of attacker behavior, has no entry called bulletproof hosting, because bulletproof hosting is a service model and ATT&CK describes what attackers do. The technique Acquire Infrastructure (T1583) covers buying, leasing or renting infrastructure. Its Virtual Private Server sub-technique (T1583.003) notes that many providers sell virtual servers and that attackers may also use providers known for renting them with minimal registration information. The phrase "bulletproof hosting" appears on those pages only in the title of a 2015 reference. Renting an ordinary virtual private server does not show that a bulletproof host was used: ATT&CK describes the acquisition, not the provider's knowledge or conduct. Like an initial access broker, who sells ways into networks, a bulletproof host is a role in the criminal market rather than a technique.