Cybersecurity Policy Report, CISA, Partners Offer Advice to Puncture ‘Bulletproof’ Web Hosting, (Nov 19, 2025)
Sharing threat intelligence and developing lists of known malicious actors can help Internet service providers and network defenders identify and block providers of “bulletproof” web hosting, according to guidance published today by the Cybersecurity and Infrastructure Security Agency and its international partners.
“Cybercriminal actors are increasingly leveraging Bulletproof Hosting (BPH) infrastructure to conduct cyber operations targeting critical infrastructure, financial institutions, and other high-value targets,” CISA said in a news release.
“BPH providers market their infrastructure as ‘bulletproof’ to cybercriminals because they neither engage in good faith with legal processes nor with third-party or victim complaints of malicious activity enabled from such infrastructure,” it said.
The guidance notes that BPH infrastructure can be hard to differentiate from legitimate hosting services, which complicates efforts to block it.
“Mitigating cybercriminal activity enabled by BPH providers requires a nuanced approach because BPH infrastructure is integrated into legitimate internet infrastructure systems, and actions from ISPs or network defenders may impact legitimate activity,” it says.
“ISPs and network defenders should apply the recommendations [in the guidance] only after weighing the associated risks, ensuring that actions taken do not unduly impact legitimate infrastructure,” it adds.
The guidance recommends the development of “a list of ‘high confidence’ malicious internet resources” based on “commercial and open source threat intelligence feeds.” Sharing threat intelligence with other organizations “via public and private information sharing channels” is advised to prevent legitimate providers of Internet infrastructure from being blocked.
ISPs should “notify customers about malicious internet resource lists and associated filters” and “engage with other ISPs for sector-wide agreement on a code of conduct for BPH abuse prevention,” the guidance says.
“Bulletproof hosting is one of the core enablers of modern cybercrime,” said Madhu Gottumukkala, CISA’s acting director. “By shining a light on these illicit infrastructures and giving defenders concrete actions, we are making it harder for criminals to hide and easier for our partners to protect the systems Americans rely on every day.”
CISA was joined in issuing the guidance by the National Security Agency, Department of Defense, Federal Bureau of Investigation, and cyber defense agencies from Australia, Canada, New Zealand, the Netherlands, and the United Kingdom.
News: FederalLegislation InternationalLegislation DataSecurity