14,143 belongs_to relationships. Every malicious IP lives somewhere. The question: in the building, who are the tenants โ and who is the landlord?
Google Cloud hosts 640 malicious IPs. Microsoft hosts 560. They're not the criminals. They're the office complex where criminals rent space.
The Landlords
14,143 belongs_to links map IP address ownership. Unlike registration (who signed the paperwork), belongs_to shows operational reality: which autonomous system announces the prefix, which organization's network carries the traffic.
Top Networks by Malicious IP Residence
| Organization | Malicious IPs | % of Total (9,972) | Character |
|---|---|---|---|
| Google Cloud (AS396982) | 640 | 6.4% | Hyperscaler |
| Microsoft (AS8075) | 560 | 5.6% | Hyperscaler |
| Google (named) | 468 | 4.7% | GCP extended |
| DigitalOcean (AS14061) | 444 | 4.5% | VPS |
| Microsoft (named) | 310 | 3.1% | Azure extended |
| Tencent (AS132203) | 225 | 2.3% | Chinese cloud |
| UCloud HK (AS135377) | 155 | 1.6% | Chinese cloud |
| China Telecom Shanghai (AS4811) | 147 | 1.5% | National ISP |
| TorServers (AS60729) | 142 | 1.4% | Anonymization |
| Amazon/AWS (AS16509) | 137 | 1.4% | Hyperscaler |
| OVH (AS16276) | 137 | 1.4% | French hosting |
| Korea Telecom (AS4766) | 127 | 1.3% | National ISP |
| Amazon/AWS (AS14618) | 125 | 1.3% | Hyperscaler |
| ChinaNet (AS4134) | 124 | 1.2% | National backbone |
| Unredacted (AS401401) | 123 | 1.2% | Privacy/anonymization |
The Big Four cloud providers (Google, Microsoft, Amazon, DigitalOcean) collectively host 2,684 malicious IPs โ 26.9% of all tracked threats. More than a quarter of the internet's attack surface lives in infrastructure operated by four companies with combined security budgets exceeding $10 billion annually.
The Concentration Paradox
This concentration isn't ironic โ it's inevitable. The same properties that make cloud computing efficient for legitimate use make it efficient for attack:
- Instant provisioning: A scanning server spins up in 60 seconds. Burns through credential lists in 24 hours. Gets terminated. Total cost: $0.50. Total damage: thousands of compromise attempts.
- Geographic diversity: Deploy in US-East, EU-West, AP-Southeast simultaneously. Different source IPs, same operator. From the victim's perspective: three different attackers.
- API-driven lifecycle: No human interaction needed. Script creates accounts, deploys VMs, runs attacks, destroys evidence. The abuse team finds empty accounts.
- Shared IP pools: Cloud IPs get reused. Today's attacker becomes tomorrow's legitimate customer on the same address. IP-based blocking hits innocents.
The Chinese Cloud Bloc
Tencent (225), UCloud (155), China Telecom Shanghai (147), ChinaNet backbone (124) โ 651 IPs across Chinese-operated networks. Combined with Hong Kong spillover and ByteDance's Volcano Engine, Chinese-jurisdiction networks host approximately 800+ malicious IPs (8%+ of total).
These networks share characteristics:
- Cross-border abuse reporting is structurally difficult (language, legal jurisdiction, Great Firewall)
- Chinese KYC (real-name registration) applies to domestic users but not international
- Many malicious IPs are compromised residential (ChinaNet, China Telecom Shanghai) not rented cloud
- The cross-provider convergence proves operational unity despite nominal independence
The Privacy Networks
TorServers (142) + Unredacted (123) + Emerald Onion (implied) = 365+ IPs in anonymization infrastructure. These aren't hosting malicious operators โ they're carrying malicious traffic through their exit nodes.
The distinction matters legally and ethically: a Tor exit node operator doesn't choose what traffic passes through their node. They operate infrastructure for privacy. That same infrastructure carries attacks because it carries everything. Blocking Tor exits blocks legitimate privacy traffic alongside the attacks.
But from the honeypot's perspective, these are source IPs of attacks. The 142 TorServers IPs appear in the malicious graph because someone behind them โ hidden by design โ is using anonymization to attack.
Read Between the Lines
14,143 belongs_to relationships. 26.9% in four companies. 8%+ in Chinese networks. 3.7% in anonymization infrastructure. The remaining ~60% is distributed across hundreds of smaller providers, national ISPs, and residential networks.
The long tail is the real problem. The Big Four have abuse teams, automated detection, and economic incentive to maintain reputation. Their malicious IPs are transient โ created, used, terminated within hours. But the long tail โ the DiGi Malaysia IPs, the Vietnamese residential connections, the small German hosters โ has no dedicated security team. Their malicious IPs persist for months.
The building has thousands of tenants. The landlords range from global corporations with security teams to single individuals with 163.com email addresses. The criminal tenants know exactly which landlords check identification โ and which ones don't check at all.
The Thread Forward
TI-2026-053G synthesizes the entire transit map. Six articles, six layers of the infrastructure stack. The conclusion: the internet's attack surface isn't a technical problem โ it's a governance problem. And governance requires consensus that doesn't exist.