Bulletproof hosting is internet infrastructure that is knowingly and intentionally marketed and leased to cybercriminals. The New Zealand NCSC, in joint guidance, describes the providers as built to withstand takedown attempts and law enforcement action. Criminals use it as a stable base for malicious activity.
- Also Called3other namesBPH · bulletproof hosting provider · bulletproof host
- Related Terms3linked entriesCommand and control (C2) · Threat intelligence · Phishing
What is bulletproof hosting?
The New Zealand NCSC publishes joint guidance on this topic. It says a bulletproof hosting provider is an internet infrastructure provider that knowingly and intentionally markets and leases its infrastructure to cybercriminals. Hosting here means renting servers or network space so that content or services can be reached online. The guidance says these providers market their services as bulletproof to attract cybercriminal clients.
How does it work?
The guidance describes two main methods. A provider can lease its own infrastructure directly to criminals. It can also resell stolen or leased infrastructure from legitimate providers, such as hosting companies, data centers, internet service providers and cloud services. Those legitimate providers may be unaware that they are enabling criminal activity.
Why does it matter?
The guidance says bulletproof hosting infrastructure enables cybercrime by providing resilient platforms for malicious activity. Criminals use these services because they are designed to withstand takedown attempts and law enforcement action. Reasoning cautiously, this means a block on one address may not end the activity if the operator can move to other infrastructure.
How can you reduce the risk?
The guidance says internet service providers and network defenders should do the following.
- Curate high confidence lists of malicious internet resources.
- Conduct traffic analysis to supplement identifying resources, and review the lists regularly.
- Share threat intelligence findings.
- Configure centralized event logging so that the malicious lists can be used.
- Implement filters.
- Use upstream providers that follow Secure by Design principles.
For internet service providers specifically, it advises notifying customers about malicious resource lists and filters, creating filters customers can apply, establishing accountability standards, implementing know-your-customer capabilities and applying internet routing security best practices.
Is bulletproof hosting the same as normal web hosting?
No. Normal hosting is rented for lawful purposes. Bulletproof hosting is marketed and leased on purpose to cybercriminals. Not every host whose servers are misused is a bulletproof provider, since the guidance notes that some legitimate providers may be unaware of the abuse.
Is bulletproof hosting the same as a VPN?
No. A VPN is a service that routes a user’s traffic through another server. Bulletproof hosting supplies the servers and network space where malicious content or services run. The two are different services.
Also Called.
- NameBPH
- Namebulletproof hosting provider
- Namebulletproof host
Questions.
-
What is bulletproof hosting?
Bulletproof hosting is internet infrastructure that a provider knowingly and intentionally markets and leases to cybercriminals. Providers say the service is bulletproof to attract criminal clients, because it is built to withstand takedown attempts and law enforcement action.
-
Why do criminals use bulletproof hosting?
Criminals use it because it is designed to withstand takedown attempts and law enforcement action. It gives them a resilient platform for malicious activity, so blocking one address may not end the activity if the operator can move to other infrastructure.
-
How can network defenders reduce the risk from bulletproof hosting?
Joint guidance advises curating high confidence lists of malicious internet resources, analyzing traffic, sharing threat intelligence, configuring centralized event logging and implementing filters. Internet service providers should also notify customers, apply know-your-customer checks and use routing security best practices.