Malware Activity in Hosting Networks (ASNs)
January 1, 2022 - March 31, 2022

To see where malware was being served up, or distributed among peer-to-peer hosts, we collected the IP addresses that malware domains and malware URLs were resolving to when malware activity was reported. We then identified the Autonomous System (ASN) where the IP prefix containing the IP address to identif the hosting network where malware were reported.

For the period, we identified 411 with IPv4 addresses reported as serving up or distributing malware:

- 94 hosting networks had 100 or more IPv4 addresses reported,

- 30 hosting networks had 500 or more IPv4 addresses reported,

- 16 hosting networks had 1000 or more IPv4 addresses reported, and

- 4 hosting networks had 5000 or more reported IPv4 addresses reported.

In the table below, we show the twenty hosting networks with the highest numbers of IPv4 addresses reported as serving up or distributing malware (“Unique Malware Addresses”).

IPv4 addresses may be reported for hosting one or more malware; for example, two or several URLs may contain the same IPv4 address but the PATHS or QUERIES may identify different malware.

In the next table, we rank by the total number of malware records that identify the IPv4 address as serving or distributing malware in ASNs.