COVID-19: Cloud Threat Landscape
Summary: Unit 42 analyzed 1.2 million newly observed hostnames containing COVID-19 keywords from March 9 to April 26, 2020, and classified 86,607 as high-risk or malicious, an average of 1,767 per day. Of 56,212 cloud-hosted hostnames in AWS, Azure, GCP, or Alibaba, 39,494 (70%) were hosted in AWS and 2,829 were classified high-risk or malicious.
What's compelling: A single Cloudflare IP, 23.227.38[.]64, was tied to more than 150 risky or malicious domains alongside 2,000 benign ones, and one malicious domain resolved to 28 Amazon CloudFront IPs - so IP-based denylisting either misses the threat or takes innocent sites down with it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026