FraudGuard ACE (Attack Correlation Engine) correlates global attack telemetry across multiple threat classifications to show where attacker infrastructure concentrates. This leaderboard is built from a nightly cache of the last 30 days and links directly into detailed provider intel pages.
Interested in exploring or leveraging data like this across your own applications and infrastructure? Start a free trial to access our threat intelligence APIs.
| # | Provider | Attacker IPs | ASNs | Countries | Threat Breakdown |
|---|---|---|---|---|---|
| 1 | NordVPN | 289,784 | 1 | 55 |
|
| 2 | Amazon Web Services | 281,169 | 8 | 49 |
|
| 3 | Digital Ocean | 181,788 | 1 | 8 |
|
| 4 | Cogent Communications | 98,935 | 10 | 24 |
|
| 5 | Alibaba Cloud | 90,640 | 3 | 16 |
|
| 6 | M247 | 58,306 | 6 | 123 |
|
| 7 | Cyberzone | 53,214 | 1 | 64 |
|
| 8 | Leaseweb | 41,077 | 19 | 15 |
|
| 9 | Bunny-communications-global | 40,894 | 1 | 34 |
|
| 10 | Datacamp | 40,828 | 2 | 112 |
|
| 11 | Microsoft Azure | 39,888 | 9 | 37 |
|
| 12 | HostRoyale Technologies Pvt | 38,592 | 8 | 77 |
|
| 13 | Google Cloud | 37,418 | 9 | 35 |
|
| 14 | ColoCrossing | 36,831 | 3 | 10 |
|
| 15 | OVH | 34,958 | 2 | 28 |
|
| 16 | Vultr | 34,490 | 2 | 30 |
|
| 17 | CTG Server | 32,526 | 1 | 4 |
|
| 18 | ServerMania | 32,486 | 1 | 9 |
|
| 19 | Tencent Cloud | 31,236 | 2 | 13 |
|
| 20 | FiberPower | 29,529 | 5 | 4 |
|
| 21 | Proper Support LLP | 29,181 | 1 | 2 |
|
| 22 | Purevoltage Enterprises | 27,538 | 1 | 9 |
|
| 23 | Colocation America Corporation | 23,093 | 20 | 8 |
|
| 24 | Hetzner | 22,813 | 4 | 4 |
|
| 25 | Ace Data Centers II | 21,127 | 47 | 31 |
|
| 26 | 3xK Tech | 20,412 | 1 | 11 |
|
| 27 | Oracle Cloud | 19,680 | 12 | 28 |
|
| 28 | Cloudflare | 19,674 | 4 | 65 |
|
| 29 | Fast Servers (Pty) | 15,830 | 3 | 13 |
|
| 30 | Alex Largman | 15,788 | 1 | 14 |
|
| 31 | Verizon Business | 15,688 | 6 | 13 |
|
| 32 | TBB | 15,196 | 1 | 48 |
|
| 33 | IPXO | 14,169 | 24 | 54 |
|
| 34 | Windstream Communications | 13,405 | 6 | 4 |
|
| 35 | Akamai | 12,299 | 3 | 15 |
|
| 36 | ProtonVPN | 12,192 | 27 | 111 |
|
| 37 | Zenlayer | 11,736 | 4 | 44 |
|
| 38 | Clouvider | 11,467 | 2 | 51 |
|
| 39 | Huawei Cloud | 10,898 | 1 | 19 |
|
| 40 | Latitude-sh | 10,800 | 1 | 16 |
|
| 41 | Colocation America | 10,450 | 3 | 1 |
|
| 42 | Contabo | 10,444 | 3 | 9 |
|
| 43 | Computer Engineering & Consulting | 10,246 | 1 | 1 |
|
| 44 | Trit Networks, LLC | 10,240 | 1 | 1 |
|
| 45 | EGIHosting | 10,187 | 4 | 7 |
|
| 46 | Astound Broadband | 9,844 | 3 | 9 |
|
| 47 | Sprious LLC | 9,842 | 2 | 15 |
|
| 48 | Iomart Cloud Services | 8,632 | 2 | 13 |
|
| 49 | Dynanode | 8,423 | 1 | 6 |
|
| 50 | Biterika Group | 8,382 | 3 | 1 |
|
Get access to IP reputation lookups, bulk enrichment, threat intelligence APIs, and downloadable threat feeds.
Create free account →Download a continuously updated Offline Threat Database (CSV + SQLite) built from FraudGuard ACE. Perfect for SIEM enrichment, warehousing, air-gapped environments, and local scoring.
Explore Offline Threat Database →