Letter E of The Web Siege — a forensic series documenting multi-vector attacks at our Traefik ingress during June 2026.

We’ve documented the attacks: credential harvesters, WordPress ghosts, the reconnaissance spectrum, multi-vector operators. Now we ask the question that binds them all:

Who is providing the infrastructure?

The answer is: the same companies selling you protection against it.

Data: 4,459 unique IPs mapped to ASNs, cross-referenced with SSH honeypot (8,000+ IPs), CrowdSec, MikroTik blocklists, and OSINT vector library. Provider abuse rates calculated across both HTTP and SSH datasets.

Nearly half of all malicious HTTP traffic to our infrastructure originates from three companies: Google, Microsoft, and Amazon. Not from shadowy bulletproof hosts in Moldova. Not from compromised IoT devices. From the three most trusted names in enterprise computing.

This is not a coincidence, a temporary abuse spike, or a few bad actors slipping through. This is structural. It is the predictable outcome of business models that optimize for customer acquisition speed over identity verification depth.

The cloud abuse apologists have a standard response: “At scale, some abuse is inevitable. You can’t screen every customer.”

Apple and Facebook prove this is false.

Apple runs 214 IPs with zero errors. Facebook runs 49 IPs with zero errors. Both operate at cloud scale. Both could theoretically host abusive customers. Neither does — because they verify identity, monitor behavior, and enforce policy.

The difference is not technical capability. It’s business priority. Apple and Facebook don’t sell compute to anonymous credit cards. Google, Microsoft, and Amazon do — because that’s how cloud revenue grows.

🧪 The experiment is conclusive. Zero abuse is achievable at scale. The hyperscalers’ 49–84% abuse rates are not inevitable — they are the result of prioritizing growth over verification. Apple proves it. Facebook proves it. The data is unambiguous.

Free trials are the nuclear weapon of cloud abuse. They reduce the cost of attack infrastructure to literally zero:

Our OSINT library documented the full model: Oracle’s abuse response team handles 200,000 free-tier abuse reports per quarter. That’s 2,200 abuse reports per day, just from the free tier, just from one cloud provider. The attackers create accounts faster than Oracle can close them.

The Meow malware operation runs its entire infrastructure on Google Cloud free credits: scanner VMs, command-and-control servers, and malware distribution — all on $300 of free compute. When the account is suspended, they create another. The operational cost is: one stolen email address per account.

🧮 The math: If each GCP free trial creates one attack account, and each account runs for ~2 months before suspension, maintaining 575 concurrent attack IPs requires ~290 active accounts and ~145 new signups per month. That’s 5 fake accounts per day. Trivially automated.

Below the hyperscalers, two more infrastructure tiers feed the attack economy:

The tiered ecosystem works like a supply chain: Hyperscalers provide the clean IP reputation and scaling. Budget cloud absorbs overflow when hyperscaler accounts get burned. Chinese infrastructure provides persistent low-volume census. Bulletproof hosts (Advin, ColoCrossing) provide the hardened nodes that never go down. Each tier serves a function in the overall attack economy.

Let’s follow the money through a single attack-defense cycle on Google Cloud:

Net result: Google earns $0 from the attacker (free trial) and $15,000+/year from the defender. The attacker is replaced in minutes. The defender’s subscription is annual. The financial incentive is to maintain just enough attack traffic to justify the security products, not to eliminate it.

This is not an accusation of intent. It’s an observation of incentive structure. Google does not need to want attacks to profit from them. The structure does the work.

We have two control samples that define “clean” at scale:

These are not small operations. Apple runs one of the largest private cloud infrastructures in the world. Meta processes billions of requests daily. Both prove that at scale, zero malicious traffic is achievable. The hyperscaler abuse rates are a choice, not a law of physics.

1. Cloud Provider Allowlists Are a Security Vulnerability

If your firewall allows all traffic from Google Cloud, Microsoft Azure, and Amazon AWS — as many enterprise configurations do — you have allowed 1,849 attack IPs through your perimeter. The “trusted cloud provider” allowlist is the most dangerous security assumption in most networks.

2. Cloud Security Products Create a Moral Hazard

When the same company sells you both the attack platform and the defense product, there is a structural incentive to maintain the threat level. This is not a conspiracy theory — it’s an observation about incentive alignment. Insurance companies have this dynamic. Cloud security does too.

3. Free Trials Must Require Verified Identity

The free trial abuse model is the single largest enabler of cloud-hosted attacks. Solutions exist: verified phone number, government ID (as some financial services require), deposit hold on credit card. None of these would eliminate abuse entirely, but any would reduce the 200,000-reports-per-quarter Oracle experience by an order of magnitude.

4. Provider Abuse Rates Should Be Public

If cloud providers published their abuse rates the way car manufacturers publish safety ratings, market pressure would drive improvement. Currently, the abuse rate is a closely guarded secret — estimated only by researchers like us who collect the data independently. Transparency would change the incentive structure.

We call them Cloud Mercenaries because that’s what they are. A mercenary doesn’t choose sides — they provide services to whoever pays. Google Cloud, Azure, and AWS don’t choose between attackers and defenders. They serve both. The attacker’s VM and the defender’s security dashboard run on the same infrastructure, managed by the same company, billed to the same revenue line.

This is the defining feature of 2026 cyber infrastructure: the attack and the defense are products sold by the same vendor.

Meanwhile:

The cloud is not neutral infrastructure.
It is a weapons market with a customer support portal.

Series: TI-2026-046 “The Web Siege” · Letter: E · Classification: TLP:WHITE

Data Sources: Traefik access logs (7-day window) · SSH honeypot (8,000+ IPs) · CrowdSec intelligence · MikroTik address lists · Qdrant OSINT library (15,392 crosslinks) · web-threats behavioral database (4,459 IPs)

Investigation: TI-2026-046E · 5 actors · 6 evidence · 6 findings · 4 connections

← 046D: The Multi-Vector Operators