[CircleSpokes]

I mean that makes sense no? Attacks like that rely on compromised servers so it shouldn't be a big surprise large hosting provides are among the biggest attackers. Other large ISPs like digital ocean and Alibaba are among the top attackers in that attack also.

I assume this attack is UDP based unlike the one you linked too.

[onphonenow]

Where are the AWS and GCP ranges then?

They aren't even in the top 10 here. Its the claim hetzner is larger than AWS? I find that highly unlikely.

[manishsharan]

We probably don't see AWS or Azure as source if these DDOS attacks because of egress costs.

[viraptor]

People aren't paying with their own money for DDoS machines normally. Well, maybe there are some small operations like that. But often the traffic comes from a hacked service that's a part of a bigger botnet. It may lead to a larger detection ratio on AWS/GCP, but the attackers are not paying the costs.

[vladvasiliu]

Attackers aren't paying with their money, but it's important for them to go undetected. If your bandwidth is a fixed cost (ie isn't related to your actual usage) you are much less likely to keep an eye on it than if it costs an arm and a leg.