Phishing Activity in Hosting Networks (ASNs)
May 1, 2023 - July 31, 2023

To see where phishing sites were being hosted, we collected the IP addresses that phishing domains and phishing URLs were resolving to when phishing activity was detected and added to a threat or block list. We then identified the ASN where the IP prefix containing the IP address of the phish is allocated and this number identifies the hosting network where phishing attacks were reported.

We measure phishing attacks to show where phishing sites are hosted and to identify the hosting service that has been allocated the IPv4 address space wherein the IP address of the phishing site lies.

A phisher may use one, several, or large numbers of URLs in a single phishing campaign. We apply rules to our phishing reports to de-duplicate URLs and to analyze hostname, URL path composition, target, and abuse report dates for similarities to obtain sets of URLs that we consider to be involved in one phishing attack. We also apply additional rules to group URLs into attacks based on observed cases.

In the table below, we show the twenty hosting networks with the highest numbers of reported phishing attacks. Complete lists of ASNs where malware was reported for the quarter can be downloaded in CSV format from the Records page.

Ranking of Hosting Networks (ASNs) by Phishing Attacks (May to July 2023)

Rank Hosting Provider AS Number # Routed
IPv4 Addresses
Phishing Attacks ▼ Phishing Attack Score
1 Cloudflare, Inc. 13335 2,550,016 100,426 393.82
2 Google LLC 15169 11,737,344 98,732 84.12
3 LG DACOM Corporation 3786 11,678,720 20,700 17.72
4 Fastly, Inc. 54113 981,792 15,396 156.82
5 M247 Ltd 9009 1,183,488 13,930 117.70
6 Weebly, Inc. 27647 2,048 10,251 50053.71
7 Amazon.com, Inc. 16509 45,135,616 10,056 2.23
8 Netminders Server Hosting 7040 29,440 9,501 3227.24
9 Nocix, LLC 33387 67,072 5,646 841.78
10 WholeSale Internet, Inc. 32097 211,456 5,095 240.95
11 Google LLC 396982 25,431,808 5,087 2.00
12 Hostinger International Limited 204915 768 5,060 65885.42
13 Hostinger International Limited 47583 190,976 4,686 245.37
14 Amazon.com, Inc. 14618 16,508,928 4,638 2.81
15 Shenzhen Tencent Computer Systems Company Limited 132203 2,674,944 4,479 16.74
16 Protocol Labs 40680 1,024 4,418 43144.53
17 Unified Layer 46606 813,056 4,199 51.64
18 QuadraNet Enterprises LLC 64270 20,480 4,000 1953.13
19 Network Solutions, LLC 19871 266,752 3,892 145.90
20 DigitalOcean, LLC 14061 2,848,512 3,200 11.23

To allow comparison of large and small Hosting Networks (ASNs), we also rank Hosting Networks based on a metric, phishing attack score, which is calculated by dividing the number phishing attacks reported against an ASN by the number of routable IPv4 addresses allocated to that ASN.

Hosting (ASN) Phishing Attack Score = (number of phishing attacks/IP Addresses in ASN) * 10,000

In the table below, we show the top 20 hosting operators based on phishing attack score.

Ranking of Hosting Networks (ASNs) by Phishing Attack Score (May to July 2023)

Hosting Networks (ASNs) with a minimum of 50,000 IPv4 addresses and 25 phishing attacks

Rank Hosting Provider AS Number # Routed IPv4
Addresses
Phishing attacks Phishing Attack Score ▼
1 Nocix, LLC 33387 67,072 5,646 841.78
2 Cloudflare, Inc. 13335 2,550,016 100,426 393.82
3 Namecheap, Inc. 22612 75,968 2,454 323.03
4 Hostinger International Limited 47583 190,976 4,686 245.37
5 WholeSale Internet, Inc. 32097 211,456 5,095 240.95
6 Fastly, Inc. 54113 981,792 15,396 156.82
7 Network Solutions, LLC 19871 266,752 3,892 145.90
8 Dreamscape Networks PTY LTD 38719 82,944 1,147 138.29
9 VIETTEL (CAMBODIA) PTE., LTD 38623 95,744 1,292 134.94
10 TimeWeb Ltd. 9123 87,042 1,147 131.78
11 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 135377 155,133 1,854 119.51
12 M247 Ltd 9009 1,183,488 13,930 117.70
13 Google LLC 15169 11,737,344 98,732 84.12
14 Unified Layer 46606 813,056 4,199 51.64
15 Host Europe GmbH 21499 53,504 272 50.84
16 Zomro B.V. 204601 59,136 290 49.04
17 DediPath 35913 283,648 1,385 48.83
18 Tier.Net Technologies LLC 397423 57,856 257 44.42
19 Interserver, Inc 19318 128,768 570 44.27
20 FranTech Solutions 53667 72,192 302 41.83

Quarterly Update:
Key Statistics
Quarterly Update:
Top Level Domains
Quarterly Update:
Registrars
Quarterly Update:
Hosting Networks
Quarter over Quarter:
Hosting Networks