Offshore hosting vs bulletproof hosting: what is the difference?

What is bulletproof hosting?

Bulletproof hosting is hosting sold to criminals with a promise that abuse reports and police requests will not take it down. A guide published on 19 November 2025 by CISA, the NSA, the FBI and partner agencies defines a bulletproof hosting provider as one that knowingly and intentionally markets and leases its infrastructure to cybercriminals.

Bulletproof hosting is defined by who it serves and by its refusal to engage with legal process, not by its country. The guide says such providers do not engage in good faith with subpoenas, court orders or victim complaints. Their customers use the servers for ransomware, phishing, malware delivery and command-and-control.

The US Treasury uses the same idea: servers designed to help criminals evade detection and resist law enforcement.

What is offshore hosting?

Offshore hosting is ordinary hosting bought from a company or datacenter outside your own country. People choose it for the host's laws on privacy, data requests and copyright notices, or for a signup with no ID.

Offshore hosting changes which law applies; bulletproof hosting refuses to answer to any law. An offshore host follows the law of its own country and acts on real abuse. More on what is an offshore VPS.

Is OffshoreKVM bulletproof hosting?

No. OffshoreKVM is an offshore host with published rules: copyright notices from abroad are ignored, abuse that harms people is not.

• Ignored: DMCA ignored: we do not act on DMCA notices or other foreign copyright notices. We answer only to Panamanian law and to orders of Panamanian courts.
• Banned: No spam or bulk email, no phishing, no malware or botnet control, no DDoS or other attacks, no scanning or brute-forcing of other people’s systems, no booter or stresser services, no carding or fraud, no child sexual abuse material, no cryptocurrency mining, and no service to sanctioned people or companies.
• Acted on: reports of spam, phishing, malware, botnet control, attacks and child sexual abuse material lead to suspension. Send them to [email protected].
• Mail: Outgoing port 25 (SMTP) is closed on every VPS to stop spam, and it stays closed. Ports 465 and 587 to mail providers stay open.
• Payments: On every coin we take except Monero, the address a payment comes from is looked up on public sanctions lists of blockchain addresses, and a payment from a listed address is not credited. A Monero payment hides that address, so the lookup has nothing to compare.
• Countries: Not available to people or companies in Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, or in the occupied regions of Ukraine.

The full rules are in the OffshoreKVM acceptable use policy.

Is DMCA ignored the same as bulletproof?

No. DMCA ignored covers one kind of notice: US copyright takedowns, which the US Copyright Office calls voluntary even for US hosts. Bulletproof hosting ignores every complaint, including phishing, malware and police requests.

According to OffshoreKVM's check of 29 October 2026, 7 of 36 active offshore VPS hosts advertise that they ignore DMCA notices. At least four others say in writing that they are not bulletproof hosts: MyNymBox, SporeStack, TLDBunker and WebCare360.

The policy is explained on what does DMCA ignored mean for an offshore VPS, and hosts are compared on what is the best DMCA ignored hosting.

Is bulletproof hosting illegal?

Running it leads to convictions and sanctions. Three cases:

• CyberBunker, Germany: on 13 December 2021, a court in Trier convicted eight people of forming a criminal organisation to run a data centre in a former military bunker. Investigators called it a bulletproof hoster.
• Aeza Group, Russia: designated by the US Treasury on 1 July 2025 as a bulletproof hosting provider serving infostealer and ransomware operators.
• Media Land, Russia: sanctioned on 19 November 2025 by the United States, Australia and the United Kingdom, with more people linked to Aeza.

For US persons, OFAC rules generally prohibit dealings with designated companies such as Aeza Group. Whether offshore hosting is legal for you is covered on is offshore hosting legal.

Why does the difference matter to customers?

It decides whether your server stays online. Customers of a bulletproof host share IP ranges with criminals, and the CISA guide asks network operators to list malicious resources and filter them. A seizure also takes every customer down at once.

Banning real abuse protects the reputation of IP ranges every customer shares. That is why OffshoreKVM closes outgoing port 25 and suspends spam, phishing and malware. Mail users read can I host an email server on an offshore VPS.

How do I tell a bulletproof host from an offshore host?

Read its rules before you pay. Warning signs:

1. No published acceptable use policy, or one that bans nothing.
2. A promise to ignore every complaint, not only copyright notices.
3. Paperwork demands before any takedown, a pattern the CISA guide describes.
4. A listing on a sanctions list (OFAC, EU or UK). OffshoreKVM's check of 29 October 2026 found Aeza Group on the OFAC and UK lists.
5. Marketing aimed at a use, such as spam, booters or carding, rather than at privacy or jurisdiction.

An offshore host shows the opposite: written bans, an abuse address, and a named jurisdiction whose courts it follows.