One major element of many brand-protection programmes is the use of an algorithm to sort the findings identified through monitoring, according to their relevance or level of potential threat. This prioritisation process offers a number of benefits, including the identification of priority targets for further analysis, content tracking, or enforcement^{1, 2}.

In many cases, prioritisation or ‘threat-scoring’ metrics of this nature will make use of a number of characteristics of the identified websites in question, each of which independently can provide insights of the potential level of threat. These insights are usually based on research into the previous frequency of association of the relevant characteristics with content found to be fraudulent, malicious or infringing. Familiar examples of such characteristics might include the TLD (top-level domain, or domain extension)—with some TLDs found to be disproportionately popular with infringers, based on factors such as domain cost and registration requirements, or the nature of any IP protection programmes offered by the registries³—or the domain registrar (with infringement rates typically found to be dependent on factors such as compliance to enforcement requests)—as per (for example) the registrar ‘bad reputation’ league table published by Spamhaus⁴.

In this article, I consider the hosting characteristics of websites as an indicator of potential threat level, following on from a previous study⁵ looking at the set of (IPv4) IP addresses blacklisted in response to identified use for specific infringing purposes (such as spamming and malware distribution), in a database provided by Myip.ms⁶ (as of January 2025). This previous study explored the creation of a threat-scoring algorithm based on (among other factors) the proximity of the host IP address of a website of interest to other blacklisted IP addresses. Specifically, an IP address was deemed to be of higher risk if it sat in a netblock together with a higher number of blacklisted addresses.

A by-product of this previous analysis was the construction of a table showing those hosting providers which were most frequently found to be associated with blacklisted IP addresses (a list topped by Amazon Technologies Inc. (14,030 blacklisted addresses, out of the full dataset of 169,023), ChinaNet Jiangsu Province Network (7,285), and Cloudflare (3,317)). However, this list does not provide the full picture, as it may simply be the case that the hosting providers associated with the highest number of blacklisted addresses are just the most popular hosting providers generally (in which case, the numbers of blacklisted addresses would not be disproportionate, implying that the hosting provider’s reputation should not be considered to be adversely affected). In this follow-up, therefore, I consider the ‘rates’ of blacklisted IP addresses per hosting provider, by expressing the raw numbers as proportions of the total numbers of IP addresses (actually, an estimate, based on a sampling exercise) with which the providers are associated.

Methodology and analysis

In order to obtain an estimate of the total extent of online presence of each hosting provider, it would ideally be necessary to carry out a host look-up for every IP address in IP-space (from 0.0.0.0 to 255.255.255.255—i.e. 256⁴ (4.3 billion) in total). However, in order to limit the number of look-ups required, a sampling approach was instead used, in which the analysis considered only four equally-spaced IP addresses within each second-level netblock (i.e. 0.0.0.0, 0.0.64.0, 0.0.128.0, 0.0.192.0, 0.1.0.0, 0.1.64.0, etc.). The idea is that this approach should provide a representative sampling of IP-space, and furthermore is reasonable (to some extent) by virtue of the fact that many hosting providers (particularly the major players) will operate large, continuous blocks of IP addresses (such that the sampling exercise will provide a reasonable overview of the activity breakdown).

By way of additional notes:

• Of the 262,144 IP addresses considered, the automated look-ups were unsuccessful in 97,114 cases (37% of the total), comprising a mix of cases where the IP addresses themselves are invalid, or other instances where the look-up was found to time-out or fail. Note that this issue may skew the statistics, if certain regions or hosting providers tend to be disproportionately associated with failed look-ups.
• In the latter stage of analysis, the name of the hosting provider (as given by the look-up) was—as in the previous study—‘cleaned’ by truncating at the first instance of a comma (so that, for example, ‘China Mobile Communications Corporation, Mobile Communications Network Operator in China, Internet Service Provider in China’ is converted to ‘China Mobile Communications Corporation’), which will in many cases produce a more reasonable aggregated dataset, but will also generate some ‘false positives’ (such as hosting providers listed just as (say) ‘Headquarters’ or ‘ZA’), or instances where distinct entities are erroneously aggregated together, such that the final datasets may require some ‘sanity-checking’ and further cleansing. This approach may also generate cases where distinct instances of the ‘same’ entity are treated separately (e.g. ‘Amazon.com’ and ‘Amazon Technologies Inc.’).

From the initial stage of analysis, the top hosting providers generally appearing most commonly in the sampled dataset (i.e. by total numbers) are as shown in Table 1.

For the main stage of analysis, a ‘bad reputation’ or ‘threat’ score was calculated for each of the hosting providers, by dividing the total number of blacklisted IP addresses under their control (from the previous study) by the total number of (sampled) IP addresses under their control (according to the approach outlined in this study), to give an ‘blacklist rate’ score. From this approach, the top ten highest-threat hosting providers are given in Table 2 (with the full list of all hosting providers assigned a blacklist rate score of 10.00 or greater shown in Appendix A).

These results exhibit some parallels with other similar analyses with, for example, three of the top ten also appearing in Scamalytics’ list of top ‘high-risk ISPs’ which achieve risk scores of greater than 52 (out of 100)⁷ (namely: geofeed, score = 62; Strong Technology, score = 60; LogicWeb Inc., score = 56).

It is also noteworthy that some other fairly well-known providers do achieve relatively high blacklist rate scores in this new analysis, including Namecheap (rate = 52.00), Cloudflare (rate = 30.43) and OVH SAS (rate = 20.00). Furthermore, of the top 50 most commonly-appearing (i.e. most popular) hosting providers overall amongst the full sampled set of IP addresses, two (ChinaNet Jiangsu Province Network, rate = 10.95; Amazon Technologies Inc., rate = 2.98) have blacklist rate scores greater than 1.

Conclusion

The analysis reveals the identities of those hosting providers which are disproportionately most frequently associated with blacklisted IP addresses—and, by extension, those which may be most popular with bad actors for hosting infringing or malicious content. Accordingly, the determination that any of these highest-threat hosting providers is associated with any arbitrary identified website therefore provides some indication that—all other factors being equal—the website might be more likely to pose a threat, and thereby be worthy of closer attention.

On this basis, the ‘blacklist rate’ scores for the hosting providers (or some variant of it) could serve as a useful component of an overall threat score for ranking websites. This concept may be useful in the prioritisation of findings identified through brand-monitoring services.

Going forward, more robust future augmentations to this approach could utilise a more intensive analysis (i.e. a less ‘coarse’ sampling) of the full set addresses in IP address space, additional blacklist or threat information, or could be applied to alternative characteristics, such as geographical hosting location (i.e. countries or cities, using geolocation data).

Appendix A: Highest-threat hosting providers by ‘blacklist rate’ score