Skip to content
Skip to main content
Cyber Incidents & Offender Methods Technical Explainer

What is bulletproof hosting?

Bulletproof hosting is service provision designed or marketed to tolerate abusive or illegal activity and resist intervention. A provider's reputation does not prove every customer is an offender or every employee knew of a particular offence.

Identify the service and customer layers

Preserve provider, reseller, customer account, server or resource ID, active period, payment and management logins. Hosting brand, data centre and reseller may each hold different records.

Historical placement matters because resources can move rapidly. Current hosting does not prove which provider carried activity during the incident.

Assess provider knowledge separately

Record abuse complaints, their content and timing, and the provider's response. Repeated notice followed by continued service supports a different inference from prompt suspension, but still does not identify the customer or prove participation in this incident.

Ordinary hosting can be abused unknowingly. Report service resilience, customer control, provider awareness and offender identity as separate propositions.

Key takeaway

Use bulletproof-hosting evidence to explain resilient service provision, while proving customer control, provider knowledge and personal offending independently.

Reference: CIM-246Cyber Incidents & Offender Methods