Malicious ASNs
The networks that announce the most malicious IP addresses in the Q-Feeds threat intelligence database, and the ones where that abuse is best confirmed. Figures through , refreshed every month.
- 30,578New malicious IP addresses in the last 30 days
- 50ASNs in the ranking
- 9ASNs on the list
Key findings
In the 30 days to , Q-Feeds recorded 30,578 new malicious IP addresses.
AS396982 (GOOGLE-CLOUD-PLATFORM - Google LLC) had the most. Volume mostly follows size: the big cloud and hosting providers rent out millions of addresses, so they carry a lot of abuse and far more legitimate traffic. A high count says little about the network itself.
Confirmed share is the better signal. It looks at how much of a network's activity two or more independent sources reported, with cloud address space discounted. Networks where that share reaches 70% go on the ASN list below; this month that is 9 of them.
Malicious IP addresses by ASN
| Rank | ASN | Network | Country | New malicious IPs, 30 days | Share of total | 90 days | Confirmed share, 90 days |
|---|---|---|---|---|---|---|---|
| 1 | AS396982 | GOOGLE-CLOUD-PLATFORM - Google LLC | US | 3,820 | 12.5% | 4,206 | 10.7% |
| 2 | AS4837 | CHINA169-Backbone - CHINA UNICOM China169 Backbone | CN | 2,954 | 9.7% | 3,768 | 40.8% |
| 3 | AS14061 | DIGITALOCEAN-ASN - DigitalOcean, LLC | US | 1,318 | 4.3% | 1,601 | 16.7% |
| 4 | AS4134 | CHINANET-BACKBONE No.31,Jin-rong Street | CN | 1,041 | 3.4% | 1,226 | 18.2% |
| 5 | AS12389 | ROSTELECOM-AS PJSC Rostelecom. Technical Team | RU | 685 | 2.2% | 750 | 18.8% |
| 6 | AS25369 | BANDWIDTH-AS | GB | 591 | 1.9% | 596 | 76.6% |
| 7 | AS58224 | TCI | IR | 358 | 1.2% | 371 | 15.7% |
| 8 | AS4766 | KIXS-AS-KR-KR - Korea Telecom | KR | 356 | 1.2% | 470 | 50.8% |
| 9 | AS17557 | PKTELECOM-AS-PK Pakistan Telecommunication Company Limited | PK | 284 | 0.9% | 292 | 15.1% |
| 10 | AS9541 | CYBERNET-AP Cyber Internet Services Pvt Ltd. | PK | 279 | 0.9% | 529 | 82.6% |
| 11 | AS132203 | TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue | CN | 254 | 0.8% | 287 | 46.2% |
| 12 | AS16276 | OVH | FR | 245 | 0.8% | 328 | 31.0% |
| 13 | AS3462 | HINET Data Communication Business Group | TW | 242 | 0.8% | 272 | 35.8% |
| 14 | AS9829 | BSNL-NIB National Internet Backbone | IN | 199 | 0.7% | 230 | 23.6% |
| 15 | AS24940 | HETZNER-AS | DE | 188 | 0.6% | 266 | 19.5% |
| 16 | AS7713 | telkomnet-as-ap - PT Telekomunikasi Indonesia | ID | 187 | 0.6% | 207 | 38.1% |
| 17 | AS8151 | UNINET | MX | 183 | 0.6% | 203 | 55.5% |
| 18 | AS8075 | MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation | US | 174 | 0.6% | 221 | 21.9% |
| 19 | AS24560 | AIRTELBROADBAND-AS-AP Bharti Airtel Ltd., Telemedia Services | IN | 160 | 0.5% | 171 | 34.9% |
| 20 | AS37963 | ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd. | CN | 157 | 0.5% | 254 | 50.5% |
| 21 | AS51167 | CONTABO | DE | 156 | 0.5% | 218 | 36.5% |
| 22 | AS17816 | CHINA169-GZ China Unicom IP network China169 Guangdong province | CN | 155 | 0.5% | 186 | 33.3% |
| 23 | AS7552 | VIETEL-AS-AP Viettel Group | VN | 154 | 0.5% | 214 | 44.2% |
| 24 | AS45102 | ALIBABA-CN-NET Alibaba US Technology Co., Ltd. | CN | 148 | 0.5% | 248 | 46.7% |
| 25 | AS3320 | DTAG Internet service provider operations | DE | 146 | 0.5% | 146 | 54.5% |
| 26 | AS36903 | Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM - Office National des Postes et Telecommunic | MA | 131 | 0.4% | 140 | 19.3% |
| 27 | AS45090 | TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited | CN | 116 | 0.4% | 184 | 42.7% |
| 28 | AS14593 | SPACEX-STARLINK - Space Exploration Technologies Corporation | US | 114 | 0.4% | 118 | 49.5% |
| 29 | AS37457 | Telkom-Internet | ZA | 112 | 0.4% | 153 | 44.8% |
| 30 | AS9121 | TTNet - Turk Telekomunikasyon Anonim Sirketi | TR | 112 | 0.4% | 132 | 19.5% |
| 31 | AS17762 | HTIL-TTML-IN-AP Tata Teleservices Maharashtra Ltd | IN | 110 | 0.4% | 125 | 0.5% |
| 32 | AS20473 | AS-VULTR - The Constant Company, LLC | US | 103 | 0.3% | 135 | 32.5% |
| 33 | AS197170 | TECHTIES-AS | SC | 102 | 0.3% | 254 | 56.9% |
| 34 | AS8359 | MTS | RU | 101 | 0.3% | 115 | 38.8% |
| 35 | AS135377 | UCLOUD-HK-AS-AP UCLOUD INFORMATION TECHNOLOGY HK LIMITED | HK | 93 | 0.3% | 126 | 69.0% |
| 36 | AS36352 | AS-COLOCROSSING - HostPapa | US | 91 | 0.3% | 146 | 54.9% |
| 37 | AS18403 | FPT-VN FPT Telecom Company | VN | 89 | 0.3% | 94 | 39.0% |
| 38 | AS22927 | Telefonica de Argentina | AR | 89 | 0.3% | 92 | 24.7% |
| 39 | AS45820 | TTSL-MEISISP Tata Teleservices ISP AS | IN | 88 | 0.3% | 106 | 1.2% |
| 40 | AS9808 | CHINAMOBILE-CN China Mobile Communications Group Co., Ltd. | CN | 84 | 0.3% | 119 | 46.4% |
| 41 | AS398324 | CENSYS-ARIN-01 - Censys, Inc. | US | 84 | 0.3% | 88 | 68.8% |
| 42 | AS33333 | OBJX - objx.net, LLC | US | 84 | 0.3% | 84 | 98.8% |
| 43 | AS23969 | TOT-NET TOT Public Company Limited | TH | 82 | 0.3% | 92 | 38.6% |
| 44 | AS57044 | BRYANSK-AS - JSC _ER-Telecom Holding_ | RU | 82 | 0.3% | 84 | 66.3% |
| 45 | AS7303 | Telecom Argentina S.A. | AR | 81 | 0.3% | 113 | 39.2% |
| 46 | AS31898 | ORACLE-BMC-31898 - Oracle Corporation | US | 81 | 0.3% | 96 | 59.7% |
| 47 | AS27699 | TELEFONICA BRASIL S.A | BR | 81 | 0.3% | 83 | 55.3% |
| 48 | AS45899 | VNPT-AS-VN VNPT Corp | VN | 79 | 0.3% | 89 | 31.8% |
| 49 | AS3209 | VODANET International IP-Backbone of Vodafone | DE | 77 | 0.3% | 87 | 48.9% |
| 50 | AS55836 | RELIANCEJIO-IN Reliance Jio Infocomm Limited | IN | 76 | 0.3% | 84 | 31.6% |
Share is the network's part of all new malicious IP addresses in the last 30 days. Confirmed share is the part of its indicators that two or more independent sources reported over 90 days, with cloud address space discounted; networks with too few indicators to judge show n/a. Country is where the ASN is registered. ASNs with fewer than 10 malicious IP addresses in 90 days are left out.
ASN list
The list holds networks with a confirmed share of at least 70% and at least 50 malicious IP addresses in the last 90 days, the same bar Q-Feeds scoring uses to treat a network as known bad. The plain-text file has one AS number per line and changes with every monthly snapshot.
This is not a block list. Blocking an ASN blocks every customer on it, legitimate ones included, so expect false positives. Use the list as a scoring input: raise the risk of traffic from these networks and alert on it. Block the individual malicious IPs with a feed.
How we measure this
- Source. The Q-Feeds threat intelligence database, which aggregates and scores indicators from more than 2,500 sources.
- What counts. IPv4, IPv6 and CIDR indicators with a malicious or suspicious verdict, mapped to the ASN that announces them. False positives and anything on one of our warninglists are excluded.
- Time windows. An address counts in the window in which we first saw it: the last 30 days and the last 90 days, ending on the snapshot date. The change compares the 30-day count with the figure we published a month earlier. We do not recount older windows: an IP address that stops showing up loses its malicious verdict after about 30 days, so a recount would understate the past and overstate growth.
- Confirmed share. Indicators in the ASN that two or more independent sources reported, divided by all its indicators over 90 days, then reduced by the part of its addresses that sits in known cloud provider ranges. That stops big clouds from looking bad only because attackers rent from them. Networks with fewer than 50 indicators get no confirmed share.
- Updates. A new snapshot is computed in the first days of every month and published here automatically.
Need the IPs themselves?
This page ranks networks, not addresses. Check a single IP in Threat Lookup, or let the Q-Feeds IP feeds keep the malicious addresses out of your firewall, SIEM or TI platform.
Frequently asked questions about malicious ASNs
What is a malicious ASN?
An autonomous system is a network with its own routing policy, identified by an AS number. An ASN gets called malicious when a large part of what it announces is used for phishing, malware command and control, scanning or spam. Few networks are malicious as a whole; most mix abuse with legitimate customers.
Why are cloud providers at the top of the ranking?
Because they are large and anyone can rent a server there in minutes. A high count says more about size than about the provider. The confirmed share column corrects for that, and it discounts cloud address space on purpose.
Can I use this as an ASN blocklist?
We don't recommend it. Blocking an ASN blocks every customer on it, legitimate ones included, so it causes false positives. Use the list as a scoring input: raise the risk of traffic from these networks, alert on it, and block the individual malicious IPs with a feed.
How is ASN reputation measured here?
From the Q-Feeds database alone: how much of a network's activity more than one independent source confirmed over 90 days, with cloud address space discounted. Our own verdicts are not part of the count, so a network's reputation cannot feed back into itself.
Why does this page not list IP addresses?
A public list of live malicious IPs is out of date within hours, and it tells attackers whether they have been spotted. The addresses are in the Q-Feeds threat feeds and in Threat Lookup, where they stay current.
How often is this page updated?
Every month. A new snapshot is computed in the first days of the month, and this page and the text file update automatically.
Can I use this data?
Yes. The figures and the list are published under CC BY 4.0. Reuse them freely, also commercially, with a link to this page as attribution.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Start free