FraudGuard ACE (Attack Correlation Engine) correlates global attack telemetry across multiple threat classifications to show where attacker infrastructure concentrates. This leaderboard is built from a nightly cache of the last 30 days and links directly into detailed provider intel pages.
Interested in exploring or leveraging data like this across your own applications and infrastructure? Start a free trial to access our threat intelligence APIs.
| # | Provider | Attacker IPs | ASNs | Countries | Threat Breakdown |
|---|---|---|---|---|---|
| 1 | Amazon Web Services | 359,106 | 8 | 50 |
|
| 2 | NordVPN | 289,837 | 1 | 55 |
|
| 3 | Digital Ocean | 254,300 | 1 | 8 |
|
| 4 | Cogent Communications | 100,294 | 10 | 26 |
|
| 5 | Alibaba Cloud | 98,481 | 3 | 16 |
|
| 6 | M247 | 62,723 | 7 | 124 |
|
| 7 | Cyberzone | 53,283 | 1 | 64 |
|
| 8 | Microsoft Azure | 47,438 | 9 | 38 |
|
| 9 | Google Cloud | 46,372 | 9 | 53 |
|
| 10 | Datacamp | 45,993 | 2 | 115 |
|
| 11 | Leaseweb | 45,485 | 19 | 15 |
|
| 12 | Bunny-communications-global | 42,158 | 1 | 35 |
|
| 13 | HostRoyale Technologies Pvt | 42,098 | 9 | 79 |
|
| 14 | ColoCrossing | 39,716 | 3 | 10 |
|
| 15 | OVH | 37,505 | 2 | 28 |
|
| 16 | Tencent Cloud | 37,354 | 2 | 13 |
|
| 17 | ServerMania | 36,104 | 2 | 9 |
|
| 18 | Vultr | 35,251 | 2 | 31 |
|
| 19 | CTG Server | 32,554 | 1 | 4 |
|
| 20 | Octopus Web Services | 29,979 | 2 | 6 |
|
| 21 | FiberPower | 29,608 | 5 | 5 |
|
| 22 | Proper Support LLP | 29,181 | 1 | 2 |
|
| 23 | Purevoltage Enterprises | 28,173 | 1 | 9 |
|
| 24 | Hetzner | 25,188 | 4 | 4 |
|
| 25 | Ace Data Centers II | 24,448 | 47 | 33 |
|
| 26 | 3xK Tech | 24,397 | 1 | 11 |
|
| 27 | Colocation America Corporation | 24,036 | 20 | 10 |
|
| 28 | Oracle Cloud | 22,041 | 13 | 29 |
|
| 29 | Cloudflare | 20,684 | 4 | 67 |
|
| 30 | Madgenius.com | 19,053 | 1 | 4 |
|
| 31 | Fast Servers (Pty) | 16,486 | 3 | 13 |
|
| 32 | Alex Largman | 16,431 | 1 | 14 |
|
| 33 | IPXO | 16,194 | 24 | 54 |
|
| 34 | Windstream Communications | 16,106 | 6 | 4 |
|
| 35 | Verizon Business | 15,691 | 6 | 13 |
|
| 36 | Akamai | 15,346 | 3 | 15 |
|
| 37 | TBB | 15,291 | 1 | 48 |
|
| 38 | Huawei Cloud | 13,503 | 1 | 19 |
|
| 39 | Zenlayer | 12,924 | 4 | 46 |
|
| 40 | Clouvider | 12,517 | 2 | 52 |
|
| 41 | Contabo | 12,479 | 3 | 9 |
|
| 42 | ProtonVPN | 12,194 | 27 | 111 |
|
| 43 | Latitude-sh | 11,665 | 1 | 16 |
|
| 44 | Dynanode | 11,421 | 1 | 6 |
|
| 45 | NTT-DATA | 11,198 | 5 | 21 |
|
| 46 | Cloudie | 11,131 | 5 | 10 |
|
| 47 | Colocation America | 11,072 | 3 | 1 |
|
| 48 | EGIHosting | 10,866 | 4 | 9 |
|
| 49 | Sprious LLC | 10,273 | 2 | 15 |
|
| 50 | Computer Engineering & Consulting | 10,246 | 1 | 1 |
|
Get access to IP reputation lookups, bulk enrichment, threat intelligence APIs, and downloadable threat feeds.
Create free account →Download a continuously updated Offline Threat Database (CSV + SQLite) built from FraudGuard ACE. Perfect for SIEM enrichment, warehousing, air-gapped environments, and local scoring.
Explore Offline Threat Database →