Who controls the routes and the hosting?

6 networks carry half of all domains

232 carry ninety percent. The remaining 52,431 networks share what is left. Concentration this steep means a single operator's policy decision reaches more of the web than most governments' do.

322.6M attributable domains across 52,663 networks, as of 2026-09-24.

6
no prior period

Networks carrying half of all attributable domains

6 of 52,663 networks observed carrying domains

Source: Datazag · as of 2026-09-24

What is ASN?
5

companies carry half, once networks run by the same operator are grouped

322.6M attributable domains across 52,663 networks

Source: Datazag · as of 2026-09-24

232
no prior period

Networks carrying ninety per cent of attributable domains

232 of 52,663 networks observed carrying domains

Source: Datazag · as of 2026-09-24

What is ASN?
52,663

networks observed carrying at least one domain

322.6M attributable domains

Source: Datazag · as of 2026-09-24

The tail is long and carries almost nothing

232 networks reach ninety percent; the remaining 52,431 share the last tenth. Log axis — each gridline is ten times the last.

Source: Datazag concentration artifactas of 2026-09-24322.6M attributable domains across 52,663 networks

Half of everything is reached at network 6, before the curve has left the first gridline.

Ninety percent is reached at 232. The curve is nearly flat from there.

The remaining 52,431 networks divide the last tenth between them.

The top 15 networks carry 62.8% of all domains

Domains carried is not traffic, revenue or importance: a hosting network with millions of small sites outranks one carrying a handful of enormous ones. The largest are named; the rest of the curve is not.

The 15 networks carrying the most attributable domains

#NetworkKind of businessCountryDomainsCumulative
1AmazonAS16509Hosting & CloudUS76.7M23.8%
2CloudflareAS13335Cloud & CDNUS46.4M38.1%
3IONOSAS8560Hosting & CloudDE10.9M41.5%
4HostingerAS47583Hosting & CloudCY9.8M44.6%
5SquarespaceAS53831Hosting & CloudUS9.6M47.5%
6NamecheapAS22612Domain RegistrarUS8.0M50.0%
7WixAS58182Hosting & CloudIL7.8M52.4%
8AmazonAS14618Hosting & CloudUS7.6M54.8%
9OVHcloudAS16276Hosting & CloudFR5.7M56.5%
10HetznerAS24940Hosting & CloudDE5.6M58.3%
11GoogleAS396982Hosting & CloudUS3.6M59.4%
12OracleAS31898Hosting & CloudUS2.8M60.3%
13SedoAS47846Domain ParkingDE2.8M61.1%
14LinodeAS63949Hosting & CloudSG2.7M62.0%
15StratoAS6724Hosting & CloudDE2.7M62.8%
Source: Datazagas of 2026-09-24322.6M attributable domains across 52,663 networks

Hosting & Cloud operators carry 68.2% of attributable domains

The next largest class, cloud & cdn, carries 16.0%. Grouping by what the operator actually is, rather than by network, is what separates a concentrated market from a merely large one.

Across 1,383 cataloged networks.

Attributable domains by the kind of business running the network

ClassOperatorsNetworksDomainsShare of corpus
Hosting & Cloud818895219.9M68.19%
Cloud & CDN91451.5M15.96%
Domain Registrar193120.3M6.28%
Network & ISP39743711.7M3.63%
Domain Parking569.7M3.01%
Source: Datazagas of 2026-09-241,383 cataloged networks

Counting networks understates it

A company is not a network. 73 of the 1,325 cataloged operators run more than one, the largest of them 11 — which is why 5 companies reach half where 6 networks do.

What is ASN?

What the head actually means

Two networks carry 38.1% of attributable domains between them, a hundred carry 83.5%. Domains with no corporate relationship routinely share an operator, an abuse policy, and a failure mode.

It cuts both ways: at this density a shared network on its own is weak evidence.

Routing hygiene

58.3% of prefix announcements carry no signed origin claim

41.2% are authorized by a ROA and 0.48% contradict one. The unsigned majority is not the same population as the contradicted minority, and the two are never summed.

Our own BGP collection, cross-referenced with public RPKI data. Per announced prefix, as of 2026-09-24.

Most announcements are unsigned rather than wrong

Whether a covering ROA authorizes each prefix's observed origin AS.

Source: Datazag BGP collection, cross-referenced with public RPKI dataas of 2026-09-241.2M IPv4 prefix announcements in intel.prefix_intel

Reading the three states

Reported separately, never summed. Valid and not-found are both ordinary; invalid, at 0.48%, is where a published claim and an announcement disagree.

What is RPKI?

The figures

Free to quote with attribution.

1.2M
+475 since 2026-09-23

Distinct IPv4 prefixes observed

1,171,358 of the Datazag BGP collection

Source: Datazag · as of 2026-09-24

What is an IP prefix?
79,192
-62 since 2026-09-23

Networks observed announcing address space

79,192 of the Datazag BGP collection

Source: Datazag · as of 2026-09-24

What is ASN?
41.19%
no prior period

Prefix announcements with a valid RPKI ROA

483,931 of 1.2M IPv4 prefix announcements in intel.prefix_intel

Source: Datazag · as of 2026-09-24

What is RPKI?
58.33%
-0.01pp since 2026-09-23

Prefix announcements with no covering ROA

685,275 of 1.2M IPv4 prefix announcements in intel.prefix_intel

Source: Datazag · as of 2026-09-24

What is RPKI?
0.48%
+0.01pp since 2026-09-23

Prefix announcements that are RPKI-invalid

5,677 of 1.2M IPv4 prefix announcements in intel.prefix_intel

Source: Datazag · as of 2026-09-24

What is RPKI?
Routing anomalies

97.41% of prefixes announced by more than one network are stable multi-homing, not hijacks

Counted naively, every prefix announced by more than one network looks suspicious: 194,872 of them in our collection. Excluding those whose multi-origin announcement has held for more than 30 days leaves 4,592 hijack candidates (0.39% of prefix announcements) — small enough to investigate rather than to headline.

97.41%
-0.17pp since 2026-09-23

MOAS prefixes that are stable multi-homing, not hijacks

189,823 of 194,872 MOAS prefixes observed

Source: Datazag · as of 2026-09-24

What is MOAS?
4,592
+316 since 2026-09-23

Prefixes flagged as hijack candidates

4,592 of 1.2M IPv4 prefix announcements in intel.prefix_intel

Source: Datazag · as of 2026-09-24

What is BGP hijacking?

Query these statistics directly

Every figure on this page is served as Parquet. Same format as the corpus itself.

SELECT * FROM read_parquet('https://observatory.datazag.com/observatory_statistics.parquet');