Mr. Nice Try Notes from the edge

Who rents to the scanners

78% of scanning came from rented servers.

Biggest landlord: Google LLC, with 465,334 probes from 787 of its machines. 1,075 networks sent scanners in all.

Wednesday, Oct 21, 2026 (UTC) · see the latest

Share on X Download the GIF
Cloud Landlords: 78% of scanning came from rented servers.

78%

from hosting

1,075

networks

▼ -2.6% vs the day before

144

countries

▼ -0.7% vs the day before

Top landlords probes
Google LLC 465,334
TECHOFF SRV LIMITED 64,229
TC DATACENTER LIMITED 36,962
Microsoft Corporation 19,443
Amazon.com, Inc. 9,616
↳ Scanners rent. They don't buy.

Every edition: from hosting

Oct 7 Oct 21

How I measure

Probe requests grouped by the network (autonomous system) their IP address belongs to, from DB-IP's free ASN database. "Hosting networks" are clouds and data centres on my list of hosting providers. Country is where the IP geolocates, which for clouds is the data centre, not the person. IP geolocation by DB-IP (CC BY 4.0).

Every landlord in the top 15

Network ASN Hosting? Probes Machines
Google LLC AS396982, AS15169 Yes 465,334 787
TECHOFF SRV LIMITED AS48090 — 64,229 43
TC DATACENTER LIMITED AS218785 — 36,962 19
Microsoft Corporation AS8075 Yes 19,443 362
Amazon.com, Inc. AS16509, AS14618 Yes 9,616 238
M247 Europe SRL AS9009 Yes 6,567 94
DigitalOcean, LLC AS14061 Yes 5,066 783
Datacamp Limited AS60068, AS212238 Yes 4,427 196
F.N.S. HOLDINGS LIMITED AS206092 — 3,704 35
TechTies Inc. AS197170 — 3,623 18
Verizon Business AS5650, AS6167 — 3,199 129
Bucklog SARL AS211590 — 3,090 1
Omegatech LTD AS202412 — 2,902 17
Hydra Communications Ltd AS25369 — 2,287 12
Cloudflare, Inc. AS13335 Yes 1,748 856

Where the servers are

The country each probe's IP geolocates to. For clouds, that's the data centre.

Country Probes Share
US 117,737 18%
AD 64,229 10%
HK 53,390 8%
ZA 41,471 6%
JP 33,633 5%
DE 33,538 5%
NL 31,161 5%
AU 29,441 5%
FR 29,016 4%
CL 27,081 4%

Past editions

Oct 27 Oct 26 Oct 25 Oct 24 Oct 23 Oct 22 Oct 21 Oct 20 Oct 19 Oct 18 Oct 17 Oct 16 Oct 15 Oct 14 Oct 13 Oct 12 Oct 11 Oct 10 Oct 9 Oct 8 Oct 7

A new one every morning.

Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.

More from yesterday

Bot Weather: 48% of yesterday's traffic was scanners.

Bot Weather · Oct 27

48% of yesterday's traffic was scanners.

How much of yesterday's web traffic was scanners, as a weather report.

 Fraud Desk: 457,316 requests got turned away at the door.

Fraud Desk · Oct 27

457,316 requests got turned away at the door.

Login stuffing, failed logins, and who got turned away at the door.

 Most Wanted: Bots' most wanted file: /.env

Most Wanted · Oct 27

Bots' most wanted file: /.env

The files bots asked for most yesterday. It's usually your .env.

 The AI Key Heist: Bots went hunting for AI keys 3,362 times.

The AI Key Heist · Oct 27

Bots went hunting for AI keys 3,362 times.

Bots are hunting for AI API keys. Here's whose they want most.

 Speedrun: New sites get scanned in under a minute.

Speedrun · Oct 27

New sites get scanned in under a minute.

How many minutes a brand-new website gets before the first scanner shows up.

 Costume Party: 71% of "browsers" were bots in costume.

Costume Party · Oct 27

71% of "browsers" were bots in costume.

Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.