ASN Threat Ranking — Most Malicious Networks Worldwide

An Autonomous System Number (ASN) identifies a network operated by a single organization, such as an ISP, cloud provider, or enterprise. This ranking lists the top 50 ASNs generating the most abuse reports, helping security teams prioritize network-level threat mitigation and understand where malicious traffic originates.

Rank ASN Organization Abuse Reports Malicious IPs Countries
1 AS0 None 20,992,041 19,126,770 113
2 AS14061 DigitalOcean, LLC 11,616,152 638,938 10
3 AS4134 Chinanet 10,814,607 601,184 1
4 AS396982 Google LLC 7,263,714 223,086 33
5 AS4837 CHINA UNICOM China169 Backbone 5,780,714 345,513 3
6 AS8075 Microsoft Corporation 5,155,814 144,362 35
7 AS16509 Amazon.com, Inc. 4,905,341 812,479 41
8 AS45102 Alibaba US Technology Co., Ltd. 3,714,563 114,448 15
9 AS206092 Internet Utilities Europe and Asia Limited 2,395,470 26,232 40
10 AS14618 Amazon.com, Inc. 2,232,533 168,764 3
11 AS4766 Korea Telecom 1,861,928 78,169 1
12 AS152194 CTG Server Limited 1,847,932 268,739 7
13 AS132203 Tencent Building, Kejizhongyi Avenue 1,614,244 76,780 12
14 AS55933 Cloudie Limited 1,558,419 162,767 13
15 AS16276 OVH SAS 1,534,232 108,443 25
16 AS3462 Data Communication Business Group 1,427,994 68,597 1
17 AS200373 3xK Tech GmbH 1,383,344 63,213 13
18 AS37963 Hangzhou Alibaba Advertising Co.,Ltd. 1,380,504 146,323 1
19 AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED 1,354,475 31,194 20
20 AS63949 Akamai Connected Cloud 1,285,437 55,343 16
21 AS62240 Clouvider Limited 1,250,871 43,882 49
22 AS6939 Hurricane Electric LLC 1,157,221 9,695 7
23 AS9541 Cyber Internet Services Pvt Ltd. 1,084,716 22,131 4
24 AS212238 Datacamp Limited 1,076,169 91,513 134
25 AS23969 TOT Public Company Limited 1,055,521 37,185 1
26 AS51167 Contabo GmbH 1,026,159 38,870 3
27 AS8151 UNINET 1,015,982 46,728 1
28 AS25369 Hydra Communications Ltd 993,357 11,727 10
29 AS5483 Magyar Telekom Plc. 988,244 129,685 2
30 AS137409 GSL Networks Pty LTD 969,266 26,815 67
31 AS17789 CNCGROUP IP network of ShangHai IDC 918,314 130,560 1
32 AS327839 Woolworths(Proprietary) Ltd 908,145 125,424 1
33 AS701 Verizon Business 903,263 71,342 1
34 AS9808 China Mobile Communications Group Co., Ltd. 879,508 37,614 1
35 AS24940 Hetzner Online GmbH 872,195 63,823 4
36 AS262287 Latitude.sh LTDA 850,840 117,872 21
37 AS211298 Driftnet Ltd 849,052 2,568 2
38 AS14962 NCR-252 846,299 65,537 1
39 AS7552 Viettel Group 844,679 60,460 1
40 AS137951 ASLINE LIMITED 843,712 65,287 2
41 AS9009 M247 Europe SRL 839,117 108,524 132
42 AS48589 Tiger Network Limited 797,522 66,472 2
43 AS36352 HostPapa 756,965 90,982 6
44 AS45090 Shenzhen Tencent Computer Systems Company Limited 747,123 86,113 1
45 AS31898 Oracle Corporation 736,252 62,860 27
46 AS213412 ONYPHE SAS 708,589 2,560 4
47 AS396356 Latitude.sh 703,106 43,249 19
48 AS45899 VNPT Corp 695,271 108,122 1
49 AS1267 Wind Tre S.p.A. 683,528 21,108 1
50 AS9829 National Internet Backbone 679,726 116,655 1

What is an ASN?

An Autonomous System Number (ASN) is a unique identifier assigned to a network or group of networks managed by a single organization under a common routing policy. Every ISP, cloud provider, and large enterprise has one or more ASNs. For example, Amazon Web Services operates AS16509, and Cloudflare operates AS13335. When a large volume of abuse reports originate from a single ASN, it may indicate compromised infrastructure, bulletproof hosting, or inadequate abuse handling within that network.

How to Use ASN Threat Data

Network-level blocking: Instead of blocking thousands of individual IPs, firewall administrators can block or rate-limit entire ASNs known for persistent abuse. This is far more efficient and covers new IPs as they appear within that network.

Monitoring and alerting: SOC teams can set up alerts when traffic from high-risk ASNs increases, indicating potential attack campaigns. Tracking ASN-level trends over time reveals which networks are improving their abuse handling and which are deteriorating.

Threat intelligence enrichment: Integrating ASN reputation data into SIEM and SOAR platforms allows automated risk scoring. An IP from a high-risk ASN can be automatically escalated for review, while IPs from well-managed networks receive lower priority.

ASN Intelligence Overview Country Threat Ranking Country Risk Trends Top Malicious IPs Live Threat Map