Hosting Radar

What does bulletproof hosting cost in 2026, and who should buy it?

Published 2026-09-30 · Researched and price-checked on official sources

Bulletproof hosting in 2026 costs roughly $20 a month for a medium-risk VPS and $300 or more for high-risk dedicated hardware, while one seller using the label advertises plans from $19.99 a month. The number buyers miss: peer-reviewed data from the MaxiDed bust put the abuse-allowing markup over identical clean servers at just 40 to 54 percent.

Key facts

What matters

Trend Micro's 2015 field study of the market split bulletproof hosting into three price tiers: low-risk servers from US$2 per month, medium-risk hosting around US$20 per month for a VPS or US$70 per month for hardware in Russia and Lebanon, and high-risk infrastructure at US$300 or more per month in China, Bolivia, Iran and Ukraine.
USENIX Security 2019 analysed the seized back end of the bulletproof host MaxiDed and found abuse-allowing servers cost a median US$146 per month against US$95 for identical clean dedicated servers, and US$35 against US$25 for VPS plans: a median markup of 40 to 54 percent.
The same dataset shows how thin the business is: 394 upstream providers were abused, only 20 percent of the 14,931 abuse-allowing packages were ever sold, and seven years of trading produced US$3.4M in revenue against less than US$280K in profit.
Takedown risk sits with the customer. MaxiDed demanded prepayment, so buyers leased short and treated servers as disposable because the upstream provider could cut the connection at any time.
For censorship resistance or copyright tolerance, a normal offshore VPS at roughly $3.50 to $15 per month is the cheaper buy, and a Tor onion service runs on ordinary hardware with no bulletproof host involved.

What is bulletproof hosting?

A bulletproof host is a hosting service that permits the activity legitimate providers prohibit: malware and command-and-control infrastructure, spam senders, phishing pages, fake shops, and files that ignore copyright takedown notices. Trend Micro's threat researchers label the category abuse-resistant hosting. The word describes the seller's tolerance policy, not the hardware, because the servers themselves are the same commodity KVM and dedicated kit anyone can rent.

Trend Micro's 2015 study Criminal Hideouts for Lease documented how the sellers present themselves. Dedicated bulletproof operators often publish nothing but an ICQ handle or phone number. A second group rents out compromised servers that they do not own at all, sometimes for a single attack. A third group is not a bulletproof host in any real sense: legitimate clouds such as AWS, Hetzner, OVH and LeaseWeb being abused by the tenants renting from them.

Bulletproof hosting prices: the three risk tiers

Price tracks how much abuse the seller will tolerate, not how much RAM you get. Trend Micro's study priced the market in three bands. Low-risk hosts that allow fake shops, adult content or DMCA-violating files rented from as little as US$2 per month. Medium-risk hosting, mostly sold out of Russia and Lebanon, ran about US$70 per month for hardware and about US$20 per month for a virtual private server. High-risk infrastructure, used for command-and-control and long-lived criminal projects, started at US$300 per month in China, Bolivia, Iran and Ukraine.

Those tiers have held up better than the individual names. AnubizHost, a seller that markets the term directly on its own product page, lists a bulletproof VPS from $19.99 per month for 2 vCPU, 4 GB RAM and 80 GB of NVMe storage, with DMCA-ignored terms, cryptocurrency checkout and no KYC at signup; the price was read from its own product page on September 30, 2026. That sits almost exactly where the medium-risk VPS tier sat a decade earlier.

Public price lists are the exception in this market, which is the first thing that should worry a buyer. Trend Micro described sellers who quote only through support chat: the provider RandServers handed package lists to prospects through its support team and never published a rate card.

What the bulletproof premium actually buys: 40 to 54 percent

The strongest evidence on pricing does not come from a marketing page. It comes from the seized back end of MaxiDed, a Netherlands-based bulletproof host taken down by Dutch and Thai law enforcement in May 2018, with two men arrested. Researchers from Delft University of Technology, the Dutch National High-Tech Crime Unit, King Saud University and New York University analysed over seven years of its records, covering January 2011 to May 2018, and published the results at the 28th USENIX Security Symposium in 2019.

The price gap between a server that allowed abuse and a technically identical one that did not was modest. For dedicated machines the median monthly lease was US$95 for clean packages and US$146 for abuse-allowing packages. For virtual servers it was US$25 against US$35. The paper puts the median markup at 40 to 54 percent, including the platform's own fee and the reseller's margin.

That gap is the whole product. A buyer is not purchasing a faster box or a better network: the same hardware was on sale to everyone. What the extra 40 to 54 percent buys is a policy that says abuse complaints will be ignored for as long as the server stays online. The research also found the demand side was softer than the reputation suggests. Of the 14,931 abuse-allowing packages on offer, only 3,066 were ever sold, and the platform's seven years of revenue came to US$3.4M with estimated profit under US$280K.

Four things a bulletproof host does not fix

Your upstream provider can still cut you off. The MaxiDed dataset traced 394 upstream hosting providers whose capacity was being resold for abuse. Trend Micro found the provider RandServers renting colocation from OVH, a mainstream European host, and another seller subleasing from Hetzner in Germany. Compliance pressure on that upstream layer ends the server, whatever the seller promised you.

Blocklists move the problem rather than solve it. Bulletproof operators watch feeds like Spamhaus and migrate infrastructure the moment their ranges get listed. That is a seller survival tactic, and it means your address changes or your service drops while the migration happens.

The risk sits on your side of the invoice. MaxiDed required prepayment, so customers leased for short terms and treated servers as disposable, absorbing the loss when one disappeared. Resilience features such as reinstalling an operating system or moving files to a new machine were sold as paid add-ons.

Support and stability are not guarantees. Trend Micro's review of RandServers recorded customer complaints about 24x7 support availability and VPS instability, which is a poor fit for anything that needs to stay online.

Who should buy bulletproof hosting, and what to buy instead

For most buyers the honest answer is nobody. If what you need is a cheap server that stays online for a blog, an app, a game server or a VPN relay, mainstream VPS pricing already beats this market: the abuse-allowing premium of 40 to 54 percent buys nothing you actually wanted. A budget VPS comparison such as RackNerd versus Hostinger VPS covers that decision, and our cheap VPS for self-hosting guide handles the do-it-yourself case.

If the problem is jurisdiction, meaning you want a host outside a particular country's copyright or speech rules, that is the offshore hosting market rather than the bulletproof one. Those providers publish real prices and acceptable-use policies: our offshore VPS price comparison, verified September 29, 2026 lists entry plans from $3.50 per month.

If the problem is anonymity of the service rather than tolerance of the host, bulletproof hosting is the wrong purchase entirely. David Alvarez Rosa's June 2026 write-up of running this site as a Tor hidden service describes the actual shape of that job: Tor forwards traffic to a web server on localhost, there is no DNS, no certificate authority and no exposed IP, and the .onion address is derived from a public key. That runs on ordinary hosting. Email is the same story: privacy email hosting is a separate product from abuse tolerance, and none of it requires a host that ignores subpoenas.

What the legal alternative costs

Set the two prices side by side and the premium looks worse. Providers in the privacy and offshore segment publish their rates, and the entry plans we checked on their own pricing pages on September 29, 2026 start well below the bulletproof tier. BuyVM's SLICE 1024 is $3.50 per month for 1 core, 1 GB RAM, 20 GB SSD and unmetered bandwidth in Luxembourg, New York or Las Vegas. 1984 Hosting's VPS #1 in Iceland is EUR 8.72 per month for 1 GB RAM and 1 TB of traffic. FlokiNET's Romania VPS I is EUR 7.99 per month with 3 TB of traffic and DDoS filtering included.

None of those hosts sells tolerance of malware or spam, and that is the point. For a blog, a store, a VPN relay, a scraped-data pipeline or a Tor hidden service, the case for paying 40 to 54 percent more than a clean server of the same size is hard to make, and the case for paying $19.99 a month for 2 vCPU disappears entirely. The full side-by-side, including crypto billing and prepayment terms, is in our offshore VPS comparison.

The legal record: seizures, arrests and prosecutions

The enforcement history is the part sellers omit. Trend Micro documented the case of Power Host, run by Mihai Ionut Paunescu, who supplied hosting for the Gozi malware operation: he leased roughly 130 servers from legitimate hosting companies and resold them for criminal use, reportedly earning EUR 190 per month on each resold server. Romanian police indicted him in 2013. The same study records the March 2013 attack on Spamhaus by the provider Off-sho.re and a group of other bulletproof operators.

The larger case is MaxiDed itself. Its servers were seized by Dutch and Thai law enforcement in May 2018 and two men were arrested, which is what made the economics public in the first place. A market whose leading platform earned under US$280K across seven years is fragile by design: research funding, blocklists and one seizure can end it, and the customers holding prepaid credit absorb the loss.

At a glance

Product tier	What the seller allows	Published price	Source
Low-risk bulletproof server	Fake shops, adult content, DMCA-violating files	From US$2 per month	Trend Micro, 2015
Medium-risk bulletproof VPS	Malware, spam, proxies; mostly Russia and Lebanon	About US$20 per month	Trend Micro, 2015
Medium-risk bulletproof hardware	Same as the VPS tier, physical server	About US$70 per month	Trend Micro, 2015
High-risk bulletproof server	Command-and-control and long-lived criminal projects	US$300 or more per month	Trend Micro, 2015
MaxiDed abuse-allowing VPS, median lease	Abuse tolerated while the server stays online	US$35 per month vs US$25 clean	USENIX Security, 2019
MaxiDed abuse-allowing dedicated server, median lease	Abuse tolerated while the server stays online	US$146 per month vs US$95 clean	USENIX Security, 2019
Self-described bulletproof VPS, 2026 seller page	DMCA-ignored hosting, crypto payment, no KYC	From US$19.99 per month for 2 vCPU, 4 GB RAM, 80 GB NVMe	AnubizHost page, checked 2026-09-30

Bulletproof hosting prices: verified tiers and the clean-server comparison

FAQ

Is bulletproof hosting legal?

Renting a server is legal in most countries, and abuse-resistant hosting is not itself a crime. What the research documents is prosecution and seizure at the operator level: Power Host's administrator was indicted in Romania in 2013 after reselling roughly 130 leased servers for criminal use, and the MaxiDed platform was seized in May 2018 with two arrests. Buying hosting in a lax jurisdiction does not change your liability where the harm occurs.

How much does bulletproof hosting cost per month?

Trend Micro's field study priced risk tiers from US$2 per month for low-risk hosting, about US$20 per month for a medium-risk VPS and US$300 or more per month for high-risk infrastructure. A 2026 seller advertising bulletproof VPS hosting lists plans from $19.99 per month, and USENIX Security's MaxiDed data showed abuse-allowing servers ran a median 40 to 54 percent above identical clean servers.

Does a Tor onion service need bulletproof hosting?

No. A hidden service needs uptime and a host that tolerates Tor traffic, not abuse tolerance. Tor forwards requests to your web server on localhost, the connection is encrypted end to end, and the .onion address derives from a public key, so there is no DNS record or exposed IP to hide. That configuration runs on a standard VPS.