Eight Networks Hold 29% of the World's Exposed Server Management. We Checked Them Against Our Own Block Log. They Are Two Completely Different Problems.

This morning we counted 31,325 baseboard management controllers facing the open internet, and argued that the concentration in hosting providers was the finding rather than the noise a census usually asks you to subtract.

Then we asked a question that our own data can answer and most exposure research cannot: are the networks leaking server management interfaces the same networks that attack us?

We have an edge that blocks things and keeps the receipts — 2.9 million block events, each one carrying the ISP of the address that earned it. So we took the eight worst networks for exposed management interfaces and looked them up in our own log.

The answer is no. And the way it is no turns out to be more useful than a yes would have been.

The eight networks

Network	Exposed BMCs	City	Country
HostPapa (AS36352)	1,856	Buffalo, Los Angeles	US
NexonHost (AS3223)	1,640	—	RO
HostDime (AS33182)	1,407	Lockhart, Orlando	US
WholeSale Internet (AS32097)	1,237	Kansas City	US
Contabo (AS51167)	890	—	DE
Tier.Net (AS397423)	819	Dallas, Ashburn	US
Psychz Networks (AS40676)	637	Dallas, Los Angeles	US
EGIHosting (AS18779)	546	Santa Clara	US

9,032 of 31,332 exposed IPMI endpoints — 28.8 percent — in eight autonomous systems. All eight are hosting or dedicated-server providers. Six are American. The United States holds 12,805 of the global total, nearly 41 percent.

Note the cities, because the instinct is to expect somewhere disreputable. Buffalo. Kansas City. Santa Clara. Orlando. Dallas. Ashburn. These are ordinary American datacenter markets. This is not an offshore bulletproof-hosting story and framing it as one would let a lot of people off the hook who should not be.

Now the overlay nobody else can run

Here is the same table against our own edge telemetry — blocked events attributed by ISP, from our infrastructure, over our history.

Network	Exposed BMCs	Blocked events (our edge)	Blocks per BMC
EGIHosting	546	10,849	19.87
Contabo	890	2,119	2.38
HostPapa	1,856	119	0.06
Tier.Net	819	41	0.05
Psychz Networks	637	15	0.02
NexonHost	1,640	0	0.00
HostDime	1,407	0	0.00
WholeSale Internet	1,237	0	0.00

We checked the zeros. Multiple spellings each — Wholesale, WholeSale, wholesaleinternet, Nexon, NexonHost Srl, HostDime.com, hostdime, and the upstream name Voxility. All zero. A false zero from a naming mismatch is the exact failure mode we have burned ourselves on before, so those were verified rather than assumed.

Exposure and hostility are two different populations. The three networks with zero blocked traffic at our edge account for 4,284 exposed management interfaces between them — nearly half the total in this group. The network with by far the most blocked traffic has the fewest exposed BMCs of the eight.

Two problems wearing the same shirt

Class one: quiet and negligent. HostPapa, NexonHost, HostDime, WholeSale Internet. Between them 6,140 exposed management interfaces and almost nothing arriving at our edge. There is no evidence here of these being hostile networks. They look like ordinary hosting businesses shipping a bad default, at scale, for years. The risk to their customers is real but it is inbound — somebody else will find those controllers, and it will not be the provider or the tenant who finds them first.

Class two: exposed and busy. EGIHosting and Contabo. Together 1,436 exposed BMCs and 12,968 blocked events — 98.7 percent of all the hostile traffic in this group, from 16 percent of the exposure.

That combination is qualitatively worse than either half, and the reason is architectural rather than moral. If a network hosts a meaningful volume of traffic that other people's edges are blocking, then somebody with bad intentions can rent a machine there — cheaply, today, with a stolen card. And a tenant inside the network is already past the part of the internet where anyone is watching. The exposed management controllers are not across a perimeter from them. They are neighbours on the same fabric, reachable without ever crossing a boundary that would produce a log entry on anybody's firewall.

An exposed BMC on a quiet network is a door someone has to travel to. An exposed BMC on a network that also rents to the kind of tenant our edge blocks ten thousand times is a door with people already living in the hallway.

EGIHosting is the standout and it inverts the ranking entirely: last in exposure among these eight, first in hostile traffic by an order of magnitude. Nearly twenty blocked events per exposed controller, roughly eight times Contabo's ratio and three hundred times everyone else's. If you ranked this list by raw BMC count you would put EGIHosting at the bottom and look at HostPapa first. Ranked by the risk that actually matters to a tenant, that ordering is exactly backwards.

Why this lands on enterprises specifically

Nobody puts core production on cut-rate bare metal, and pretending otherwise would make this piece dumber than it needs to be.

What goes there is exactly what cheap dedicated servers are good at: staging environments, QA clusters spun up for a load test and never torn down, regional and promotional microsites, subsidiary and acquired-brand properties, media and object storage moved off a hyperscaler to dodge egress billing, and the developer sandbox somebody stood up in an afternoon three years ago.

Every one of those shares two properties. It sits outside the governance perimeter of the primary cloud tenancy — no landing zone, no policy assignment, no central logging, often not in the CMDB at all. And it very often holds credentials that reach production, because a staging environment that cannot talk to anything is a staging environment nobody uses.

So the machines an organisation counts least carefully are disproportionately the ones whose management plane is on the public internet, and disproportionately the ones holding a token that works somewhere that matters. An attacker with BMC access can mount virtual media, reinstall the host, watch the console through boot, and read the disk — underneath the layer where the tenant's tooling is looking, and surviving the rebuild the tenant would perform if they ever got suspicious.

There are public tools that will map famous brands to hosting address space, and running that list would produce a spicier article. We are not doing it. That method routinely attributes an agency microsite, a reseller, a regional franchisee or a decade-old landing page to a parent corporation, and the result would be an accusation we could not defend. The shape is the story. It does not need a brand name attached to be true.

What to do

If you rent dedicated or bare-metal servers, ask your provider in writing: is my server's BMC reachable from the public internet, and what credential is on it. Both answers are yours by right. If it is exposed, ask for it behind their management network or a VPN. A vague answer is a no.

If you are an enterprise security team, this is an inventory exercise, not a scan. Find every hosting relationship the organisation has that is not the primary cloud provider — procurement records, expense reports, corporate cards, DNS pointing at address space nobody recognises. For each, ask whether a BMC exists and whether it faces the internet. You will find relationships nobody remembers opening. That is the normal result and it is the point.

Weight by the second table, not the first. If your forgotten staging box is in a network that also rents to people the rest of the internet is blocking, move it up the queue regardless of how few controllers that provider exposes in total.

If you run your own metal, probe UDP 623 from outside your perimeter across every range you own, then move every controller onto a management VLAN with no internet route. Govern access to that VLAN like physical access to the building, because that is what it is.

If you are one of the eight, you already know your own numbers. The remedy is a default, not a documentation page.

The honest limits, stated plainly

We hold this at 95 percent, and this one needs its caveats stated properly rather than buried.

Our block log is one vantage point. It records traffic that reached our edge and got blocked. A zero in that column means this network has not attacked us. It does not mean the network is clean, well-run, or safe, and nobody should read it that way. We are a small shop with a small denominator; a hosting provider could be a serious problem for the rest of the internet and register nothing with us purely because they never pointed anything our way. Absence of evidence, and all of that.

The Shodan counts are a single afternoon's reading and will drift. A scan samples what answered, not what exists.

ASN attribution identifies who announces the address space, not who operates a given machine inside it. Resellers and downstream customers muddy that considerably. Read the tables as network-level responsibility for a default, not as a verdict on corporate conduct.

The blocks-per-BMC ratio divides two things measured very differently — a global scan against our local log. It is a useful ordering heuristic and it is not a rate of anything real. We are using it to rank attention, not to make a claim about frequency.

What survives all of that is the part with your name on it: roughly nine thousand server management interfaces, eight companies deciding whether they answer the internet, and a much larger number of tenants who were never consulted and would have chosen differently.

And as with this morning: these addresses are not going into our blocklists. They are victims, not threats. An exposure census is a map of who needs help. Shipping it as an indicator feed means our customers block somebody's hospital and call it defense.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com