Bulletproof hosting

Bulletproof hosting is a hosting service that deliberately tolerates abusive content, such as phishing sites, malware infrastructure and spam, and ignores or delays abuse reports. Operators usually market it on criminal forums, charge more than ordinary hosting and promise customers that their servers will not be shut down in response to complaints.

How it works

Bulletproof providers rely on a mix of tactics to stay online:

• registering companies and network resources in jurisdictions where enforcement is slow or weak;
• reselling capacity from ordinary data centres while hiding the real customer behind layers of resellers;
• moving customers quickly between IP ranges, servers or providers when one is blocked;
• answering complaints with stock replies, or not answering at all.

Some operations also combine hosting with fast-changing DNS so that a phishing domain points to a new server every few minutes, which makes it harder to pin down.

Example

As an illustration, a phishing page on examplepay-secure[.]com is hosted on an IP address belonging to a small provider. Several abuse reports to the provider go unanswered for weeks, and the same network already hosts dozens of other phishing domains. Reports to the domain's registrar and to blocklists, however, succeed: the domain is suspended and browsers start showing warnings, even though the server itself stays online.

How to spot it

• Abuse reports that receive no reply or only automatic replies, repeatedly.
• Many unrelated phishing or malware domains on the same IP range.
• Network blocks that appear on reputation lists such as those published by Spamhaus.
• Provider websites that advertise "DMCA ignored" or "offshore, no questions asked".
• Sites that move to new IP addresses soon after a report.

What brands can do

Do not rely on the host alone. Report the domain to its registrar and the registry where appropriate, report to the upstream network or data centre that provides connectivity, and submit the URL to Google Safe Browsing, Microsoft SmartScreen and other blocklists so users are warned. Keep a record of the infrastructure, since the same operators often come back. Phishvoid's team works through these alternative channels during a phishing takedown; contact us if a host is ignoring your reports.

Read more: The Phishing Site Takedown Process, Step by Step