Is "bulletproof hosting" a real thing?

The phrase gets used for two businesses that have almost nothing in common, and conflating them is how people end up with their data inside a police evidence bag.

The first meaning: a jurisdiction strategy

An operator running its own hardware in a country whose law does not implement notice-and-takedown, declining to act on foreign complaints, and removing genuinely criminal material quickly. Everything about that is lawful in the place it happens. It is a boring compliance posture that happens to be different from the American default, and it is stable precisely because there is nothing for anyone to raid.

The second meaning: a countdown

An operator that advertises tolerance for anything at all — malware command-and-control, phishing, carding panels, ransomware infrastructure — usually on rented racks, often reselling capacity it does not control. These outfits are not protected by jurisdiction. They are protected by not having been noticed yet, and that protection expires.

• Transit providers depool them once the abuse reports accumulate, and the whole range goes dark without warning.
• Their address space ends up on every blocklist worth having, so legitimate services sharing it stop working.
• They attract coordinated law-enforcement operations, and seizures take entire racks, including machines belonging to people who were doing nothing wrong.
• They tend to disappear with balances still on the books, because the business model never assumed a graceful exit.

How to tell them apart before you pay

• Read the acceptable use policy. A real one lists categories and says what happens. A shrug is not a policy.
• Ask whether they own the hardware. Resellers cannot honour promises their upstream will not honour.
• Look at what they advertise tolerance for. A host that publicly welcomes malware is telling you what kind of neighbours you will have.
• Check whether they distinguish jurisdictions. An operator claiming every region behaves identically has either not thought about it or is not being straight with you.

Where we sit

We are the first kind, deliberately and without apology. We decline copyright policing because there is no legal obligation to perform it where our safe-harbour metal lives. We remove criminal material immediately because that is what keeps the network, the addresses and the other customers viable. Those two positions are not in tension; holding both is the only way this stays a business rather than a countdown.

Published by NoDMCAVPS, an offshore host that files automated DMCA notices instead of forwarding them. What we still remove is listed in the acceptable use policy.