knock-knock.net

Promiscuous Hosting Services

They Could Stop Botnets Fast. They Don't.

August 30, 2026

Set up a new server on the internet and it will immediately be swarmed by scanners and botnets. Some of these bots try to log in via SSH, Telnet, or RDP, while others attempt to break in via HTTP or SMB exploits, and some even try to place unauthorized VoIP toll calls via the SIP protocol. Yes, with a little bit of experience, you can set up your server so that it is less vulnerable (firewalls, Fail2ban, and locking down services are all great techniques). However, it bothers me that hosting services ignore these bad actors and allow them to persist. The fact that people continue to spend time building and operating these botnets is evidence that they work and do real harm. Why don’t hosting services just shut them down?

Measuring the Problem

You can browse the honeypot dashboard by visiting knock-knock.net. On my honeypot network, each server receives approximately 7 to 11 attacks per minute, or 10K–16K per day. Across eight internationally distributed honeypots, the network has collectively recorded more than 14 million attacks in a little over four months.

Navigate to the ISP pane to see the worst offenders by attack count. Near the top of the leaderboard are some names you likely haven’t heard of, such as TechTies and, ironically, Unmanaged Ltd. Some small hosting services are known as “bullet-proof” hosters, because there is little that bad actors might do to get their servers deactivated. Sadly, bullet-proof sounds almost positive, as if the servers themselves are more immune to failure. Instead I refer to these companies as promiscuous hosting services, because… well, they’ll host anyone.

Top ISP leaderboard snapshot from knock-knock.net on August 29, 2026
Top ISP leaderboard snapshot, August 29, 2026. See the current top 100 live at knock-knock.net.

Looking back at the top ISP list by attack traffic, Microsoft, Google, GoDaddy, DigitalOcean, and IONOS also rank highly. It is shocking to see these household names among the worst offenders. All of these are big corporate players who should care far less about the minor loss of revenue than about the damage these botnets are inflicting on their reputations, their legitimate customers, and the broader internet.

Tracking Down the Offenders by IP

OK – say I ran a hosting service and wanted to shut down the botnets on my network. How would I find them? That sounds terribly difficult. Well, actually, it is very easy. I would check whether or not any of the IP addresses that I manage are actually appearing in honeypots. For the knock-knock honeypot, we publish a dirt-simple, free API. For example, this returns the botnet hosts seen on Microsoft’s network:

curl 'https://api.knock-knock.net/check-asn?asn=8075'

The number 8075 above is Microsoft’s network identifier, or ASN. Microsoft, Google, and the others could trivially run such a query every day, find the new botnets, and initiate the process of removing those IPs from their networks. Keep in mind that the vast majority of this traffic arrives over TCP, which requires a completed handshake, so those source IPs can't be spoofed.

The hosters might want to give their customers, say, 24 hours’ notice before removing their servers from the net, or perhaps more practically, automatically flag the customer instance, validate the ongoing abuse, quarantine persistent offenders, and require the customer to remediate the system before restoring network access. After all, many of these attacking hosts aren’t run by bad actors directly; they belong to legitimate customers whose systems got hacked. Notifying the above-board customers of a breach is great customer service. But it is inexcusable not to take fast action. Over the last 4 months, I observed 3,142 Microsoft-hosted attack IPs. An attacking IP remained visible for an average of 39 days; weighting hosts by the number of attacks they generated gives an average lifetime of 48 days. This is far, far too long.

Hey Microsoft and Google – if you don’t want to rely upon the honeypot that I’m running, the source is available at github.com/djkurlander/knock-knock. Set up your own honeypot network! And there are other honeypots out there that can be checked as well. It is so easy to do this, there is no excuse for any reputable hosting service to be promiscuous.

Are Microsoft and Google Really Worse Than Others?

OK, so I’ve been accused of being tough on Microsoft and Google here. They are certainly big players in the hosting space, so perhaps their standing in the Worst Offenders leaderboard is due to their size, and if measured instead as botnets per host, they really aren’t so bad. And that’s actually true. Larger ISPs naturally would float to the top of this list. As they say, just like a septic tank, the big chunks float to the top. But Peter Parker would argue that a more apt saying is that with great power comes great responsibility, and it would be so easy for the big players to put a simple process in place that would substantially reduce bot traffic originating from their networks.

What About Amazon?

Gird your loins: I’m going to say something positive about Amazon. Amazon/AWS may operate the largest cloud hosting infrastructure in the world, and it is currently 32nd on the list. While there is always room for improvement, I am impressed with their relatively low botnet activity. I don’t actually know if they police the bots better or if there are economic or deployment considerations that result in lesser bot traffic, but kudos to them.

Resources