New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Top Source ASNs Behind DDoS Attacks — Cloudflare’s Q1 2025 DDoS Threat Report
Motion3549
Member
in News
In 2025 Q1, the German-based Hetzner (AS24940) retained its position as the largest source of HTTP DDoS attacks. It was followed by the French-based OVH (AS16276) in second, the US-based DigitalOcean (AS14061) in third, and another German-based provider, Contabo (AS51167), in fourth.
Comments
thankyou
I read the whole article.
Besides tech, Cloudflare is smart enough to use 'China Taiwan' in its Chinese version, while 'Taiwan' in other languages.
They probably hire a professional translator who is also a technical writer.
For your convenience, listed in order (worst at the top):
Note: These are the major sources of http(s) attacks. Gladly all of them (AFAIK) are hosters and not ISPs, so simply blocking them should do the trick in many (most?) cases.
Too bad ASN blacklisting doesn’t work with UDP attacks since the IP can be spoofed. Definitely useful for protecting HTTP servers though.
Since there’s a bunch of OVH people here, does anyone know how one can blacklist an ASN on OVH’s firewall?
AS200373 is a proxy provider. The most abusive ASN I've ever personally seen.
More than CHINANET?
Hahaha didn’t even have to search up that ASN to know what is it. 3xK, the notorious proxy provider everyone uses.
what exactly is their business?
all service provider should block that asn for network safety
They're infiniteproxies.com. They're pretty much who everyone resells.
Why is Hetzner always at the top of that list? They have a rigorous KYC process and they send you notices if they detect any kind of abuse (port scan, outgoing DDoS, open/vulnerable ports, etc.). That is, unless the IPs were spoofed.
IPs can be spoofed on UDP, but it’d be a weird pick to use a Hetzner IP. Anyone with an upstream firewall that has no business with a Hetzner server can just drop all packets from a Hetzner IP and call it a day.
The first few at the top of the list are significantly less expensive then the other hyperscalers, also there're many resellers (of dedi's as well as vps). Even though Hetzner or OVH strictly do KYC, in general they're quite liberal and accept if there's no super red flags.