Which Hosting Providers Harbor the Most Dangerous Websites? An Analysis of 36,000 Domains

Key Findings

• Out of 36,033 classified domains, 5,344 (14.8%) were flagged as problematic — either through automated scan verdicts, admin investigations, or classification as potentially malicious.
• Nearly 38.2% of all standard scans returned a Suspicious or Dangerous verdict.
• Cloudflare hosts the largest absolute number of problematic domains (2,418), though its scale (11,797 domains) means only 20.5% are flagged.
• Tencent stands out with 91.6% bad scan rates — the highest among major providers.
• Scam is the dominant threat category, appearing across 545 problematic domains, followed by phishing (311) and credential harvesting (248).

Methodology

We analyzed 36,033 domain classifications from URLert's database alongside 19,346 completed standard scan results. Each domain was mapped to its hosting provider via ASN (Autonomous System Number) lookups — identifying the infrastructure company serving each domain's traffic.

A domain was considered "problematic" if it met any of three criteria:

1. Scan verdict: At least one standard scan returned DANGEROUS or SUSPICIOUS (4,192 domains)
2. Classification: Classified as POTENTIALLY_MALICIOUS by URLert's domain classification system (1,549 domains)
3. Admin flag: Manually flagged with a WARNING or DANGER admin note (470 domains)

Many domains met multiple criteria simultaneously.

The Verdict Landscape

Across all 19,346 standard scans:

More than 1 in 3 scanned URLs (38.2%) received a Suspicious or Dangerous verdict, indicating a significant proportion of web traffic encounters potentially harmful content.

ASN Hosts: Who Hosts the Most Problematic Domains?

Across 2,561 unique ASN hosts, the top 30 by number of problematic domains are below.

Cloudflare dominates in raw numbers — hosting 2,418 problematic domains — but this is partially a function of its enormous market share (11,797 classified domains). Its 20.5% problematic rate, while concerning, is moderate relative to smaller providers.

Tencent is the most alarming among major providers: 91.6% of all scans for Tencent-hosted domains returned Suspicious or Dangerous verdicts, and 41.8% of its domains are flagged as problematic.

Hostinger and Namecheap — popular budget hosting and domain registration services — show elevated rates at 26.2% and 28.3% problematic respectively, with Namecheap's bad scan rate reaching 63.0%.

The 100% Club: Providers Where Every Scan Is Bad

Among providers with at least 10 scans, the following showed near-perfect bad scan rates:

These providers — often offshore or privacy-focused hosting companies — appear almost exclusively associated with malicious content, functioning effectively as "bulletproof hosting" for bad actors.

Notably, Tencent is the only major-scale provider in this list, with 268 total domains and 119 scans — far larger than the typical bulletproof host, yet maintaining a 91.6% bad scan rate. The geographic pattern is also striking: Hong Kong, Malaysia, Russia, Switzerland, and Lithuania feature prominently — jurisdictions where takedown enforcement can be challenging.

Threat Categories: What Are the Dangers?

Among problematic domains, the most common threat types detected are:

Scam content is the dominant threat, appearing nearly twice as often as phishing. Credential harvesting — fake login pages designed to steal usernames and passwords — affects 248 domains, often overlapping with phishing campaigns.

Admin-Flagged Domains: Human Intelligence

URLert's security team manually flagged 470 domains with WARNING (245) or DANGER (225) admin notes — representing the most heavily investigated sites.

The hosting distribution of these admin-flagged domains:

Cloudflare's dominance here (54.7% of all admin-flagged domains) is notable and disproportionate even relative to its market share. Two operational factors likely drive this concentration:

1. Scam sites that survive abuse reports: A large share of Cloudflare-flagged domains are scam operations — fake shops, deceptive "investment" platforms, misleading subscription traps — rather than classic phishing or malware. Because these sites don't distribute malware binaries or host credential-harvesting forms in the traditional sense, they often don't violate hosting abuse policies clearly enough to be taken down quickly. They stay online for weeks or months, requiring the security team to manually flag them each time they resurface in user submissions.
2. Anti-bot shielding obscures automated detection: Cloudflare's bot protection — designed to defend legitimate sites — inadvertently shields malicious actors as well. When automated scanners are blocked by challenge pages, URLert's security team must manually review and flag these domains, inflating the admin-flagged count relative to providers without similar protections.

These factors compound: threat actors deliberately leverage Cloudflare's free tier, DDoS protection, and domain proxying capabilities to obscure their origin servers — while the platform's own defenses make it harder for security tools to automatically classify the threats hiding behind them.

WIBO Baltic (Lithuania) is noteworthy as a small provider with only 15 total domains yet 5 admin-flagged — a 33% manual flag rate, indicating concentrated human-verified malicious activity.

The Worst Individual Domains

The top individual domains generating the most bad scans:

Patterns in the Top Individual Domains

Dedicated malicious domains like shrinkme.click (99.6%), nowplaytoc.com (100%), and ey43.com (100%) are purpose-built for malicious activity — scam operations and redirect chains.

URL shorteners are heavily abused: tinyurl.com, ln.run, is.gd, and bit.ly all appear in the top results. These services mask destination URLs, making them ideal vectors for distributing phishing and scam links. Of 68 total scans for tinyurl.com, 46 (67.6%) were bad.

Major platforms like google.com, t.co, t.me, outlook.com, and blogspot.com appear due to user-generated content — the scanned URLs are paths within these domains that lead to phishing or scam content, not the platforms themselves. Telegram (t.me) is notable: while only 25.5% of its scans return bad verdicts, it still ranks 8th by absolute bad scan count (38), confirming its role as a distribution channel for scam content.

roblox.com.ge is a typosquatting domain impersonating Roblox, hosted on WIBO Baltic (Lithuania) — every single scan (26/26) returned a bad verdict, flagged for credential harvesting and phishing targeting young gamers.

Conclusions

Data collected April 3, 2026. Analysis covers 36,033 domain classifications and 19,346 standard scan results from URLert's production database. Domain classifications use eTLD+1 (registered domain) granularity. ASN hosting provider is determined via BGP routing table lookups from RouteViews.