A datacenter proxy routes traffic through a server in a cloud or hosting data centre, so the website or service on the other end sees the server's address instead of the real sender's. Datacenter proxies are cheap, fast and easy to rent by the thousand, which makes them a favourite for scanning, scraping and password guessing. This guide explains how they work, what they did to our honeypot sensors, and how to detect and block them without cutting off legitimate traffic, with 31 days of data from Whatoblock Heartbeat and our sensors, 7 October to 6 November 2026.
The short version
- What it is: a proxy running on a cloud or hosting server, not on a home or mobile connection.
- How big it is: Whatoblock Heartbeat tracked 33.843 datacenter proxy addresses in 31 days, in 1.932 networks.
- Why they are easier to block: the 10 largest networks hold 65% of those addresses. One network alone holds 41%.
- What they do: the datacenter proxy addresses that attacked our sensors sent 3.779 attack events each, against 2.372 for the average attacker, mostly password guessing on remote desktops.
- What to do: block known datacenter proxy addresses everywhere, and block whole hosting networks only on services real users never reach from a data centre.
What is a datacenter proxy?
A proxy forwards requests on someone's behalf, so the destination sees the proxy instead of the client. Most proxies speak the web's HTTP protocol or SOCKS5, a general purpose proxy protocol.
A datacenter proxy runs that service on a server rented from a cloud or hosting provider. Proxy sellers rent them in pools, often rotating through many addresses so each request appears to come from a different server. Attackers like them for the same reasons everyone else uses the cloud: they are cheap, they have fast connections, and new ones can be started in minutes.
The weakness is just as clear. A datacenter address belongs to a hosting company, not to a household, and anyone can look that up. AWS's own documentation notes that web hosting and cloud providers are less likely to be the source of real users' traffic.
Datacenter, residential and ISP proxies
| Type | Where the address lives | How hard to block |
|---|---|---|
| Datacenter | Cloud and hosting servers | Easier: a few hosting networks hold most of them |
| ISP or static residential | Addresses that appear residential but are hosted in data centres | Medium: few networks, but they look like home users |
| Residential | Home broadband and mobile connections | Hard: spread over thousands of networks and shared with real users |
The full comparison, with the residential side of our data, is in our guide what is a residential proxy.
What 31 days of datacenter proxy data shows
Whatoblock Heartbeat tracked 33.843 datacenter proxy addresses in 31 days, in 1.932 networks and 135 countries. The United States hosted 19.661 of them, 58% of the 33.843.
Datacenter proxy addresses by network.
- One network stands out. ASN-FEIT held 13.970 addresses, 41% of all datacenter proxy addresses we tracked. Large clouds and hosting companies follow far behind: DigitalOcean (1.897), Akamai (1.628), The Constant Company (987), Oracle (890) and Amazon (541).
- That concentration is the defender's advantage. The 10 largest networks hold 65% of the list. For residential proxies, the 10 largest networks hold only 14%:
Share of all listed addresses held by the 10 largest networks in each category.
- The line with residential proxies blurs. 9.384 of the 33.843 datacenter proxy addresses (28%) were also offered as residential proxies in the same 31 days, 6.054 of them in ASN-FEIT. That is the grey zone sold as ISP or static residential proxies: hosted in a data centre, presented as a home connection.
The live datacenter proxy ranking shows the networks carrying the most proxy addresses right now.
Few attackers, heavy traffic
We compared the list with every address that attacked our honeypot sensors in the same 31 days. Only 1.349 of the 997.591 attacking addresses were datacenter proxy addresses, but each of them was busy:
Attack events per attacking address on our sensors.
- 5.097.994 attack events came from those 1.349 addresses, 3.779 each. Residential proxy addresses sent 133 each: they spread out, datacenter proxies hammer.
- Remote desktops took most of it. VNC received 3.585.412 of their events (70%) from 239 addresses, and RDP 1.214.703 from 47. Thousands of attempts from one address are the signature of automated password guessing.
- They probed widely. Datacenter proxy addresses also tested HTTP proxies (335 addresses), web servers (333), Elasticsearch (141) and Docker (112).
- They are rarely infected devices. Only 13 of them delivered botnet malware and 2 were C2 servers. Datacenter proxies are rented infrastructure, not hijacked homes.
Hosting networks carry most attack traffic
The bigger picture goes beyond proxies. Every one of the 10 networks that sent the most attack traffic to our sensors in these 31 days is a hosting provider:
Attack events on our sensors by network, research scanners excluded.
Together they sent 1.037.224.751 of 2.355.183.110 attack events (44%), after excluding known research scanners. MEVSPACE alone sent 283.619.997 events from just 266 addresses. The ranking shows where attack traffic was hosted, not who is behind it. Hosting providers serve many legitimate customers alongside rented or compromised servers.
Others see the same pattern:
- Bots. Cloudflare found that networks of Amazon Web Services, Google Cloud and Microsoft Azure together originated about 30% of all the bot traffic it observed in 2025, good and bad.
- DDoS. In Cloudflare's report for the second quarter of 2025, "9 out of 10 ASNs listed offer virtual machines (VMs), hosting, or cloud services" among the top sources of HTTP DDoS attacks. Cloudflare estimates such botnets of rented servers to be up to 5.000 times stronger than botnets of infected IoT devices.
- Web attacks. Fastly reported that "Cloud Hosting providers are the primary sources of attack traffic".
How attackers use datacenter proxies
- Password guessing and credential stuffing. Rotating through many proxy addresses gets around per address rate limits. The New York Attorney General's guide on credential stuffing tells businesses to consider blocking or throttling "Requests that originate from virtual private server providers such as Amazon Web Services or commercial data centers."
- Scanning. Rented servers scan the internet for open services at high speed, as our data shows.
- Scraping and scalping. Bots collect prices and content, or buy tickets and limited goods past per customer limits. A 2025 FTC complaint alleges ticket resellers used "rotating IP proxy services" to hide their real addresses from Ticketmaster.
- DDoS. A few thousand rented virtual machines can outgun a botnet of millions of infected devices.
- Hiding the real origin. Even residential proxy services run their infrastructure on rented servers.
How to detect a datacenter proxy IP
Owning datacenter address space and acting as a proxy are different things, so combine signals:
- Who owns the address. Every address belongs to a network (an ASN) registered to a company. Hosting and cloud companies are easy to recognise.
- Published cloud ranges. AWS, Google Cloud, Microsoft Azure and Oracle publish their address ranges. Microsoft warns that its AzureCloud range includes "IPs used by other Azure customers", so treat cloud ranges as "hosted somewhere", not as "trusted".
- Reverse DNS. Many cloud addresses resolve to provider hostnames that reveal the hosting origin.
- A fresh datacenter proxy list. It tells you which hosting addresses were recently rented out as proxies, which no ownership list can.
- Behaviour. Login attempts across many accounts, no browser behaviour, or request rates no person produces.
Should you block all datacenter IP ranges?
Not everywhere. Legitimate traffic lives in data centres too:
- Good bots. Search engine crawlers, uptime monitors and security scanners run in the cloud. Verify them before blocking, for example with the crawler checks search engines publish.
- Privacy relays and VPNs. Apple's iCloud Private Relay sends many users through shared relay addresses, and Apple asks site owners to treat them like large carrier grade NAT or enterprise addresses.
- Shared cloud space. Cloud addresses are recycled between customers. One study found more than a third of publicly exposed services hosted in the cloud.
- Network level blocks age. A joint 2025 guidance from CISA, the NSA, the FBI and partner agencies warns that blocking an entire network "may unduly impact legitimate traffic", and that abusive hosters can get a new network number "within two to five business days".
A practical split:
- Block known datacenter proxy addresses everywhere. A proxy list targets addresses seen acting as proxies, not whole networks.
- Block or challenge hosting networks on login pages, admin panels, SSH and RDP, where real users connect from homes and offices, not from servers.
- Allow verified bots and your own monitoring before turning on network wide rules.
How to block datacenter proxies
On a firewall. Whatoblock's Datacenter Proxies category is part of every paid blocklist plan, rebuilt every hour from the last 31 days. On 7 November it held 30.785 addresses, or 8.596 entries with /24 aggregation, small enough for any firewall, including older FortiGate models (see our FortiGate threat feed guide). Setup steps for each firewall are on the integrations page and plans on the pricing page.
On Cloudflare. Custom rules can match the network number of the visitor's address (the ip.src.asnum field) on every plan, so you can block or challenge specific hosting networks. Cloudflare's managed lists of open proxies, anonymizers and VPNs require an Enterprise plan.
On AWS WAF. The managed HostingProviderIPList rule blocks addresses "from web hosting and cloud providers" by default. Note that "The IP list does not include AWS IP addresses", so add AWS ranges yourself if you need them covered.
Bulletproof hosting: where datacenter abuse concentrates
Some hosting companies sell to criminals on purpose. Governments call them bulletproof hosting providers, and have acted against several:
- Joint guidance, November 2025. Agencies from the US, Australia, Canada, the Netherlands, New Zealand and the UK describe a bulletproof hoster as a provider "that knowingly and intentionally markets and leases their infrastructure to cybercriminals", increasingly reselling space "from legitimate hosting providers, data centers, ISPs, or cloud service providers".
- US sanctions. The US Treasury sanctioned Zservers in February 2025 for leasing IP addresses to ransomware affiliates, Aeza Group in July 2025, and Media Land in November 2025. In the same November action it sanctioned a UK company that Aeza used "to move its IP infrastructure and evade sanctions".
- EU and Dutch action. The EU sanctioned the web host Stark Industries Solutions in May 2025. In May 2026, Dutch investigators arrested two men and seized more than 800 servers in a case about a web host sanctioned by the EU, whose infrastructure had been moved to a new Dutch company.
- Virtualine. In October 2026, US authorities seized the domain of the bulletproof hoster Virtualine. We covered what its network sent to our sensors in our Virtualine analysis.
Rebranding and moving address space to new companies is why blocks by company name or network number age fast, and why lists of addresses seen misbehaving need constant refreshing.
Frequently asked questions
What is a datacenter proxy?
A proxy server running in a cloud or hosting data centre. It forwards traffic so the destination sees the server's address instead of the real sender's.
Can websites detect datacenter proxies?
Usually yes. The address belongs to a hosting company, which anyone can look up, and many cloud providers publish their address ranges. A fresh proxy list shows which of those addresses were recently used as proxies.
How can I check if an IP address is a datacenter IP?
Look up the network (ASN) the address belongs to and who registered it, check it against the published ranges of the major clouds, and look at its reverse DNS name.
Should I block all datacenter IP ranges?
Not on public websites, because search engine crawlers, monitoring services and privacy relays run there too. Block or challenge hosting networks on logins, admin panels, SSH and RDP, and block known datacenter proxy addresses everywhere.
What is the difference between a datacenter IP list and a datacenter proxy blocklist?
A datacenter IP list covers all address space owned by hosting companies, good and bad. A datacenter proxy blocklist covers only the addresses recently seen working as proxies, so it blocks far less legitimate traffic.
How do I block datacenter IPs in Cloudflare?
Create a custom rule that matches the network numbers of the hosting providers you want to block or challenge, using the ip.src.asnum field. It works on every Cloudflare plan.
Why do attackers still use datacenter proxies if they are easy to detect?
Because they are cheap, fast and plentiful, and many services do not filter them. Our sensors saw datacenter proxy addresses send 3.779 attack events each.
About this data
- Period: 7 October to 6 November 2026, UTC, the same 31 day window the blocklist uses.
- Datacenter proxy addresses: tracked by Whatoblock Heartbeat. Daily counts change strongly with collection, so we report totals only.
- Attacks: every address that sent traffic to our honeypot sensors in the same period. The network ranking excludes known research scanners.
- Botnets: bots and C2 servers identified by IP address.
- Outside sources are quoted as published and linked below. Sanctions and complaints describe allegations by the authorities.
Sources
- AWS WAF, IP reputation rule groups
- Spur, VPN, residential proxy and ISP proxy compared
- Cloudflare Radar 2025 Year in Review
- Cloudflare DDoS threat report, 2025 Q2
- Fastly Network Effect Threat Report
- New York Attorney General, business guide for credential stuffing attacks
- FTC v. Key Investment Group, complaint
- Microsoft Azure service tags and AWS IP address ranges
- Apple, prepare your network for iCloud Private Relay
- Izhikevich et al., Cloud Watching, ACM IMC 2023
- Cloudflare, managed IP lists and the ip.src.asnum field
- CISA and partners, Bulletproof Defense, November 2025
- US Treasury, Zservers sanctions, Aeza Group sanctions and Media Land sanctions
- Council of the EU, Decision 2025/966
- FIOD, arrests for violating sanctions law, 22 May 2026
Check the live data
Open Scanner Recon with the last 24 hours selected.