Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

Host Radar mapped 3,900+ active C2 servers across 302 Eastern European hosting providers over three months, surfacing provider-level threat signals—updated after provider feedback.

Host Radar mapped 1,350+ active C2 servers across 98 Middle East providers in a three-month window, breaking down hosting providers, telecom networks and campaigns by country.

Host Radar mapped 1,250+ active C2 servers across 165 Russian providers over three months, with TimeWeb, REG.RU and VDSina hosting the most, and Keitaro, Cobalt Strike and Sliver among top families.

Reviews the Georgia Tech 2013 cyber threat forecast: cloud botnets, mobile browser and wallet flaws, malware obfuscation, counterfeit hardware in the supply chain, and healthcare data risks.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.