⚠️ High-Risk ASNs & Threat Sources

Common VPS provider used for abuse due to easy provisioning

Large cloud provider frequently used for hosting malicious infrastructure

VPS provider with streamlined signup often abused by threat actors

Popular VPS provider for both legitimate and malicious use

European hosting provider often used for bulletproof hosting

Large European hosting provider with diverse abuse patterns

Chinese cloud provider with global presence

Hosting provider associated with VPN and proxy services

Known for hosting VPN exit nodes and proxy services

Amsterdam datacenter commonly used for European abuse operations

Russian hosting provider frequently associated with Tor nodes and proxy services

GCP infrastructure used for bot hosting, credential stuffing, and scraping

CDN and proxy service — traffic origin is masked behind Cloudflare IPs

CDN provider — IPs may mask origin of automated traffic

GCP compute instances frequently used for automated attacks and scraping

Large cloud platform used for hosting malicious infrastructure at scale

Budget hosting provider popular with spammers and botnet operators

Hosting provider associated with scan and abuse traffic

Major Chinese ISP — source of large-scale scanning and brute force activity

Chinese ISP frequently associated with automated scanning activity

Korean ISP — occasional source of credential stuffing campaigns

Russian tech company — Yandex bot and cloud infrastructure

Budget hosting provider with high abuse rates due to easy signup

Affordable VPS provider frequently used for proxy and bot infrastructure

Hosting provider with mixed legitimate and malicious traffic

Dutch hosting provider associated with bulletproof hosting services

Chinese cloud provider with limited abuse controls

Privacy-focused hosting provider popular with anonymity services

Major transit provider — source of diverse traffic including abuse

Internet backbone and tunnel broker — used for IPv6 tunneled abuse

Hosting provider associated with VPN exit nodes and proxy services

European hosting provider known for Tor relay hosting

Hosting provider associated with proxy and VPN services

Major backbone provider — carries diverse traffic including botnet C2

US telecom — residential IPs occasionally used in credential stuffing

Known Tor exit node hosting ASN under Datacamp umbrella

Ad-blocking DNS provider — signals non-standard DNS configuration

Major Chinese cloud provider — source of large-scale scraping and bot traffic

Chinese cloud provider with growing global footprint — used for automated attacks

German hosting provider known for Tor relay and VPN exit node hosting

Swedish hosting provider frequently used for Tor relays and proxy services

Hosting provider associated with bulletproof hosting and cybercrime infrastructure

Dedicated ASN for Tor relay and exit node infrastructure

Privacy-focused VPS provider popular for Tor relays and anonymity services

French cloud provider with affordable instances frequently used for abuse infrastructure

Chinese CDN and hosting provider with global edge — used for automated scraping and bot traffic

Luxembourg-based global hosting and CDN — proxy and VPN exit node hosting

Cloud VPS provider with easy provisioning — abused for credential stuffing and scraping

UK hosting provider known for VPN exit node and proxy infrastructure hosting

Hosting provider associated with bulletproof hosting and phishing infrastructure

Dutch hosting provider with abuse-tolerant policies — proxy and botnet infrastructure

Chinese search and cloud giant — operates public DNS (180.76.76.76) and cloud infrastructure

Largest domain registrar and hosting provider — mixed legitimate and abuse traffic

Major CDN provider — traffic origin masked behind Akamai edge servers, commonly searched IP ranges

Enterprise cloud provider increasingly used for automated scanning and bot hosting

Primary AWS US-East ASN — highest volume of cloud-hosted abuse traffic globally

Chinese cloud computing division — source of large-scale scraping and credential stuffing

US hosting provider with high abuse rates — frequently hosts proxy and VPN infrastructure

Florida-based bare metal hosting — used for botnet C2 and scan infrastructure

Japanese hosting provider — source of automated scanning and brute force attempts

Chinese cloud provider with global nodes — limited abuse controls, bot hosting

US division of Contabo — affordable VPS frequently used for proxy and bot infrastructure

Hosting provider known for VPN exit nodes and residential proxy infrastructure

Indian national ISP — large IP space with significant automated scanning activity

Social media platform infrastructure — IPs commonly looked up in abuse investigations

Social media and advertising infrastructure — IPs searched in bot and scraper investigations

Major European hosting provider — shared hosting frequently abused for phishing and spam

Major shared hosting provider — parent of Bluehost, HostGator, and HostMonster

Chinese global carrier — source of large-scale scanning and brute force activity

Major Chinese metropolitan ISP — high-volume scanning and credential stuffing source

Norwegian hosting provider known for Tor relay and privacy service hosting

Major hosting provider with global infrastructure — used for proxy, VPN, and bot hosting

Major global backbone and transit provider — carries diverse traffic including abuse

Japanese cloud and hosting provider — source of automated scanning from Asia-Pacific

US budget hosting provider — frequently used for proxy infrastructure and abuse

Largest US cable ISP — residential IPs used in credential stuffing and account takeover attacks

Major US telecom — residential and mobile IPs involved in large-scale bot traffic

Major US backbone and ISP — carries diverse traffic including abuse from residential and enterprise customers

Largest European telecom — French residential IPs frequently seen in bot and scraping traffic

Turkish national ISP — large IP space with significant scanning and brute force activity

Major Japanese ISP and mobile carrier — residential IPs in bot and credential stuffing campaigns

US hosting provider frequently abused for proxy, VPN exit node, and botnet infrastructure

German hosting provider known for Tor relay and exit node hosting

Popular public DNS resolver (208.67.222.222) — queries from this ASN indicate non-standard DNS configuration

Privacy-focused public DNS resolver (9.9.9.9) — signals security-conscious or anonymity-seeking users

Family-safe DNS filtering service (185.228.168.9) — DNS resolver with content filtering

Internet-wide security scanner — all traffic from this ASN is automated reconnaissance

Third-largest US cable ISP — residential IPs used in credential stuffing and account takeover

Major Chinese metropolitan ISP — high-volume scanning and brute force source from Shanghai region

Large Chinese mobile ISP — significant automated scanning and credential stuffing activity

Major Indian and global backbone provider — carries diverse traffic including large-scale scanning

Major European cable ISP operating across 10+ countries — residential IPs in bot and abuse traffic

Major UK broadband ISP — residential IPs seen in credential stuffing and automated abuse

Largest Italian ISP and backbone — residential and business IPs in scanning and abuse traffic

Russian national telecom — largest Russian ISP, significant source of scanning and brute force activity

Consumer tech giant — iCloud Private Relay, Apple CDN, and services infrastructure commonly looked up

Developer platform — IPs frequently searched for webhook allowlists and CI/CD configuration

Third-largest US mobile carrier — residential and mobile IPs in credential stuffing and bot traffic

Cloud WAF and CDN provider — traffic origin masked behind Imperva security infrastructure

Hosts millions of WordPress.com sites — source of Jetpack, Akismet, and wp-cron traffic

Major managed cloud and hosting provider — infrastructure used for both legitimate and abuse traffic

Los Angeles hosting provider with high abuse rates — proxy, botnet, and scanning infrastructure

Developer deployment platform — IPs searched for CDN edge node identification and allowlisting

Major CDN provider — serves content for thousands of websites, traffic origin masked

Live streaming platform — IPs commonly looked up in bot and viewbot investigations

Major US managed hosting provider — dedicated servers and VPS used for diverse workloads

Hosting provider known for VPN exit node and residential proxy infrastructure

German non-profit operating high-bandwidth Tor exit relays — 109.70.100.0/24 range frequently appears in Tor exit node lookups

Bulletproof hosting provider (UK/Russia) sanctioned for hosting malware, ransomware, and infostealer infrastructure — supplements AS60729 Aeza Network

US budget hosting and VPS provider with high abuse rates — proxy, VPN, and scanning infrastructure

Major Russian cloud and dedicated server provider — source of large-scale scanning and bot hosting

Russian registrar and shared hosting provider — frequently abused for phishing and spam campaigns

Bare-metal cloud provider popular with developers — IP ranges searched for allowlisting and abuse investigation

US budget VPS and hosting provider with easy signup — frequently abused for proxy, scraping, and bot infrastructure

DDoS-protected hosting provider — frequently flagged for hosting proxy, botnet C2, and abuse infrastructure

Dallas-based dedicated server provider — source of scanning and proxy hosting traffic

US dedicated server and colocation provider with high abuse rates — proxy and scanning infrastructure

US budget dedicated server provider — abuse-heavy, hosts proxy, VPN, and scanning infrastructure

Major US managed cloud and hosting provider — supplements AS27411, mixed legitimate and abuse traffic

German VPS and dedicated server provider with affordable plans — used for proxy and bot infrastructure

German hosting provider operating WebTropia — VPS and dedicated servers used for abuse infrastructure

Major US cable ISP (Spectrum) — residential IPs used in credential stuffing and account takeover attacks

Major US broadband ISP — residential IPs seen in bot traffic and credential stuffing campaigns

Largest US mobile carrier — mobile IPs in large-scale bot, scraping, and account fraud traffic

Largest German ISP — residential and business IPs in scanning, bot, and credential stuffing traffic

Major Indian ISP and mobile carrier — large IP space with significant automated scanning activity

Largest Indian mobile ISP by subscribers — huge IP space, source of bot and credential stuffing traffic

Major Russian mobile and broadband ISP — significant source of scanning and brute force activity

Major Russian mobile carrier — large mobile IP space involved in automated scanning and bot traffic