# Bulletproof Hosting The foundational service layer of organized cybercrime: internet hosting deliberately designed to be **resistant to complaints, subpoenas, and takedown orders**. A bulletproof-hosting (BPH) provider knowingly rents server space, domains, and IP ranges to criminal clients and — unlike a legitimate host — does *not* pull the plug when sent abuse reports or court orders. It is the dependable real estate on which the rest of the criminal economy is built: command-and-control servers for botnets, [[Ransomware-as-a-Service]] infrastructure, phishing and malware-distribution sites, spam operations, carding and fraud shops, dark-web markets, and disinformation campaigns. ## How it stays "bulletproof" BPH resilience comes from jurisdiction-shopping and evasion rather than any actual immunity: - **Permissive jurisdictions.** Providers base operations (or route through) countries with weak cybercrime enforcement or little interest in cooperating with Western law enforcement — historically Russia, parts of Eastern Europe, and various offshore havens. - **Acceptable-use policies that permit the illicit.** Where a normal host forbids malware and abuse, a BPH provider's terms quietly allow it. - **Infrastructure agility.** When pressure mounts, operators rapidly migrate clients across shell companies, upstream providers, and "fast-flux" rotating IP addresses, so takedowns hit empty infrastructure. - **A layer of deniability.** Many maintain a legitimate-looking front as an ordinary ISP or reseller. ## Canonical cases - **[[Russian Business Network]] (RBN)** — the case that put BPH on the map. Exposed by researchers in 2006–2007, this St. Petersburg-linked operation maintained an ordinary-ISP front while being tied to a vast share of the era's cybercrime — phishing, identity theft, child-exploitation material, and botnets. - **[[CyberBunker]]** — a provider that literally operated from a decommissioned NATO bunker in the Netherlands (later Germany), hosting nearly anything until German police dismantled it in 2019. Takedowns are difficult and often temporary: raids and sanctions disrupt specific hosts, but the demand is constant, so new providers continually emerge to replace those that fall. ## Right-wing-KB relevance Bulletproof hosting is the **physical substrate** beneath threats this vault tracks across cybercrime, disinformation, and state-tolerated operations. It is where ransomware crews, disinformation networks, and extremist content find takedown-resistant homes — and the recurring concentration of BPH in Russia ties directly to the permissive-harbor dynamic discussed under [[Russian State Hacking Groups]] and [[Ransomware-as-a-Service]]: a state that declines to police criminal infrastructure on its soil gains deniable disruptive capacity against its rivals. Following the hosting layer is often how investigators map and ultimately disrupt a campaign. ## Distinct from neighbors - **Legitimate web hosting** — responds to abuse reports and legal orders; BPH is defined by *refusing* to. - **[[Ransomware-as-a-Service]]** — the criminal *service* sold to attackers; BPH is the *infrastructure* that service runs on. - **Dark web / Tor hidden services** — an anonymity *network layer*; BPH is takedown-resistant *hosting* (the two are often combined). - **Fast flux** — a specific evasion *technique* (rapidly rotating IPs) that BPH providers use, not the service itself. ## See Also - [[Cybersecurity Lexicon]] - [[Ransomware-as-a-Service]] - [[Russian State Hacking Groups]]