Phishing Activity in Hosting Networks (ASNs)
November 1, 2021 - January 31, 2022

To see where phishing sites were being hosted, we collected the IP addresses that phishing domains and phishing URLs were resolving to when phishing activity was detected and added to a threat or block list. We then identified the ASN where the IP prefix containing the IP address of the phish is allocated and this number identifies the hosting network where phishing attacks were reported.

For the November 1, 2021 to January 31, 2022 period, we identified

- 98 hosting networks with 100 or more reported phishing attacks.

- 44 hosting networks with 500 or more reported phishing attacks.

- 22 hosting networks with 1000 or more reported phishing attacks.

and 8 hosting networks with 5000 or more reported phishing attacks.

We measure phishing attacks to show where phishing sites are hosted and to identify the hosting service that has been allocated the IPv4 address space wherein the IP address of the phishing site lies.

A phisher may use one, several, or large numbers of URLs in a single phishing campaign. We apply rules to our phishing reports to de-duplicate URLs and to analyze hostname, URL path composition, target, and abuse report dates for similarities to obtain sets of URLs that we consider to be involved in one phishing attack. We also apply additional rules to group URLs into attacks based on observed cases.

Table 1 shows the twenty hosting networks with the highest numbers of reported phishing attacks.

Ranking of Hosting Networks (ASNs) by Phishing Attacks (November 2021 to January 2022)

Rank AS Name AS number # Routed
IPv4 Addresses
Phishing Attacks ▼ Phishing Attack Score
1 CLOUDFLARENET 13335 2,374,400 30,434 128.18
2 UNIFIEDLAYER-AS-1 46606 1,393,920 18,826 135.06
3 MICROSOFT-CORP-MSN-AS-BLOCK 8075 45,598,720 16,876 3.70
4 NAMECHEAP-NET 22612 93,696 10,850 1158.00
5 GOOGLE 15169 23,098,112 9,532 4.13
6 FASTLY 54113 530,176 8,872 167.34
7 WEEBLY 27647 2,048 5,917 28891.60
8 DIGITALOCEAN-ASN 14061 2,656,512 5,586 21.03
9 AMAZON-02 16509 42,261,760 5,439 1.29
10 SOFTQLOUD-AS - Softqloud GmbH 208006 3,584 4,401 12279.58
11 ASN-QUADRANET-GLOBAL 8100 654,080 4,199 64.20
12 AS-COLOCROSSING 36352 780,800 3,369 43.15
13 BCPL-SG BGPNET Global ASN 64050 435,968 3,135 71.91
14 AWEX - Hostinger International Limited 204915 768 3,068 39947.92
15 OVH - OVH SAS 16276 4,044,800 2,505 6.19
16 CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co. 45102 4,819,968 2,466 5.12
17 AMAZON-AES 14618 16,345,344 2,463 1.51
18 CONTABO - Contabo GmbH 51167 269,824 2,279 84.46
19 HETZNER-AS - Hetzner Online GmbH 24940 2,239,232 1,678 7.49
20 HOSTWINDS 54290 327,424 1,584 48.38

To allow comparison of large and small Hosting Networks (ASNs), we also rank Hosting Networks based on a metric, phishing attack score, which is calculated by dividing the number phishing attacks reported against an ASN by the number of routable IPv4 addresses allocated to that ASN.

Hosting (ASN) Phishing Attack Score = (number of phishing attacks/IP Addresses in ASN) * 10,000

Table 2 shows the top 20 hosting operators based on phishing attack score.

Ranking of Hosting Networks (ASNs) by Phishing Attack Score (November 2021 to January 2022)

Hosting Networks (ASNs) with a minimum of 50,000 IPv4 addresses and 25 phishing attacks

Rank AS Name AS number # Routed IPv4
Addresses
Phishing attacks Phishing Attack Score ▼
1 NAMECHEAP-NET 22612 93,696 10,850 1158.00
2 FASTLY 54113 530,176 8,872 167.34
3 GHOST - G-Core Labs S.A. 202422 54,016 765 141.62
4 UNIFIEDLAYER-AS-1 46606 1,393,920 18,826 135.06
5 CLOUDFLARENET 13335 2,374,400 30,434 128.18
6 PONYNET 53667 63,744 781 122.52
7 AS-HOSTINGER - Hostinger International Limited 47583 121,600 1,388 114.14
8 AS-REGRU - "Domain names registrar REG.RU", Ltd 197695 94,464 972 102.90
9 INMOTI-1 54641 58,368 588 100.74
10 TIMEWEB-AS - TimeWeb Ltd. 9123 57,600 529 91.84
11 CONTABO - Contabo GmbH 51167 269,824 2,279 84.46
12 PEGTECHINC-AP-03 398993 65,536 500 76.29
13 IMH-WEST 22611 56,832 411 72.32
14 BCPL-SG BGPNET Global ASN 64050 435,968 3,135 71.91
15 24SHELLS 55081 103,680 736 70.99
16 ASN-QUADRANET-GLOBAL 8100 654,080 4,199 64.20
17 NFORCE - NForce Entertainment B.V. 43350 80,384 508 63.20
18 ON-LINE-DATA - Zomro B.V. 204601 58,112 319 54.89
19 NOCIX 33387 57,344 290 50.57
20 HOSTWINDS 54290 327,424 1,584 48.38