Bulletproof hosting is a hosting service that knowingly tolerates criminal activity and ignores abuse complaints and takedown requests from researchers and law enforcement.
How bulletproof hosting works
Bulletproof hosting providers rent servers, IP addresses and domains to customers who cannot use ordinary hosts. They are typically registered in jurisdictions with weak cooperation on cybercrime, advertise on underground forums and accept anonymous payment in cryptocurrency. To survive pressure, many operate as resellers on top of legitimate data centres, move customers between IP ranges and shell companies, and quickly reappear under new names after being blocked.
Typical customers host:
- command and control servers for malware and botnets;
- phishing kits, exploit kits and malware download sites;
- spam infrastructure, fraud shops and ransomware leak sites.
Why bulletproof hosting matters
Resilient infrastructure is a backbone of the criminal economy. When the US provider McColo was disconnected by its upstream networks in 2008, global spam volumes dropped sharply for weeks. The Russian Business Network became notorious for hosting malware and fraud in the mid-2000s. In 2019 German police raided CyberBunker, a data centre in a former NATO bunker in Traben-Trarbach that hosted dark web markets and botnet servers. Governments have also begun imposing sanctions on such providers, for example Zservers in 2025.
How defenders respond
- Block or closely monitor traffic to IP ranges and autonomous systems known for abuse.
- Use threat intelligence feeds that track bulletproof infrastructure.
- Researchers and authorities use sinkholing, domain seizures and pressure on upstream providers to disrupt it.
