What Is Bulletproof Hosting?

Bulletproof hosting (BPH) is internet infrastructure intentionally leased by providers to cybercriminals, deliberately structured to ignore abuse complaints, maintain anonymity, evade law enforcement takedown attempts, and enable malicious activities including ransomware, phishing, malware delivery, and denial-of-service attacks.

The key characteristic that distinguishes bulletproof hosting from compromised legitimate hosting is intent. According to CISA (2025), BPH providers knowingly and deliberately market infrastructure as "bulletproof" because they do not engage in good faith with legal processes, victim complaints, or third-party abuse reports.

How does Bulletproof Hosting Work?

Bulletproof hosting operates through a deliberate operational model distinct from legitimate hosting infrastructure.

The intentional structure forms the foundation. Providers deliberately ignore abuse reports and takedown requests as core business practice. They maintain minimal legitimate business practices to appear operational while marketing services specifically to cybercriminals. Customer support operates through criminal channels rather than standard business communications.

Technical operations enable diverse criminal activities. According to CISA (2025), BPH providers host malware command-and-control servers, facilitate phishing infrastructure, distribute malware and ransomware, enable DDoS attack infrastructure, and host illegal content including fraud and exploitation.

Evasion and migration tactics protect criminal customers. According to Intel471 (2025), when infrastructure is discovered, BPH providers automatically migrate customers to new IP ranges. They sub-allocate network blocks to hide true infrastructure ownership and employ fast-flux techniques to rapidly change IP associations. Spamhaus (2025) documented that sophisticated operators simultaneously operate both legitimate and bulletproof resells to maintain reputation.

The provider relationship structure obscures criminal activity. BPH often operates through compromised lower-tier hosting providers, leasing network blocks from legitimate ISPs. According to Trend Micro (2025), they exploit legitimate providers' limited abuse monitoring capabilities while hiding behind provider reputation.

Geographic advantage provides legal insulation. Operations are predominantly located in Eastern Europe, Russia, or China, selected based on weak law enforcement action. According to CISA (2025), jurisdictional challenges prevent effective government pressure and international cooperation.

The Russian BPH provider "Proton66" disclosed by TheHackerNews in April 2025 demonstrated active threat activity. Researchers detected mass scanning, credential brute-forcing, and exploitation attempts since January 8, 2025, targeting organizations worldwide with compromised infrastructure being actively weaponized.

How does Bulletproof Hosting Differ from Related Threats?

Bulletproof hosting deliberately ignores abuse reports as business model, while compromised legitimate hosting is unintended. BPH operators actively support customer migration when detected, a service no legitimate provider offers.

Why do Bulletproof Hosting Matter?

Government response in 2025 recognized BPH as systematic threat requiring coordinated action. CISA released "Bulletproof Defense: Mitigating Risks from Bulletproof Hosting Providers" in November 2025, representing joint guidance from NSA, DoD Cyber Crime Center, FBI, and international partners. According to Infosecurity Magazine (2025), this was the first comprehensive government framework to address BPH.

Industry scale demonstrates massive criminal impact. While precise figures remain difficult to verify, BPH facilitates billions in criminal transactions annually. It plays a major role in the ransomware ecosystem, which generated estimated $24+ billion in global losses in 2024, according to industry estimates. BPH provides critical infrastructure for Phishing-as-a-Service platforms and powers the majority of botnet command-and-control operations.

The systematic nature of BPH infrastructure creates multiplier effects across cybercrime. Rather than individual attacks, BPH enables entire criminal ecosystems by providing stable, reliable infrastructure that criminals can depend on for extended operations.

What major law enforcement actions have targeted Bulletproof Hosting?

International law enforcement operations against BPH providers escalated significantly in 2024 and 2025, demonstrating a growing coordinated response to this infrastructure threat.

Zservers sanctions (February 2025)

On February 11, 2025, the United States Department of the Treasury's Office of Foreign Assets Control (OFAC), the United Kingdom's Foreign Commonwealth and Development Office (FCDO), and Australia's Department of Foreign Affairs and Trade (DFAT) jointly sanctioned Zservers, a Russia-based bulletproof hosting provider, for its role in supporting LockBit ransomware attacks. Sanctions were also issued against two Russian nationals, Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov, both key administrators at Zservers. Investigators found a seized laptop operating a virtual machine connected to an IP address subleased by Zservers, which was running a programming interface for operating LockBit ransomware. Dutch authorities subsequently seized 127 servers run by Zservers in an operation in Amsterdam (CyberScoop, 2025).

Operation Endgame and CrazyRDP takedown (November 2025)

Between November 10-13, 2025, coordinated raids across 11 locations in the Netherlands, Germany, and Greece resulted in the seizure of 1,025 servers and 20 criminal domains associated with three major malware operations: Rhadamanthys (a sophisticated infostealer), VenomRAT (a Remote Access Trojan), and Elysium (a botnet). Dutch police seized nearly 250 physical servers from data centers in The Hague and Zoetermeer belonging to CrazyRDP, a notorious bulletproof hosting provider implicated in 80 law enforcement investigations spanning cybercrime and child sexual abuse material distribution. Officials accessed a Rhadamanthys database revealing more than 525,000 infections between March and November 2025 across 226 countries, collecting over 86 million individual records. Operation Endgame is coordinated by Europol and Eurojust as a joint effort between law enforcement and judicial authorities of Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the United Kingdom, and the United States (Bleeping Computer, 2025).

Media Land and Aeza Group sanctions (November 2025)

On November 19, 2025, OFAC sanctioned Media Land, Aeza Group's front companies, and associated individuals and entities for providing bulletproof hosting services used for illicit activities. This action targeted a broader network of BPH infrastructure providers supporting diverse criminal operations (Elliptic, 2025).

LockBit infrastructure arrests (October 2024)

On October 1, 2024, authorities arrested four individuals linked to the LockBit ransomware gang, including a developer, a bulletproof hosting service administrator, and two other affiliates, demonstrating law enforcement's focus on the infrastructure layer supporting ransomware operations (Veeam, 2024).

What are the Limitations of Bulletproof Hosting?

Bulletproof hosting faces several operational challenges and vulnerabilities:

Detection visibility through infrastructure compartmentalization. While compartmentalization makes full network mapping challenging, it is not impossible. Security researchers using sophisticated analysis can still map BPH networks.

Attribution complexity through legitimate ISP layers. BPH is layered through legitimate ISPs, complicating attribution to specific criminals. This creates investigative challenges but also limits operational flexibility.

Cost overhead requiring criminal revenue. According to Spamhaus (2025), premium pricing runs 3-5 times legitimate hosting costs, requiring substantial criminal revenue to justify. This limits BPH to well-funded operations.

Regulatory pressure from international cooperation. Increasing international cooperation and sanctions targeting BPH operators create business uncertainty and operational risks.

ISP leverage through customer vetting. According to CISA (2025), legitimate ISPs are increasingly implementing comprehensive customer vetting procedures, making it harder for BPH operators to acquire infrastructure.

Migration labor tying up resources. Constant migration requirements when infrastructure is discovered tie up operator resources and create detection opportunities during transition periods.

How can Organizations Defend Against Bulletproof Hosting?

ISPs provide the primary defense against bulletproof hosting through operational controls and customer vetting.

According to CISA (2025), ISPs should implement comprehensive customer vetting and due diligence procedures, collecting and verifying customer information before allocating resources. Creating industry codes of conduct for BPH abuse prevention establishes baseline standards.

Providing customers with malicious resource lists and filters (with opt-out options) and developing premade filters for customer networks helps downstream protection. Monitoring for suspicious activity patterns from allocated IP ranges enables early detection. Collaborating with peer ISPs to share threat intelligence on BPH indicators creates network effects.

Network defenders should monitor for traffic patterns consistent with BPH hosting including malware C2, phishing, and DDoS. Blocking known BPH IP ranges at network perimeter prevents outbound connections. Tracking DNS queries to BPH-hosted domains and implementing DNS sinkholing for known BPH infrastructure provides additional protection.

Organizations should educate staff on indicators of compromise from BPH infrastructure. Implementing egress filtering to prevent C2 callbacks to known BPH ranges blocks command channels. Deploying endpoint detection for behavioral indicators of BPH-hosted malware identifies infections even when infrastructure changes.