Bulletproof Hosting: When Fake Shops Refuse to Go Offline

You report a fake shop impersonating your brand. A week later it is still live, still taking orders, still ranking in search. You report it again. Nothing.

This is not a glitch in the system. It is the system working exactly as the operator intended. Fake shops hosted on bulletproof infrastructure are built to survive takedown attempts. The host ignores abuse reports because ignoring them is the service it sells. Knowing where else to apply pressure is what separates a brand that gets the site down from one that keeps filing tickets into a void.

What Is Bulletproof Hosting?

Bulletproof hosting (BPH) providers lease server infrastructure to operators who need to stay online regardless of what their sites are doing. They are not rogue operations in some technical sense. Many use perfectly ordinary cloud infrastructure. What makes them bulletproof is their policy: abuse complaints are ignored, delayed, or quietly dismissed.

According to Intel 471's analysis of the BPH ecosystem, bulletproof providers typically combine features that make takedowns difficult: permissive abuse-handling policies, jurisdictional insulation across multiple countries, reseller layers that obscure the true hosting relationship, frequent IP rotation to evade blocklists, and upstream network relationships that complicate enforcement.

For brand owners, the result is a site that looks legitimate, ranks in search, runs paid ads, and processes payments, all while the host silently bins every report you send.

How to Spot a Bulletproof-Hosted Fake Shop

Not every unresponsive host is running a bulletproof operation, but there are reliable signals:

• Abuse reports go unanswered for two weeks or more with no auto-acknowledgement
• The site reappears at a new domain or IP address shortly after any partial disruption
• WHOIS records show privacy protection services registered in high-risk jurisdictions
• The domain was registered recently (often within the past 30-90 days) with a pattern name like your brand plus "shop", "outlet" or "official"
• The hosting IP resolves to a known bulletproof autonomous system number (ASN)
• The site uses a CDN or reverse proxy (such as Cloudflare) as its visible front end, masking the true origin server

The Escalation Ladder: Where to Apply Pressure When the Host Goes Silent

When the host ignores you, the answer is not to send the same report again. The answer is to escalate up and across the infrastructure stack simultaneously. Each layer has a different relationship with the fake shop, and each has its own pressure points.

Step 1: The Domain Registrar

The registrar controls the domain name itself. Even if the host is unresponsive, the registrar operates under ICANN obligations and is required to act on credible abuse reports, particularly for phishing, fraud, and trademark infringement.

• Identify the registrar via a WHOIS lookup
• Submit a formal abuse report with documented evidence: screenshots, trademark certificates, and proof of consumer harm
• Reference ICANN's Uniform Rapid Suspension (URS) or Uniform Domain-Name Dispute-Resolution Policy (UDRP) procedures if the registrar is slow to act
• If the domain is using a privacy service, the registrar is still the correct point of escalation

Suspending the domain removes the branded name and forces the operator to rebuild their traffic, even if the IP remains reachable.

Step 2: The CDN and Reverse Proxy

Many fake shops sit behind a content delivery network or reverse proxy, with Cloudflare being the most commonly encountered. This is often where brand owners get confused: the Cloudflare IP in the WHOIS record does not mean Cloudflare is hosting the content.

As Cloudflare's own abuse approach documentation explains, Cloudflare is not the origin host in a CDN or pass-through role and cannot remove content it does not store. That said, reporting to Cloudflare is still worth doing: it forwards the complaint to the actual hosting provider, surfaces the origin IP address, and for phishing specifically, can place a warning interstitial on the domain. Use the report to find the true origin server, then escalate there directly.

Step 3: The Upstream Network Provider

Behind the host sits an upstream transit or network provider, typically a large carrier or autonomous system operator. These organisations care about their network reputation and respond to abuse reports more reliably than downstream bulletproof hosts.

Identify the upstream provider using the site's IP and an ASN lookup tool, then submit a network abuse complaint with full technical evidence: IP addresses, timestamps, and documentation of the infringing activity. Reference relevant law where applicable, such as the EU's Digital Services Act. Upstream providers can null-route or de-peer the bulletproof host's traffic entirely, which is far more disruptive than a single site takedown.

Cut Off the Oxygen: Search, Ads, and Payments

Infrastructure escalation removes a site from the web. But while that process works through, there are faster levers that cut off the revenue and traffic a fake shop depends on.

Search De-indexing

A fake shop that cannot be found in Google is functionally dead for most consumers. Search de-indexing is one of the most effective and fastest-acting tools available, and it works independently of the hosting situation.

Remove.tech operates as an official member of Google's Trusted Copyright Removal Program, which means removal requests are processed with significantly higher priority than standard submissions. The platform also scans and de-lists across other search engines as part of its continuous monitoring cycle.

De-indexing does not take the site offline, but it removes the majority of consumer traffic. If a site cannot be found through Google, most customers will not find it at all.

Cutting Off Advertising

Many fake shops run paid search or social media ads using your brand name as the keyword. This is both a direct revenue driver for the fraudster and a source of consumer confusion.

Submit a trademark infringement complaint to Google Ads, Meta, and any other platform where the fake shop is advertising, with your trademark registration details and evidence of the fraudulent ad. Remove.tech's fake advertising removal service covers this as a dedicated enforcement route across major platforms. Cutting the ad spend removes the fake shop's customer acquisition immediately, even before the site itself comes down.

Cutting Off Payment Processing

Without a way to take money, a fake shop cannot operate. Payment processors including Stripe, PayPal, and card networks all have fraud and brand abuse reporting mechanisms.

Document the fake checkout flow with screenshots, then report to the payment processor with evidence that the site is impersonating your brand or selling counterfeit goods. Payment processors carry financial and regulatory risk for enabling fraud, so these complaints tend to move faster than hosting abuse reports and can result in merchant account suspension.

Document Everything Before You Start

Every escalation route above requires evidence. Abuse reports without documentation are easy to dismiss. Before submitting anything, build a case file: full-page screenshots with timestamps, the domain name, IP address and WHOIS record at discovery, proof of trademark ownership, and a log of every previous report submitted with any responses received. This creates the paper trail needed if enforcement escalates to a UDRP filing or legal action.

If fake websites keep surviving your reports, Remove.tech's brand protection platform continuously monitors over 100,000 websites and platforms, identifies infringing sites as they appear, and escalates removal through the right channels. Coordinated, multi-channel enforcement is what works where single reports fail.

FAQ

What is bulletproof hosting?

Bulletproof hosting is a type of web hosting service that deliberately ignores or dismisses abuse reports. Providers operating this way lease infrastructure to operators running fake shops, phishing sites, counterfeit marketplaces, and other fraudulent operations. The defining characteristic is a policy of non-compliance with standard takedown requests.

Why does the host ignore my abuse report?

Ignoring abuse reports is the service bulletproof hosts sell. Their business model depends on keeping clients online regardless of complaints. They may also operate across multiple jurisdictions, use reseller layers to obscure responsibility, and rotate IP addresses to complicate enforcement.

Can Cloudflare take down a fake shop?

Cloudflare is most commonly used by fake shops as a reverse proxy or CDN, not as a hosting provider. In that role, Cloudflare cannot remove content it does not store. However, reporting to Cloudflare is still useful: it forwards your complaint to the actual hosting provider and can surface the origin server's IP address, which you can then escalate to directly. For phishing specifically, Cloudflare can place a warning interstitial on the domain. See Cloudflare's abuse approach for full details on how they handle different service types.

Is search de-indexing enough to stop a fake shop?

De-indexing removes the site from search results, which cuts off the majority of organic traffic. It does not take the site offline. For most fake shops, losing search visibility is highly damaging because it eliminates customer acquisition. Combined with payment processor and ad platform complaints, de-indexing can effectively neutralise a site while infrastructure escalation continues in parallel.

What if the fake shop keeps reappearing on new domains?

Repeat reappearance signals a coordinated operation, not a one-off infringement. The response is continuous monitoring rather than reactive reporting. Tracking infrastructure clusters, such as shared IP ranges, name servers, and registration patterns, across new domains allows you to identify the next site before it gains traction.

‍