Bulletproof Hosting: How It Works and How Defenders Block It

Bulletproof hosting (BPH) is internet infrastructure, such as servers, IP address space and network connectivity, that a provider knowingly markets and leases to cybercriminals while ignoring abuse complaints and legal process. It is the stable base underneath much ransomware, infostealer, phishing and command and control activity, because it lets criminals keep servers running after victims and researchers report them. In November 2025 CISA, NSA, the FBI, DC3 and the national cyber security agencies of Australia, Canada, the Netherlands, New Zealand and the United Kingdom published joint guidance urging network defenders and internet service providers to filter it. This page explains what bulletproof hosting is, how it works, why it matters to defenders, common misconceptions and how to identify and block it safely. It is written for SOC analysts, network and DNS engineers and threat intelligence teams, and it is strictly defensive. The broader criminal economy is covered in the Cybercrime Ecosystem Guide.

Key takeaways

• The defining feature is intent, not technology. The joint guidance describes BPH providers as infrastructure providers that "knowingly and intentionally market and lease their infrastructure to cybercriminals" and do not engage in good faith with legal processes or victim complaints.
• It is woven into legitimate internet infrastructure. BPH operators lease IP space and resell capacity, so blunt blocking can hit legitimate users; the agencies advise weighing risks first and monitoring the effect.
• Filtering by ASN, subnet and IP is the core defensive measure. The guidance recommends dynamically filtering autonomous system numbers, subnets or individual addresses, built from a reviewed list of high-confidence malicious resources.
• Sanctions turn it into a compliance issue. OFAC designated Aeza Group in July 2025 and Media Land in November 2025 (with Australia and the UK), so payments to or services from these providers can create legal exposure for US persons.
• Providers rebrand to survive. OFAC reported that after its designation Aeza moved infrastructure through front companies and a rebrand, so static blocklists go stale; refresh them automatically.

What it is

A normal hosting company has an acceptable use policy, an abuse desk and a process for responding to law enforcement. When a phishing page or malware server is reported, it is suspended. A bulletproof host advertises the opposite: customers can run malicious services without fear of takedown, usually paying a premium and often paying in cryptocurrency. OFAC describes BPH providers as selling access to specialised servers and infrastructure "specifically designed to evade detection and defy law enforcement efforts".

Not every abused host is bulletproof. Criminals also rent cheap virtual private servers from mainstream providers, compromise legitimate servers and abuse cloud and content delivery services. The difference matters for response: a mainstream provider will usually act on an abuse report, a bulletproof one will not, so for BPH the effective response is filtering on your own network rather than reporting.

How it works

The operating model has several layers, which together make a BPH provider resilient to takedown.

• Leasing address space and connectivity: OFAC reported that Aeza's UK branch leased IP addresses to cybercriminals, including operators of the Meduza infostealer. Leasing lets a provider move customers between address blocks and upstream networks, and blends criminal space with legitimate allocations.
• Front companies and rebranding: after its July 2025 designation, OFAC says Aeza's leadership launched a rebrand to cut visible links to new infrastructure, used a UK front company to move IP infrastructure and used companies in Serbia and Uzbekistan to build infrastructure not publicly tied to the brand. Expect any well-known BPH name to reappear under a new one.
• Jurisdictional arbitrage: operators choose locations and legal structures where cooperation with foreign law enforcement is slow or absent, while connecting through upstream providers elsewhere.
• Resilient naming: customers often combine BPH with DNS techniques such as fast flux, which ATT&CK describes as T1568.001 Fast Flux DNS, rapidly rotating the IP addresses behind a domain to hide the real servers.
• Services on top: criminal customers host command and control panels, malware download servers, phishing kits, stolen data storefronts and denial of service infrastructure. WaterISAC's summary of the joint guidance lists command and control, malware delivery, phishing and illicit content hosting as typical uses.

Where it appears in the attack lifecycle

Why it matters

• It sustains the threats you already fight. OFAC linked Aeza to Meduza, Lumma and RedLine infostealer operations and to BianLian ransomware, and linked Media Land to LockBit, BlackSuit and Play ransomware and to denial of service attacks on US victims. Infostealer logs feed credential and session token theft; see the Infostealer Threat Guide.
• Reporting does not work against it. Takedown requests that remove a phishing site from a mainstream host within hours achieve nothing at a BPH provider. Your own controls must carry the load. See the Brand Impersonation and Lookalike Domain Takedown Playbook for the cases where reporting does work.
• Legitimate users rarely need it. Ranges that exist only to serve criminals produce little or no legitimate business traffic, which is why curated lists such as Spamhaus ASN-DROP list autonomous systems that send no legitimate traffic. Blocking them is high value and low cost.
• Sanctions exposure. OFAC states that US persons generally may not deal in property of designated persons, that civil penalties are imposed on a strict liability basis, and that entities owned 50 percent or more by blocked persons are also blocked. Procurement, hosting and payment teams should screen providers, not just security teams. See the Ransomware Payments and Sanctions Guide.
• Machine identities connect to it. Stolen API keys and tokens are frequently exercised from VPS and hosting ranges rather than residential addresses. Alerting when a workload or service account authenticates from a known BPH range is a cheap, high-signal detection; see the Threat Intelligence for Identity and NHI Guide.

Identifying and blocking it

The joint guidance's core recommendations, as summarised by the authoring agencies and WaterISAC, are to analyse network traffic for activity linked to BPH, build a list of high-confidence malicious internet resources, review that list regularly and automatically, filter by ASN, subnet or IP, and monitor the results so legitimate infrastructure is not unduly affected. The steps below turn that into a rollout.

1. Assemble sources. Combine curated datasets (for example Spamhaus DROP and ASN-DROP, which Spamhaus offers free with attribution and re-evaluates daily, in JSON files drop_v4.json, drop_v6.json and asndrop.json), government advisories and sanctions designations, your threat intelligence platform and your own incident data.
2. Grade confidence. Only ranges and ASNs with strong evidence of criminal-only use go in the block tier. Mixed-use providers go in a monitor tier that raises alert scores but does not block.
3. Start in monitor mode. Log matches at the firewall, web proxy and DNS resolver for two to four weeks. Review every match against business traffic to find false positives, such as a supplier hosted in leased space.
4. Block in layers. Apply the block tier at perimeter firewalls (inbound and outbound), web proxies, DNS resolvers through response policy zones or protective DNS, and email gateways. See the Protective DNS Guide.
5. Automate refresh. Pull updates on a schedule (Spamhaus asks for at least one hour between automated downloads and suggests once a day is usually enough) and expire entries that leave the source lists, so rebranded or reallocated space is handled.
6. Define an exception path. Give the service desk a fast route to request and approve an allow-list entry with an owner and expiry date. This is your rollback mechanism.
7. Feed detections back. Add confirmed BPH indicators from incidents to the list and share them through ISACs or national schemes.

Choosing the filtering point

Small organisations should rely on a managed protective DNS service and their firewall vendor's threat feeds rather than building lists. Large organisations and ISPs should maintain graded lists, apply them at several layers and measure collateral impact.

Metrics

• Blocked outbound connections to block-tier ranges per week, and how many were investigated.
• Endpoints or workloads with repeated attempts to reach BPH ranges (likely infections).
• False positive rate: allow-list requests per thousand blocks and median time to resolve.
• List freshness: age of the newest update and percentage of entries reviewed in the last 30 days.
• Sign-ins or API calls from BPH ranges blocked at the identity layer.

Common misconceptions

• "Bulletproof means offshore." BPH operators use front companies and connect through upstream providers in many countries; OFAC's designations include UK, Serbian and Uzbek entities linked to a Russian provider. Judge by behaviour and evidence, not country.
• "Blocking whole countries solves it." Geo-blocking is coarse, easily bypassed through leased space elsewhere, and can harm legitimate business. Use evidence-based ASN and range lists.
• "A one-off blocklist is enough." Rebranding and reallocation make static lists stale. Automated, reviewed refresh is part of the agencies' recommendation.
• "Everything on cheap VPS hosting is bulletproof." Most cheap providers act on abuse reports. Treat them as a monitor tier and report abuse, keeping block-tier listing for proven BPH.
• "Sanctions are only a finance problem." Using a designated provider for hosting, or paying one, can be a sanctions issue for the organisation. Security teams should share designations with procurement.
• "Takedowns ended the problem." Law enforcement disruptions remove individual providers, but OFAC's own account shows operators restructuring to continue. See the Cybercrime Law Enforcement Takedowns Guide.

Related concepts

• Command and control: BPH is a common home for C2 servers. See the Command and Control (C2) Guide and the Beaconing and C2 Detection Guide.
• Residential proxy networks: the opposite approach, hiding traffic among home connections rather than in criminal hosting. See the Residential Proxy Networks and Abuse Guide.
• Abuse of legitimate cloud services: criminals also hide in mainstream cloud and collaboration platforms. See the Cloud Services Abuse for C2 Guide.
• Routing security: hijacked or leased address space connects to RPKI and BGP filtering. See the BGP and Routing Security Guide.
• Defensive techniques: MITRE D3FEND names DNS Denylisting (D3-DNSDL), Outbound Traffic Filtering (D3-OTF) and Inbound Traffic Filtering (D3-ITF), the techniques applied above.

Framework mapping

Practitioner checklist

• Subscribe to at least one curated high-confidence list (such as Spamhaus DROP and ASN-DROP) and track government advisories and sanctions designations naming BPH providers.
• Grade sources into block and monitor tiers with documented evidence for each entry.
• Run new lists in monitor mode for two to four weeks before blocking.
• Apply the block tier at firewall, web proxy, DNS resolver and email gateway, inbound and outbound.
• Automate list refresh within the provider's download limits and expire stale entries.
• Maintain an allow-list exception process with owner, justification and expiry.
• Alert when user, workload or service account sign-ins originate from BPH ranges.
• Screen hosting and service suppliers against sanctions lists with procurement.
• Feed confirmed indicators from incidents back into lists and sharing communities.

Standards and references

• NSA: NSA Joins CISA and Others to Release Guidance on Mitigating Malicious Activity (Bulletproof Defense)
• Australian Cyber Security Centre: New Guidance for Mitigating Risks from Bulletproof Hosting Providers
• Canadian Centre for Cyber Security: Joint Guidance on Mitigating Risks from Bulletproof Hosting Providers
• US Treasury: Sanctions on Bulletproof Hosting Provider Aeza Group
• US Treasury: United States, Australia and United Kingdom Sanction Russian Cybercrime Infrastructure Supporting Ransomware
• Spamhaus: Do Not Route Or Peer (DROP) Lists
• MITRE ATT&CK: Acquire Infrastructure
• MITRE ATT&CK: Fast Flux DNS

Related NHI Mgmt Group resources: Cybercrime Ecosystem Guide · Protective DNS Guide · Command and Control (C2) Guide · Threat Intelligence for Identity and NHI Guide