The Double Standard

Western Providers — 032 Series

Chinese Providers — 031 Series (Comparison)

Two Architectures of Abuse

The series revealed fundamentally different abuse architectures:

The Chinese Model (031): Concentrated. Tencent's AS132203 alone accounts for 76% of all Chinese IPs. High abuse rate (86.2%) but relatively low volume. State-adjacent companies — Tencent, Alibaba, Huawei — with government oversight creating both surveillance capability and, paradoxically, somewhat better abuse control (Huawei at 5.9% abuse rate). The threat is strategic: when abuse happens, it may be state-tolerated or state-directed.

The Western Model (032): Distributed. No single provider dominates — DigitalOcean leads by volume (350 IPs) but OVH leads by hits (1,108). The abuse rate varies wildly: from 33.4% (DigitalOcean) to 90% (SingleHop). Eight providers across US, France, Germany, Canada operate independently with no coordinating oversight. The threat is systemic: it's the absence of coordination, the gap between providers, the overlapping jurisdictions that create the attack surface.

Pattern 1: The Distance Gradient

Consistently across every provider examined, abuse intensity increases with organizational and geographic distance from headquarters:

• OVH: France avg 48.7, Canada 60.7, Poland 63.1
• Contabo: Germany avg 13.6, France avg 52.9 (4× differential)
• Google Cloud: US avg 19.6, Belgium avg 44.9 (2.3× differential)
• DigitalOcean: US avg 17.0, India/Singapore 2× US rate
• OVH founder Octave Klaba's personal IPs: avg 6.7 (clean)

The closer you are to the people who set the policies, the better the enforcement. This is universal across corporate structures, countries, and regulatory frameworks.

Pattern 2: The Acquisition Decay

Every provider with a private equity or acquisition history shows elevated abuse:

• ColoCrossing → HostPapa acquisition: 62.2% abuse rate, Spamhaus-listed
• SingleHop → INAP → Internap Holding LLC: 90% abuse rate, twice-bankrupt, highest avg threat in series (69.7)
• Psychz → Brander Group affiliation: 89.6% abuse rate, RIPE-NCC-HM-MNT on a US provider

When infrastructure changes hands, the compliance team is the first casualty. Abuse policies written by the founder don't survive the first PE fund manager.

Pattern 3: The Campaign Ecosystem

The hassh-14b2ddda386a4d10 botnet (628 IPs, 48 countries, libssh2_1.11.0) appears on every Western provider in this series:

A single botnet draws hosting from all seven providers simultaneously. No one provider can stop it because the campaign exists across all of them. Contabo has its own exclusive campaign (hassh-16443846184eafde) that also cross-contaminated to Google Cloud. The botnets are multi-provider by design.

Pattern 4: The Regulatory Void

Neither US, EU, nor any other regulatory framework addresses hosting abuse as outbound attack infrastructure:

• US: Section 230 protects platforms from liability for user content. No equivalent framework for outbound attacks from user infrastructure.
• EU: GDPR addresses data protection. DSA addresses illegal content. NIS2 addresses critical infrastructure cybersecurity. None address the obligation to prevent VPS infrastructure from being used as SSH brute-force platforms.
• Self-regulation: Abuse desks are cost centers, not profit centers. Response time varies from hours (DigitalOcean) to "an empty void" (FranTech).

The regulatory hole is hosting-shaped: every framework addresses what's on a server (content, data, services) but not what the server does to other servers.

Pattern 5: The Hyperscaler Paradox

The two largest companies in this series — DigitalOcean ($DOCN, NYSE) and Google ($2T market cap) — contribute the most IPs but the lowest per-IP threat:

Scale produces lower per-IP density but massively higher absolute abuse volume. The hyperscaler model: abuse at scale is a rounding error on the revenue line, which means it's never truly urgent.

The Questions Nobody Asks

Q: Why does the cybersecurity industry focus on Chinese and Russian threats while Western infrastructure produces more abuse?

A: Follow the money. The cybersecurity industry is a $200B+ market dominated by Western companies selling to Western clients. The threat narrative — "Chinese APTs, Russian ransomware" — drives purchasing decisions. Nobody buys a $50M security platform to protect against attacks originating from DigitalOcean or Google Cloud. The industry needs an external threat to justify internal spending. The data showing that the call is coming from inside the house is bad for business.

Q: Is the regulatory void around hosting abuse intentional?

A: Consider who benefits. The cloud industry generates $600B+ annually. AWS, Azure, GCP together control >65% of the global market. These companies have extensive lobbying operations in Washington, Brussels, and London. A regulation requiring hosting providers to prevent outbound abuse would impose costs on every cloud provider. The regulatory void isn't an oversight — it's a feature of regulatory capture by the cloud industry itself.

Q: Do Western providers know they host more abuse than Chinese ones?

A: Google literally publishes papers about it (GCAT Threat Horizons). DigitalOcean has a dedicated Trust & Safety team. OVH has a published AUP. They all know. The question isn't knowledge — it's incentive. A compromised VM running a botnet was a paying customer until it got caught. The economic model incentivizes a detection latency just long enough to capture revenue from the attack lifecycle before terminating the instance. Too fast kills revenue. Too slow creates liability. The sweet spot is the gap between "we're working on it" and "we've terminated the account."

Q: What does it mean that the same botnet (hassh-14b2ddda386a4d10) operates across all seven providers?

A: It means the internet's attack infrastructure is provider-agnostic. The botnet operator doesn't care whether the node runs on a $5 DigitalOcean droplet, a €4.99 Contabo VPS, or a Google Cloud instance. They provision where provisioning is easiest. The botnet's distribution across all seven providers is itself a finding: there is no safe provider. The differences between providers are marketing. The shared attack surface is reality.

Q: Does the West hold China to standards it doesn't apply to itself?

A: Yes. The data is unequivocal. 1,028 Western IPs vs 237 Chinese. 525 Western abuse=100 vs 174 Chinese. 4,930 Western hits vs 753 Chinese. When we published 031 documenting Chinese cloud abuse, the numbers were concerning. Now that we've documented Western providers using the same methodology, the same tools, and the same database — the numbers are worse. The mirror shows the face you didn't want to see.