Malware Activity:Hosting Networks (ASNs)
Quarter over Quarter Comparison
October 1, 2021 - December 31, 2021
For purposes of observing change over time, it is useful to compare measurements and metrics over successive reporting periods. Such comparisons illustrate whether malware activities are increasing or decreasing, and where such changes are occurring. Such comparisons can identify identify hosting networks where malware is being hosted and whether or not such activity is persistent or atypical. Investigators or policy makers may focus on these hosting networks for deeper analyses.
Ranking of Hosting Networks (ASNs) by Number of Unique Malware Addresses, Quarter over Quarter (October to December 2021)
Hosting Providers with a minimum of 50,000 addresses assigned to the ASN and 25 malware records
| IPv4 Addresses Assigned | Unique Malware Addresses | Total Malware Records | ||||||||||
| Rank | Hosting Provider | ASN | July to September 2021 | October to December 2021 | July to September 2021 | October to December 2021 | July to September 2021 | October to December 2021 ▼ | ||||
| 1 | — | CHINA169-BACKBONE CHINA UNICOM China169 Backbone | 4837 | 59,102,208 | 59,096,064 | (-0%) | 64,483 | 64,932 | (+1%) | 163,426 | 151,079 | (-8%) |
| 2 | ▲ +1* | CHINANET-BACKBONE No.31 | 4134 | 115,205,120 | 112,990,720 | (-2%) | 14,587 | 19,767 | (+36%) | 38,929 | 43,552 | (+12%) |
| 3 | ▼ -1 | BSNL-NIB National Internet Backbone | 9829 | 10,832,128 | 10,828,288 | (-0%) | 24,987 | 24,153 | (-3%) | 55,698 | 43,511 | (-22%) |
| 4 | ▲ +6 | CLOUDFLARENET | 13335 | 2,355,968 | 2,368,256 | (+1%) | 3,095 | 3,032 | (-2%) | 5,281 | 36,035 | (+582%) |
| 5 | ▼ -1 | CHINA169-GZ China Unicom IP network China169 Guangdong province | 17816 | 3,948,288 | 3,948,288 | (0%) | 13,992 | 13,409 | (-4%) | 30,630 | 25,397 | (-17%) |
| 6 | N/R** | MICROSOFT-CORP-MSN-AS-BLOCK | 8068 | 18,688 | 18,688 | (0%) | 4 | 6 | (+50%) | 312 | 20,217 | (+6,380%) |
| 7 | ▼ -2 | CNCGROUP-GZ China Unicom Guangzhou network | 17622 | 1,355,776 | 1,365,504 | (+1%) | 10,716 | 7,781 | (-27%) | 24,733 | 14,189 | (-43%) |
| 8 | ▲ +3 | WIND Telecom S.A. | 27887 | 63,744 | 63,488 | (-0%) | 1,884 | 4,066 | (+116%) | 4,853 | 9,324 | (+92%) |
| 9 | ▼ -3 | HATHWAY-NET-AP Hathway IP Over Cable Internet | 17488 | 999,168 | 1,008,128 | (+1%) | 5,299 | 4,770 | (-10%) | 9,274 | 7,596 | (-18%) |
| 10 | ▲ +12 | UNIFIEDLAYER-AS-1 | 46606 | 1,393,152 | 1,393,920 | (0%) | 765 | 1,787 | (+134%) | 1,847 | 6,087 | (+230%) |
| 11 | ▼ -2 | VNPT-AS-VN VNPT Corp | 45899 | 19,169,536 | 19,346,432 | (+1%) | 2,431 | 1,994 | (-18%) | 5,801 | 4,217 | (-27%) |
| 12 | ▲ +12 | QUANTILNETWORKS | 54994 | 109,056 | 122,112 | (+12%) | 15 | 32 | (+113%) | 1,762 | 3,259 | (+85%) |
| 13 | ▼ -5 | CNCGROUP-SZ China Unicom Shenzen network | 17623 | 958,976 | 950,528 | (-1%) | 2,873 | 1,882 | (-34%) | 5,807 | 3,141 | (-46%) |
| 14 | ▼ -2 | DIGITALOCEAN-ASN | 14061 | 2,599,168 | 2,652,416 | (+2%) | 468 | 873 | (+87%) | 3,574 | 3,088 | (-14%) |
| 15 | ▲ +14 | AMAZON-02 | 16509 | 41,511,936 | 42,019,328 | (+1%) | 379 | 695 | (+83%) | 1,371 | 2,737 | (+100%) |
| 16 | ▲ +2 | MTNL-AP Mahanagar Telephone Nigam Limited | 17813 | 2,729,984 | 2,729,984 | (0%) | 1,095 | 1,393 | (+27%) | 2,366 | 2,656 | (+12%) |
| 17 | ▲ +2 | AS-26496-GO-DADDY-COM-LLC | 26496 | 1,522,944 | 1,523,200 | (0%) | 425 | 797 | (+88%) | 2,061 | 2,646 | (+28%) |
| 18 | ▲ +5 | UNICOM-CN China Unicom IP network | 133119 | 211,712 | 219,904 | (+4%) | 5 | 6 | (+20%) | 1,825 | 2,635 | (+44%) |
| 19 | ▼ -2 | HINET Data Communication Business Group | 3462 | 17,027,328 | 17,025,792 | (-0%) | 1,139 | 1,314 | (+15%) | 2,562 | 2,610 | (+2%) |
| 20 | ▲ +10 | OVH - OVH SAS | 16276 | 3,979,264 | 3,979,264 | (0%) | 405 | 751 | (+85%) | 1,194 | 2,501 | (+109%) |
* Indicates change over prior quarter
** Indicates not ranked in prior quarter; either number of addresses or number of malware records did not meet minimum threshold for ranking
Quarter over Quarter Comparisons of:
Activity in Hosting Networks (ASNs)