Bulletproof hosting is internet infrastructure that is knowingly and intentionally marketed and leased to cybercriminals. The New Zealand NCSC, in joint guidance, describes the providers as built to withstand takedown attempts and law enforcement action. Criminals use it as a stable base for malicious activity.
- Also Called3other namesBPH · bulletproof hosting provider · bulletproof host
- Related Terms3linked entriesCommand and control (C2) · Threat intelligence · Phishing
What Is Bulletproof Hosting?
The New Zealand NCSC publishes joint guidance on this topic. It says a bulletproof hosting provider is an internet infrastructure provider that knowingly and intentionally markets and leases its infrastructure to cybercriminals. Hosting here means renting servers or network space so that content or services can be reached online. The guidance says these providers market their services as bulletproof to attract cybercriminal clients.
How Do These Providers Supply Infrastructure?
The guidance describes two main methods. A provider can lease its own infrastructure directly to criminals. It can also resell stolen or leased infrastructure from legitimate providers, such as hosting companies, data centers, internet service providers and cloud services. Those legitimate providers may be unaware that they are enabling criminal activity.
Which Bulletproof Hosts Have Governments Sanctioned?
Three Russia-based providers were named by the US Treasury in 2025, two of them jointly with Australia and the UK. The NZ NCSC guidance followed.
- 11 Feb 2025Zservers sanctionedThe US, Australia and the UK named it for supporting LockBit attacks.
- 1 Jul 2025Aeza Group sanctionedThe US named it for hosting ransomware and infostealer operators.
- 19 Nov 2025Media Land sanctionedThe US, Australia and the UK named it. Treasury says LockBit, BlackSuit and Play used it.
- 21 Nov 2025NZ NCSC guidance publishedIt sets out how network defenders and providers can reduce the risk.
Treasury says these providers sell servers designed to evade detection and resist law enforcement attempts to disrupt malicious activity.
Why Is One Blocked Address Not Enough?
The guidance says bulletproof hosting infrastructure enables cybercrime by providing resilient platforms for malicious activity. Criminals use these services because they are designed to withstand takedown attempts and law enforcement action. A block on one address may not end the activity if the operator can move to other infrastructure.
On 27 October 2026 the US Attorney’s Office for the Eastern District of Virginia announced the seizure of virtualine.net, the website of Virtualine, which its release calls a “bulletproof” service offering hosting and server solutions. Read our news post on the Virtualine bulletproof hosting seizure.
What Should Network Defenders Do?
The guidance says internet service providers and network defenders should do the following.
- Curate high confidence lists of malicious internet resources.
- Conduct traffic analysis to supplement identifying resources, and review the lists regularly.
- Share threat intelligence findings.
- Configure centralized event logging so that the malicious lists can be used.
- Implement filters.
- Use upstream providers that follow Secure by Design principles.
For internet service providers, it advises these steps:
- Notify customers about malicious resource lists and filters.
- Create filters customers can apply.
- Set accountability standards.
- Use know-your-customer checks.
- Apply internet routing security best practices.
Is Bulletproof Hosting the Same as Normal Web Hosting?
No. Normal hosting is rented for lawful purposes. Bulletproof hosting is marketed and leased on purpose to cybercriminals. Not every host whose servers are misused is a bulletproof provider, since the guidance notes that some legitimate providers may be unaware of the abuse.
Is Bulletproof Hosting the Same as a VPN?
No. A VPN is a service that routes a user’s traffic through another server. Bulletproof hosting supplies the servers and network space where malicious content or services run. The two are different services.
Related Pages in the Knowledge Hub
Also Called.
- NameBPH
- Namebulletproof hosting provider
- Namebulletproof host
Questions.
-
What is bulletproof hosting?
Bulletproof hosting is internet infrastructure that a provider knowingly and intentionally markets and leases to cybercriminals. Providers say the service is bulletproof to attract criminal clients, because it is built to withstand takedown attempts and law enforcement action.
-
Why do criminals use bulletproof hosting?
Criminals use it because it is designed to withstand takedown attempts and law enforcement action. It gives them a resilient platform for malicious activity, so blocking one address may not end the activity if the operator can move to other infrastructure.
-
How can network defenders reduce the risk from bulletproof hosting?
Joint guidance advises curating high confidence lists of malicious internet resources, analyzing traffic, sharing threat intelligence, configuring centralized event logging and implementing filters. Internet service providers should also notify customers, apply know-your-customer checks and use routing security best practices.
Sources
- 1 Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers, CISA
- 2 Bulletproof Defense: Mitigating Risks from Bulletproof Hosting Providers, New Zealand NCSC
- 3 Treasury sanctions Zservers (11 Feb 2025), US Department of the Treasury
- 4 Treasury sanctions Aeza Group (1 Jul 2025), US Department of the Treasury
- 5 Treasury sanctions Media Land (19 Nov 2025), US Department of the Treasury
- 6 Bulletproof website domain seized in international law enforcement operation (27 October 2026), US Department of Justice