Double-Edged Sword: An Empirical Study on the Contribution of Cloud Providers in Malicious Infrastructure

Cloud computing offers flexibility and costeffectiveness, but can also be abused for malicious activities. In this study, we conduct an empirical analysis of the cloud infrastructure of malicious (blocklisted) domains, with a focus on three core infrastructural components — web hosting, DNS, and email — and we compare them against a baseline of general domains. Our goal is to assess the rate of abuse targeting these components as they represent fundamental pillars of Internet communication. Leveraging DNS data from OpenINTEL, cloud classification from IP2Location, and a curated ground-truth list of cloud providers, we evaluate the role of major providers in hosting malicious infrastructure. Our results show that malicious domains are increasingly shifting toward partial cloud infrastructure outsourcing, with a strong preference for cloud-based web hosting while avoiding full-stack cloud adoption. We also observe a high degree of diversity of malicious infrastructure deployment across all three components. Finally, our country analysis highlights a growing concentration of malicious hosting activity in the Asia-Pacific region.