The Transit Hierarchy

9,972 tracked malicious IPs. 11,064 shared BGP upstream relationships. Every attack packet travels a path — and those paths converge on a surprisingly small number of transit providers.

The top three — Microsoft, DigitalOcean, Google — account for 1,074 malicious IPs. More than 10% of all tracked threats route through infrastructure owned by companies with dedicated security teams, abuse departments, and public commitments to internet safety.

The Legitimacy Paradox

Microsoft's AS8075 hosts 497 malicious IPs with an average threat score of 41.5. This isn't Microsoft being complicit — it's Microsoft being useful. Azure's global infrastructure, instant provisioning, and pay-as-you-go model serves legitimate customers and attackers with equal efficiency.

The economics are clear:

• Hyperscalers (Microsoft, Google, DigitalOcean): 1,074 IPs. Low-to-moderate threat scores (38-42). Attackers use these for scanning, C2, and credential operations. Accounts are disposable — created with stolen cards, used briefly, abandoned.
• Chinese Clouds (Tencent, UCloud, ChinaNet): 553 IPs. Higher threat on Tencent (55.1). Different enforcement jurisdiction. Abuse reports go unanswered across national boundaries.
• Anonymization Networks (TorServers, Unredacted, Emerald Onion): 362 IPs. Lower average threat (22-48). These carry everything — legitimate privacy traffic alongside attacks. By design, they cannot distinguish.
• Bulletproof-tolerant (FranTech, ColoCrossing): 197 IPs. Moderate threat. Known for slow abuse response. Not technically bulletproof, but the next best thing for an attacker on a budget.

The Geography of Transit

The United States hosts 21% of all malicious IPs — not because Americans are more criminal, but because American infrastructure is more accessible. Azure, AWS, GCP, DigitalOcean — the tools that democratized cloud computing also democratized cloud-based attack infrastructure.

The Netherlands punches above its weight: 442 IPs with the highest average threat score (50.6) of any major country. Amsterdam is Europe's peering hub — data center density creates hosting options that attract both CDN customers and botnet operators.

China's paradox: 581 IPs but the lowest average threat (21.6). These are overwhelmingly compromised residential and IoT devices, not rented infrastructure. They participate in botnets unknowingly. The Great Firewall keeps abuse reports out and prevents rapid takedown — creating persistent, low-threat zombie infrastructure.

The BGP Upstream Convergence

11,064 shared BGP upstream relationships map the transit layer — who carries packets for whom. The top upstream clusters (20+ IPs sharing the same transit provider):

Tier-1 providers (NTT, GTT) appear because they carry everything — malicious and legitimate alike. Their presence in the graph is structural, not indicative. But below Tier-1, the clustering becomes informative: M247, Hivane, PacketHub — these are transit resellers that serve hosting companies which serve attackers. The supply chain of connectivity mirrors the supply chain of malware.

The Abuse Contact Theater

11,324 shared abuse phone relationships. When thousands of malicious IPs share the same contact phone number, the contact exists for compliance theater rather than actual abuse handling:

Two entries stand out:

RIPE NCC (+31 20 535 4444): 30 malicious IPs, spanning 12 different ASNs. This is RIPE's general registry number — not an abuse desk. When attackers register IP space and list the regional internet registry as their abuse contact, they're exploiting a system designed for good faith.

Cloud Innovation, Seychelles (+248-4-610-795): 25 IPs spanning 17 ASNs. A Seychelles-registered entity whose phone number appears as abuse contact across seventeen different autonomous systems. This is bulletproof hosting hiding behind a tropical jurisdiction — previously documented in TI-2026-057F as a registration fraud pattern.

The RDAP Registration Layer

11,411 shared RDAP organization links reveal who registers the IP space:

"Private Customer" — 26 malicious IPs registered to a completely anonymous entity. No organization name, no contact beyond the mandatory minimum. This is the WHOIS privacy equivalent for IP space — technically compliant, operationally opaque.

Shadowserver Foundation (23 IPs): Not malicious — these are sinkholed domains and honeypot infrastructure operated by the security research community. Their presence in the malicious graph is a measurement artifact: they attract traffic from infected machines.

ACEVILLE PTE LTD (22 IPs): A Singapore-registered entity operating across multiple Chinese cloud providers. Previously identified in the cross-provider convergence documented in TI-2026-031H.