Phishing Activity in Hosting Networks (ASNs)
May 1, 2023 - July 31, 2023
To see where phishing sites were being hosted, we collected the IP addresses that phishing domains and phishing URLs were resolving to when phishing activity was detected and added to a threat or block list. We then identified the ASN where the IP prefix containing the IP address of the phish is allocated and this number identifies the hosting network where phishing attacks were reported.
We measure phishing attacks to show where phishing sites are hosted and to identify the hosting service that has been allocated the IPv4 address space wherein the IP address of the phishing site lies.
A phisher may use one, several, or large numbers of URLs in a single phishing campaign. We apply rules to our phishing reports to de-duplicate URLs and to analyze hostname, URL path composition, target, and abuse report dates for similarities to obtain sets of URLs that we consider to be involved in one phishing attack. We also apply additional rules to group URLs into attacks based on observed cases.
In the table below, we show the twenty hosting networks with the highest numbers of reported phishing attacks. Complete lists of ASNs where malware was reported for the quarter can be downloaded in CSV format from the Records page.
Ranking of Hosting Networks (ASNs) by Phishing Attacks (May to July 2023)
Rank | Hosting Provider | AS Number | # Routed IPv4 Addresses |
Phishing Attacks ▼ | Phishing Attack Score |
1 | Cloudflare, Inc. | 13335 | 2,550,016 | 100,426 | 393.82 |
2 | Google LLC | 15169 | 11,737,344 | 98,732 | 84.12 |
3 | LG DACOM Corporation | 3786 | 11,678,720 | 20,700 | 17.72 |
4 | Fastly, Inc. | 54113 | 981,792 | 15,396 | 156.82 |
5 | M247 Ltd | 9009 | 1,183,488 | 13,930 | 117.70 |
6 | Weebly, Inc. | 27647 | 2,048 | 10,251 | 50053.71 |
7 | Amazon.com, Inc. | 16509 | 45,135,616 | 10,056 | 2.23 |
8 | Netminders Server Hosting | 7040 | 29,440 | 9,501 | 3227.24 |
9 | Nocix, LLC | 33387 | 67,072 | 5,646 | 841.78 |
10 | WholeSale Internet, Inc. | 32097 | 211,456 | 5,095 | 240.95 |
11 | Google LLC | 396982 | 25,431,808 | 5,087 | 2.00 |
12 | Hostinger International Limited | 204915 | 768 | 5,060 | 65885.42 |
13 | Hostinger International Limited | 47583 | 190,976 | 4,686 | 245.37 |
14 | Amazon.com, Inc. | 14618 | 16,508,928 | 4,638 | 2.81 |
15 | Shenzhen Tencent Computer Systems Company Limited | 132203 | 2,674,944 | 4,479 | 16.74 |
16 | Protocol Labs | 40680 | 1,024 | 4,418 | 43144.53 |
17 | Unified Layer | 46606 | 813,056 | 4,199 | 51.64 |
18 | QuadraNet Enterprises LLC | 64270 | 20,480 | 4,000 | 1953.13 |
19 | Network Solutions, LLC | 19871 | 266,752 | 3,892 | 145.90 |
20 | DigitalOcean, LLC | 14061 | 2,848,512 | 3,200 | 11.23 |
To allow comparison of large and small Hosting Networks (ASNs), we also rank Hosting Networks based on a metric, phishing attack score, which is calculated by dividing the number phishing attacks reported against an ASN by the number of routable IPv4 addresses allocated to that ASN.
Hosting (ASN) Phishing Attack Score = (number of phishing attacks/IP Addresses in ASN) * 10,000
In the table below, we show the top 20 hosting operators based on phishing attack score.
Ranking of Hosting Networks (ASNs) by Phishing Attack Score (May to July 2023)
Hosting Networks (ASNs) with a minimum of 50,000 IPv4 addresses and 25 phishing attacks
Rank | Hosting Provider | AS Number | # Routed IPv4 Addresses |
Phishing attacks | Phishing Attack Score ▼ |
1 | Nocix, LLC | 33387 | 67,072 | 5,646 | 841.78 |
2 | Cloudflare, Inc. | 13335 | 2,550,016 | 100,426 | 393.82 |
3 | Namecheap, Inc. | 22612 | 75,968 | 2,454 | 323.03 |
4 | Hostinger International Limited | 47583 | 190,976 | 4,686 | 245.37 |
5 | WholeSale Internet, Inc. | 32097 | 211,456 | 5,095 | 240.95 |
6 | Fastly, Inc. | 54113 | 981,792 | 15,396 | 156.82 |
7 | Network Solutions, LLC | 19871 | 266,752 | 3,892 | 145.90 |
8 | Dreamscape Networks PTY LTD | 38719 | 82,944 | 1,147 | 138.29 |
9 | VIETTEL (CAMBODIA) PTE., LTD | 38623 | 95,744 | 1,292 | 134.94 |
10 | TimeWeb Ltd. | 9123 | 87,042 | 1,147 | 131.78 |
11 | UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | 135377 | 155,133 | 1,854 | 119.51 |
12 | M247 Ltd | 9009 | 1,183,488 | 13,930 | 117.70 |
13 | Google LLC | 15169 | 11,737,344 | 98,732 | 84.12 |
14 | Unified Layer | 46606 | 813,056 | 4,199 | 51.64 |
15 | Host Europe GmbH | 21499 | 53,504 | 272 | 50.84 |
16 | Zomro B.V. | 204601 | 59,136 | 290 | 49.04 |
17 | DediPath | 35913 | 283,648 | 1,385 | 48.83 |
18 | Tier.Net Technologies LLC | 397423 | 57,856 | 257 | 44.42 |
19 | Interserver, Inc | 19318 | 128,768 | 570 | 44.27 |
20 | FranTech Solutions | 53667 | 72,192 | 302 | 41.83 |
Quarterly Update: Key Statistics |
Quarterly Update: Top Level Domains |
Quarterly Update: Registrars |
Quarterly Update: Hosting Networks |
Quarter over Quarter: Hosting Networks |