Top Hosting Providers
FraudGuard ACE (Attack Correlation Engine) correlates global attack telemetry across multiple threat classifications to show where attacker infrastructure concentrates. This leaderboard is built from a nightly cache of the last 30 days and links directly into detailed provider intel pages.
Interested in exploring or leveraging data like this across your own applications and infrastructure? Start a free trial to access our threat intelligence APIs.
Top Hosting Providers
| # | Provider | Attacker IPs | ASNs | Countries | Threat Breakdown |
|---|---|---|---|---|---|
| 1 | NordVPN | 288,754 | 1 | 54 |
|
| 2 | Amazon Web Services | 110,296 | 2 | 35 |
|
| 3 | M247 | 70,293 | 4 | 99 |
|
| 4 | Cyberzone | 52,617 | 1 | 63 |
|
| 5 | Digital Ocean | 19,149 | 1 | 8 |
|
| 6 | Google Cloud | 17,375 | 1 | 55 |
|
| 7 | Cloudie | 15,936 | 0 | 9 |
|
| 8 | Datacamp | 12,484 | 2 | 91 |
|
| 9 | ProtonVPN | 11,584 | 26 | 111 |
|
| 10 | rainbow network | 10,504 | 1 | 4 |
|
| 11 | Alibaba Cloud | 10,390 | 2 | 15 |
|
| 12 | Microsoft Azure | 8,578 | 1 | 31 |
|
| 13 | Heng Tong | 8,481 | 1 | 2 |
|
| 14 | ExpressVPN | 6,843 | 5 | 13 |
|
| 15 | Tencent Cloud | 5,528 | 2 | 12 |
|
| 16 | IPXO | 4,227 | 7 | 41 |
|
| 17 | Partner Hosting | 4,107 | 1 | 8 |
|
| 18 | Ace Data Centers II | 3,889 | 8 | 23 |
|
| 19 | Hydra Communications | 3,618 | 1 | 8 |
|
| 20 | Cloudflare | 3,360 | 1 | 60 |
|
| 21 | Leaseweb | 3,355 | 12 | 11 |
|
| 22 | ColoCrossing | 3,119 | 1 | 4 |
|
| 23 | Mullvad VPN | 3,049 | 1 | 5 |
|
| 24 | ServerMania | 3,001 | 1 | 7 |
|
| 25 | Tunnelbear | 2,256 | 1 | 1 | — |
| 26 | Akamai | 2,131 | 1 | 15 |
|
| 27 | Contabo | 2,093 | 2 | 8 |
|
| 28 | Airu | 2,048 | 0 | 1 |
|
| 29 | Clouvider | 1,912 | 1 | 22 |
|
| 30 | Purevoltage Enterprises | 1,832 | 1 | 6 |
|
| 31 | Cox Communications | 1,805 | 2 | 6 |
|
| 32 | OVH | 1,761 | 1 | 14 |
|
| 33 | Eonix Corporation | 1,742 | 1 | 4 |
|
| 34 | Alex Largman | 1,728 | 1 | 13 |
|
| 35 | Hetzner | 1,625 | 1 | 4 |
|
| 36 | Fast Servers (Pty) | 1,601 | 2 | 13 |
|
| 37 | HostRoyale Technologies Pvt | 1,586 | 5 | 63 |
|
| 38 | 3xK Tech | 1,505 | 1 | 9 |
|
| 39 | GSL Networks | 1,473 | 1 | 37 |
|
| 40 | Octopus Web Services | 1,431 | 0 | 6 |
|
| 41 | Vultr | 1,329 | 1 | 23 |
|
| 42 | Perimeter 81 | 1,315 | 1 | 2 | — |
| 43 | Web2Objects LLC | 1,302 | 3 | 4 |
|
| 44 | Cogent Communications | 1,270 | 2 | 12 |
|
| 45 | Huawei Cloud | 1,222 | 1 | 12 |
|
| 46 | Oracle Cloud | 1,159 | 1 | 25 |
|
| 47 | GTHost | 1,119 | 2 | 8 |
|
| 48 | China Telecom | 1,076 | 1 | 1 |
|
| 49 | Africa-on-Cloud | 1,027 | 0 | 4 |
|
| 50 | Modmc-54103 | 1,025 | 1 | 1 |
|
Start a free trial
Get access to IP reputation lookups, bulk enrichment, threat intelligence APIs, and downloadable threat feeds.
Create free account →Need threat intel offline?
Download a continuously updated Offline Threat Database (CSV + SQLite) built from FraudGuard ACE. Perfect for SIEM enrichment, warehousing, air-gapped environments, and local scoring.
Explore Offline Threat Database →