FraudGuard ACE (Attack Correlation Engine) correlates global attack telemetry across multiple threat classifications to show where attacker infrastructure concentrates. This leaderboard is built from a nightly cache of the last 30 days and links directly into detailed provider intel pages.
Interested in exploring or leveraging data like this across your own applications and infrastructure? Start a free trial to access our threat intelligence APIs.
| # | Provider | Attacker IPs | ASNs | Countries | Threat Breakdown |
|---|---|---|---|---|---|
| 1 | NordVPN | 288,206 | 1 | 54 |
|
| 2 | Amazon Web Services | 86,017 | 1 | 35 |
|
| 3 | Cyberzone | 53,027 | 1 | 64 |
|
| 4 | M247 | 46,873 | 2 | 116 |
|
| 5 | Google Cloud | 42,467 | 0 | 56 |
|
| 6 | Digital Ocean | 42,316 | 1 | 8 |
|
| 7 | Datacamp | 18,482 | 2 | 93 |
|
| 8 | Microsoft Azure | 14,108 | 1 | 33 |
|
| 9 | ProtonVPN | 11,486 | 25 | 111 |
|
| 10 | Alibaba Cloud | 8,866 | 1 | 15 |
|
| 11 | IPXO | 7,649 | 6 | 39 |
|
| 12 | ExpressVPN | 6,871 | 5 | 13 |
|
| 13 | Cloudflare | 6,661 | 0 | 67 |
|
| 14 | Purevoltage Enterprises | 6,310 | 1 | 7 |
|
| 15 | Arisk-communications-inc | 5,460 | 0 | 17 |
|
| 16 | Windstream Communications | 5,312 | 0 | 2 |
|
| 17 | Tencent Cloud | 4,983 | 1 | 12 |
|
| 18 | OVH | 4,728 | 0 | 18 |
|
| 19 | 3xK Tech | 4,713 | 1 | 9 |
|
| 20 | Ace Data Centers II | 4,670 | 1 | 27 |
|
| 21 | ServerMania | 4,608 | 0 | 8 |
|
| 22 | Leaseweb | 3,929 | 2 | 13 |
|
| 23 | Web2Objects LLC | 3,678 | 0 | 4 |
|
| 24 | Akamai | 3,653 | 0 | 16 |
|
| 25 | Hetzner | 3,507 | 0 | 4 |
|
| 26 | Clouvider | 3,321 | 1 | 37 |
|
| 27 | HostRoyale Technologies Pvt | 3,220 | 1 | 64 |
|
| 28 | ColoCrossing | 3,136 | 0 | 7 |
|
| 29 | Mullvad VPN | 3,031 | 1 | 5 |
|
| 30 | Latitude-sh | 2,867 | 1 | 14 |
|
| 31 | Fast Servers (Pty) | 2,864 | 2 | 13 |
|
| 32 | Cox Communications | 2,661 | 1 | 6 |
|
| 33 | IT_HOST_BLSYNC | 2,439 | 0 | 35 |
|
| 34 | Biterika Group | 2,412 | 0 | 1 |
|
| 35 | Alex Largman | 2,351 | 1 | 13 |
|
| 36 | Tunnelbear | 2,256 | 1 | 1 | — |
| 37 | Contabo | 2,140 | 0 | 9 |
|
| 38 | GSL Networks | 2,119 | 1 | 46 |
|
| 39 | Astound Broadband | 2,006 | 0 | 2 |
|
| 40 | China Telecom | 1,925 | 0 | 1 |
|
| 41 | Oracle Cloud | 1,820 | 0 | 26 |
|
| 42 | 1&1 Versatel | 1,732 | 0 | 1 |
|
| 43 | SOLLUTIUM EU Sp z.o.o. | 1,700 | 0 | 4 |
|
| 44 | PENTECH BILISIM TEKNOLOJILERI SANAYI VE TICARET SI | 1,621 | 0 | 4 |
|
| 45 | SPDNet Telekomunikasyon Hizmetleri Bilgi Teknoloji | 1,540 | 0 | 3 |
|
| 46 | Colocation America Corporation | 1,515 | 2 | 5 |
|
| 47 | Onehostplanet s.r.o. | 1,495 | 0 | 3 |
|
| 48 | Vultr | 1,475 | 0 | 24 |
|
| 49 | Cogent Communications | 1,398 | 2 | 17 |
|
| 50 | Perimeter 81 | 1,315 | 1 | 2 | — |
Get access to IP reputation lookups, bulk enrichment, threat intelligence APIs, and downloadable threat feeds.
Create free account →Download a continuously updated Offline Threat Database (CSV + SQLite) built from FraudGuard ACE. Perfect for SIEM enrichment, warehousing, air-gapped environments, and local scoring.
Explore Offline Threat Database →