What is bulletproof hosting?¶
The practical answer¶
Bulletproof hosting is hosting marketed or operated to tolerate abusive, illegal or high-risk activity with limited intervention.
The key evidential caution¶
The dangerous assumption is that every customer of a bulletproof provider is an offender or that every provider employee knowingly supports the specific offence.
It may not be that simple.
Such services may advertise:
Key points¶
- minimal identity checks
- resistance to takedown
- ignored complaints
- offshore locations
- rapid server replacement
- anonymous payment
- support for high-risk content
What investigators should establish¶
Investigators should establish:
Key points¶
- which provider supplied the service
- which customer account used it
- what server or resource was involved
- when it was active
- how it was paid for
- which login sources managed it
- what abuse reports existed
- how the provider responded
The provider’s reputation may support context.
It does not prove the customer’s identity or the provider’s knowledge of the specific activity.
Evidential limits¶
Likewise, ordinary hosting providers can be abused without knowing it.
Preserve customer, payment, account-access and server records where lawful and proportionate.
Do not rely only on current hosting. Infrastructure may move quickly between providers.
Where abuse complaints exist, preserve their timing, content and the provider’s response. Repeated notice followed by continued service may support a different inference from a provider that suspended the resource promptly. Even then, provider-level conclusions should remain separate from customer attribution and the specific incident facts.
Where the provider operates through resellers, identify which layer held the customer relationship and which retained access records. A hosting brand, data centre and reseller may each hold different parts of the evidence.
Operational takeaway¶
Use bulletproof-hosting evidence to understand resilience and service provision, but prove customer control, provider knowledge and offender identity separately.