Abuse Density Ranking Clears AWS, Flags DigitalOcean as Worst Offender Per IP

A new analysis of 84,983 sampled IPs from a threat corpus ranks 13 cloud providers by abuse density — flagged addresses per million announced IPs — rather than raw malicious IP counts. When measured by volume alone, AWS, Azure, and GCP appear near the top of abuse lists, mirroring cloud market-share rankings and making the data largely meaningless. Adjusted for their massive IP footprints, the three hyperscalers rank at the bottom of the density table, with AWS recording the lowest abuse density of all 13 providers. DigitalOcean ranked worst on both metrics, with a density index 104.5 times that of AWS, pointing to low-friction, instant-provisioning services as the real driver of abuse. The author argues abuse density reflects a provider's onboarding and pricing friction, not its security posture, and notes that heavier account verification and fraud teams at large clouds make abuse economically costlier for attackers.