DMCA-ignored, stated precisely.

The Digital Millennium Copyright Act is a United States federal statute passed in 1998. Its section 512 creates a safe harbour: a US service provider that removes allegedly infringing material promptly on receipt of a compliant notice is shielded from liability for its users' infringement.

That single sentence is where nearly every misconception about offshore hosting starts, so it is worth pulling apart into the two things it actually implies.

The DMCA is not a global law. Its notice-and-takedown procedure binds providers subject to US jurisdiction, and a provider in Bucharest has no s.512 safe harbour it must preserve by taking your site down. Be careful with the stronger version of that sentence, which we used to print here: s.512 defines a service provider by what it does and whether it meets the conditions, not by nationality, and US courts have taken personal jurisdiction over foreign online services that aim themselves at US users. Where your server sits changes who has to be persuaded and how hard that is. It does not make US copyright exposure disappear.

A DMCA notice is not a court order. It is a letter asserting infringement, sent under penalty of perjury as to the sender's authority but with no judicial review of the claim itself. Anyone can send one. They are sent in enormous volume by automated systems, and studies of large notice corpora have consistently found substantial error rates.

At NimbusVPS, in the 4 locations marked DMCA-ignored, a US copyright notice is:

• Received and logged, so we have a record.
• Forwarded to you for information, so you know a claim was made.
• Not acted upon. No suspension, no takedown, no content removal, no null-route.

The reason is straightforward: a US notice arriving in Reykjavík, Chișinău, Panama City or Victoria carries no legal force of its own, and no local instrument stands behind it. Acting on it would mean removing a customer's lawful content on the say-so of a letter from a foreign jurisdiction.

Now the part most pages in this market leave out, and the reason our list is shorter than theirs. Amsterdam, Bucharest and Sofia are inside the European Union, and since 17 February 2024 the Digital Services Act (Regulation (EU) 2022/2065) has applied to every hosting provider in it. Art. 16 obliges us to accept a complaint about your server and to deal with what it says. Once one carries the detail Art. 16(2) sets out, we are treated as knowing it, and Art. 6(1) withdraws the liability shield from us if we then do nothing. That is why the Netherlands, Romania and Bulgaria are marked reviewed in the table below and not ignored: the label describes what the law allows us to do, not which marketing tier a site belongs to, and a hosting provider established in the Union cannot honestly claim the second one. In those 3 sites a bulk DMCA email still does nothing, a properly substantiated complaint gets assessed and answered, and "we act only on a court order" is a promise the law no longer lets us keep. We would rather lose the sale than let you find that out from a lawyer.

Outside the Union the older framing holds, and that is precisely where our 4 DMCA-ignored sites are. Iceland is the strongest case for it: it is in the EEA but outside the EU, so the DSA does not reach it, and under Act No. 30/2002 a host's removal duty is tied to a court injunction. Moldova, Panama and Seychelles sit outside both the US and EU frameworks entirely, so a foreign notice there reaches us with no mechanism behind it at all.

What continues to apply everywhere, including in those locations:

• A court order from the host country's own judiciary is honoured. Always, without exception.
• Our acceptable use policy is enforced. CSAM, spam, phishing, malware and denial-of-service attacks get you removed immediately, with no refund and no argument, in every location.
• Criminal law of the hosting country applies. DMCA-ignored is about copyright notices, not about criminal conduct.

We list the United States in the same table and label it plainly, because a customer who buys "DMCA-ignored hosting" and lands in Kansas City has been sold the opposite of what they asked for.

The term bulletproof hosting describes providers that knowingly host criminal infrastructure — botnet command-and-control, phishing kits, carding shops, ransomware panels — and refuse all cooperation. That is a genuine and very different category, and it is not what we are.

Three practical reasons, in ascending order of how much they matter:

1. Transit providers de-peer networks that host that material. A provider whose upstreams disconnect it takes every legitimate customer down with it.
2. It attracts exactly the attention that hurts everyone hosted there. Law enforcement seizure of a rack does not distinguish between the criminal tenant and the journalist next to them.
3. We do not want to. A privacy position is worth defending. A malware position is not, and conflating them does real damage to the case for the former.

Our position is narrow and defensible: we do not act on unadjudicated foreign copyright claims, and we do act — immediately — on verified reports of criminal abuse. Those are not in tension.

In every location, including all 4 DMCA-ignored ones, verified reports in these categories result in immediate suspension without refund:

• Child sexual abuse material. No location, no exception, no notice period. Reported to the relevant authority.
• Spam and unsolicited bulk email, including snowshoe operations and list-washing.
• Phishing and credential harvesting, including sites impersonating banks, exchanges or providers.
• Malware hosting and command-and-control, including ransomware panels and stealer infrastructure.
• Denial-of-service attacks launched from our network, including booter and stresser services.
• Carding, fraud and stolen-data marketplaces.
• Anything criminal under the law of the hosting country.

Full text in the acceptable use policy. Counts of what we acted on go into the transparency report at each quarter end — no quarter has closed yet, so that page currently publishes the method and an empty table rather than figures.

The phrase appears on a great many hosting front pages, including plenty of providers who will suspend you on the first complaint. Questions that separate them:

1. Which jurisdiction, specifically, and which datacenter? "Offshore" is not a country. A provider that will not name the facility is reselling, and the actual host's policy is what governs you.
2. Do they own their IP space? A reseller's upstream can null-route your prefix regardless of the reseller's own stated policy. Ask for the AS number and check the registry yourself — if the name that comes back is not the host's, you are buying from a reseller. Apply the same test to us; the network page tells you where our number stands.
3. Is the abuse policy written down and specific? "We ignore all complaints" is not a policy, it is a liability. Look for a document distinguishing copyright notices from criminal reports.
4. What happens on a local court order? A provider claiming it would ignore one is either lying or will not exist long enough to matter.
5. Is there a transparency report? Published counts mean someone has thought about the process before it was needed.