What is the difference between offshore and bulletproof hosting?

What is bulletproof hosting?

Bulletproof hosting is hosting that knowingly tolerates abuse: spam, malware, botnets and phishing stay online despite complaints. CISA published a guide on it on 19 November 2025, with the NSA, the FBI, the DoD Cyber Crime Center and foreign partners. It defines a bulletproof hosting provider as one that knowingly leases infrastructure to cybercriminals.

The US Treasury describes the product the same way. Such providers sell access to specialized servers designed to help criminals evade detection.

Bulletproof hosting is defined by the customers it accepts and the complaints it ignores, not by the country it is in.

What is offshore hosting?

Offshore hosting is ordinary hosting bought from a company or datacenter in another country. Buyers choose it for that country's rules on privacy, data requests and copyright notices, or for a signup without ID.

An offshore host publishes its rules, answers to its own courts and removes real abuse. Offshore hosting chooses which country's law applies; bulletproof hosting tries to escape all of them. The full definition is on what is an offshore dedicated server.

Which bulletproof hosts have governments sanctioned?

The US Treasury's OFAC sanctioned three Russia-based bulletproof hosts in 2025, two of them jointly with Australia and the United Kingdom:

• Zservers, Barnaul, 11 February 2025. It leased IP addresses to LockBit ransomware affiliates. Sanctioned by the US, Australia and the UK.
• Aeza Group, St. Petersburg, 1 July 2025. It hosted Meduza and Lumma infostealer operators, BianLian ransomware and the BlackSprut drug market. Designated with the help of the UK's National Crime Agency.
• Media Land, St. Petersburg, 19 November 2025. It served criminal marketplaces and the LockBit, BlackSuit and Play ransomware groups. Sanctioned by the US, Australia and the UK.

For US persons, these designations mean blocking the companies' property and not dealing with them, in crypto as in dollars (OFAC FAQ 560).

Is Ironatoll bulletproof hosting?

No. Ironatoll is an offshore host with a written list of what it bans and suspends. Its rule, word for word: Foreign copyright notices, DMCA ones included, are set aside: we act only under Panamanian law or on a Panamanian court order. Spam, phishing, malware, botnet control, attacks and child sexual abuse material are banned, and any one of them gets the server suspended.

• Banned: Spam and bulk email, phishing, malware and botnet control, DDoS and other attacks, scanning or brute-forcing systems that belong to others, booter and stresser services, carding and fraud, child sexual abuse material, cryptocurrency mining and any service to sanctioned people or companies are all forbidden.
• Mail: Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally.
• Payments: Wherever the blockchain shows the sending address, which it does for every coin we take except Monero, we match the payment against public sanctions lists of blockchain addresses, and a payment sent from a listed address is never added to a balance.
• Countries: We turn away people and companies located in Cuba, Iran, North Korea, Syria, Russia, Belarus, China, Yemen or Western Sahara, or in the occupied regions of Ukraine.

The complete rules are on what is not allowed on an Ironatoll server.

Is ignoring DMCA notices the same as bulletproof hosting?

No. A DMCA notice is one kind of complaint: a US copyright takedown, which the US Copyright Office calls voluntary for every provider. Bulletproof hosting ignores every kind of complaint, including malware, phishing and police requests.

According to Ironatoll's check of 30 October 2026, 4 of 34 active dedicated-server hosts advertise that they ignore DMCA notices. That label says nothing about how a host treats malware or phishing. Read its acceptable use policy to find out.

Ironatoll's copyright policy is explained on what does DMCA ignored mean for a dedicated server.

Why does the difference matter for my server?

It decides whether your server stays reachable. The CISA guide asks network operators to build lists of malicious resources and to filter them. When a range is filtered or a host is seized, every customer on it goes dark, guilty or not.

A host that removes abuse keeps its IP ranges usable for everyone. That is why Ironatoll closes outgoing port 25 and suspends phishing and malware. Mail users should read can I host a mail server on an offshore dedicated server.

How can I tell an offshore host from a bulletproof one?

Read the rules before you pay. Five checks:

1. The ban list. An offshore host names what it removes. A bulletproof host bans nothing that matters.
2. The promise. "We ignore DMCA" is a copyright policy. "We ignore all complaints" is a warning sign.
3. The sanctions lists. Search the OFAC, UK and EU lists for the company and its owners.
4. The marketing. A host that courts spammers, booter operators or carders is selling to crime.
5. The court. An offshore host names the courts it follows. For Ironatoll, Panama.

An offshore host shows written bans, an abuse process and a named jurisdiction. Ironatoll is run by DomaineGoat LLC, a company registered in Panama, and answers only to Panamanian law. Each server’s datacenter, for its part, is bound by the law of the country it stands in.

What does an offshore dedicated server cost at Ironatoll?

An offshore dedicated server at Ironatoll costs from $63.68 per 30 days for Intel Xeon E-2236 (6 cores / 12 threads), 16 GB RAM, 2 × 480 GB SSD in RAID 1, 30 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64. Every plan follows the same abuse rules. All prices are on how much does an Ironatoll dedicated server cost.