Glossary
What Is Bulletproof Hosting?
Published Last updated
Bulletproof hosting is hosting that is deliberately resistant to abuse complaints, takedown notices and law-enforcement requests. Operators advertise tolerance for content that mainstream providers remove, such as phishing kits, malware C2, spam infrastructure and illegal content, usually by operating in jurisdictions with weak enforcement and aggressive customer protection.
How Whisper models it
Two hops tie an address to the network that routes it, and the ASN carries a reputation category with the signals behind it, including listings on network blocklists.
MATCH (ip:IPV4 {name:"185.220.101.1"})-[:ANNOUNCED_BY]->(p:ANNOUNCED_PREFIX)<-[:ROUTES]-(a:ASN) RETURN p.name, a.name, a.reputationCategory, a.reputationSignals LIMIT 5How Bulletproof Operations Work
A bulletproof provider may run its own ASN and IP space or, more commonly, resell space leased from upstream networks that don't ask questions. Customers pay a premium over regular hosting for the assurance that abuse reports won't lead to takedowns within hours.
Common Tactics Used by Operators
- Operating in jurisdictions known for slow legal cooperation.
- Routing through multiple shell companies to obscure ownership.
- Frequent re-allocation of IP ranges and re-routing of prefixes.
- Mixing legitimate customers with abusive ones to make blanket blocking expensive.
- Offering DDoS protection, untraceable payment and operational secrecy as features.
How Defenders Detect Bulletproof ASNs
Few networks describe themselves as bulletproof in their registration or routing data. Defenders infer it from behaviour:
- Disproportionate concentration of threat-feed listings.
- Long takedown times for confirmed-malicious hostnames.
- BGP routing instability: frequent prefix flapping or hops between upstreams.
- Customer overlap: the same registrant emails or hosting profiles recur across malicious domains.
- Abuse contact emails that bounce or never respond.
The Limits of ASN Reputation
ASN reputation is a useful prior, not a verdict. Even bulletproof networks host some legitimate customers; even reputable networks occasionally host malicious content. Reputation works best when combined with ground-truth signal on the specific hostnames or IPs in question.
Bulletproof Hosting in Whisper
In WhisperGraph each ASN node carries a reputation category, from reputable to highly suspicious, together with the signals behind it: the density of threat listings across the space it announces, the stability of its routing, and listings on network blocklists. From any address, ANNOUNCED_BY and ROUTES reach the announcing network in two hops, and LISTED_IN shows which feeds list the address itself. A suspect IP, its network and that network's record come back in one query, which is where the judgement described above starts.
Read the category together with its signals. A network that sits on a blocklist but announces no address space today is a different finding from one whose announced space is dense with listings right now.
Where this shows up
See it in a live investigation: Is this domain or IP actually dangerous?
Go hands-on with the campaign pivoting recipes.
