FraudGuard ACE (Attack Correlation Engine) correlates global attack telemetry across multiple threat classifications to show where attacker infrastructure concentrates. This leaderboard is built from a nightly cache of the last 30 days and links directly into detailed provider intel pages.
Interested in exploring or leveraging data like this across your own applications and infrastructure? Start a free trial to access our threat intelligence APIs.
| # | Provider | Attacker IPs | ASNs | Countries | Threat Breakdown |
|---|---|---|---|---|---|
| 1 | NordVPN | 288,566 | 1 | 55 |
|
| 2 | Amazon Web Services | 123,605 | 1 | 36 |
|
| 3 | M247 | 60,307 | 3 | 112 |
|
| 4 | Cyberzone | 52,684 | 1 | 63 |
|
| 5 | Digital Ocean | 39,585 | 1 | 8 |
|
| 6 | Google Cloud | 34,864 | 0 | 51 |
|
| 7 | Datacamp | 16,614 | 2 | 96 |
|
| 8 | Cloudie | 14,435 | 0 | 8 |
|
| 9 | Microsoft Azure | 13,531 | 1 | 33 |
|
| 10 | Alibaba Cloud | 12,124 | 1 | 15 |
|
| 11 | ProtonVPN | 11,597 | 25 | 111 |
|
| 12 | rainbow network | 9,492 | 1 | 4 |
|
| 13 | IPXO | 7,516 | 6 | 45 |
|
| 14 | ExpressVPN | 6,867 | 5 | 13 |
|
| 15 | Tencent Cloud | 5,615 | 1 | 12 |
|
| 16 | Cloudflare | 5,026 | 0 | 68 |
|
| 17 | Ace Data Centers II | 4,994 | 2 | 28 |
|
| 18 | Windstream Communications | 4,740 | 1 | 2 |
|
| 19 | OVH | 4,272 | 1 | 16 |
|
| 20 | 3xK Tech | 4,270 | 1 | 9 |
|
| 21 | ColoCrossing | 4,236 | 1 | 7 |
|
| 22 | Leaseweb | 3,894 | 6 | 10 |
|
| 23 | ServerMania | 3,700 | 1 | 7 |
|
| 24 | Akamai | 3,387 | 0 | 16 |
|
| 25 | Mullvad VPN | 3,040 | 1 | 5 |
|
| 26 | HostRoyale Technologies Pvt | 3,023 | 2 | 61 |
|
| 27 | Purevoltage Enterprises | 2,838 | 1 | 7 |
|
| 28 | Hydra Communications | 2,810 | 1 | 7 |
|
| 29 | Clouvider | 2,763 | 1 | 31 |
|
| 30 | Cox Communications | 2,615 | 2 | 6 |
|
| 31 | Alex Largman | 2,494 | 1 | 13 |
|
| 32 | Hetzner | 2,356 | 0 | 4 |
|
| 33 | Contabo | 2,276 | 1 | 9 |
|
| 34 | Tunnelbear | 2,256 | 1 | 1 | — |
| 35 | GSL Networks | 2,160 | 1 | 48 |
|
| 36 | Latitude-sh | 2,096 | 1 | 14 |
|
| 37 | China Telecom | 2,067 | 1 | 1 |
|
| 38 | Airu | 2,048 | 0 | 1 |
|
| 39 | 1&1 Versatel | 1,804 | 0 | 1 |
|
| 40 | Fast Servers (Pty) | 1,727 | 2 | 13 |
|
| 41 | Cogent Communications | 1,534 | 2 | 14 |
|
| 42 | Onehostplanet s.r.o. | 1,494 | 0 | 3 |
|
| 43 | Oracle Cloud | 1,479 | 0 | 25 |
|
| 44 | PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET SI | 1,463 | 0 | 3 |
|
| 45 | Colocation America Corporation | 1,408 | 3 | 5 |
|
| 46 | Vultr | 1,353 | 0 | 23 |
|
| 47 | Perimeter 81 | 1,315 | 1 | 2 | — |
| 48 | Eonix Corporation | 1,289 | 0 | 4 |
|
| 49 | Scaleway | 1,284 | 1 | 4 |
|
| 50 | Huawei Cloud | 1,246 | 1 | 13 |
|
Get access to IP reputation lookups, bulk enrichment, threat intelligence APIs, and downloadable threat feeds.
Create free account →Download a continuously updated Offline Threat Database (CSV + SQLite) built from FraudGuard ACE. Perfect for SIEM enrichment, warehousing, air-gapped environments, and local scoring.
Explore Offline Threat Database →