Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers

This joint guidance outlines how cybercriminals increasingly rely on bulletproof hosting providers—services that ignore abuse complaints and legal requests—to power ransomware, phishing, malware delivery, and other malicious activity. It explains how these providers blend into legitimate internet infrastructure, making them difficult to detect and disrupt. The document encourages ISPs and network defenders to build “high-confidence” threat lists, apply smarter filtering, and share intelligence to help shrink the operational space these actors depend on. By adopting coordinated mitigation steps, organizations can reduce cybercriminals’ ability to hide behind these resilient hosting networks.