Network Report

AS21859 — Zenlayer Inc

What Predax has observed across this network's address space, and what it means for traffic screening.

Addresses observed
24
100% carried a flag

About this network

Zenlayer Inc (AS21859) is commercial hosting space — servers rented by whoever pays for them, not connections an ISP assigns to homes. Traffic from the 24 addresses we have observed here is almost always software: monitors, API clients, scrapers, and services someone deployed.

Of those addresses, 100% carry the datacenter flag and 4% are known VPN endpoints, and 1 (4%) carried a notable risk score of 40 or higher when last checked. Hosting space is neutral in itself — the same racks hold uptime monitors and credential-stuffing scripts — so the risk share, not the datacenter flag, is the number to read.

Observed
24
distinct addresses checked
Flagged
100%
24 with any threat flag
Notable risk
4%
1 scoring 40+
Countries
14
where addresses geolocate

Flag composition

Share of observed addresses carrying each classification when last checked.

VPN14%
Proxy00%
Tor00%
Datacenter24100%

Geography

Germany
4
United States
4
United Arab Emirates
2
Finland
2
Indonesia
2
Singapore
2
Most-seen cities

Frankfurt am Main (DE) · Dubai (AE) · Helsinki (FI) · Jakarta (ID) · Singapore (SG) · Dallas (US)

Observation window

Addresses on this network have been looked up through Predax between February 10, 2026 and August 31, 2026. Each figure on this page reflects an address's most recent check, not a permanent record.

Geographically, the observed addresses span 14 countries, with the largest share (4 of 24) geolocating to Germany.

Should you screen traffic from this network?

Traffic from hosting space is rarely a person on a browser, so friction here is cheap: rate limits, bot checks and challenges cost you almost no real visitors. Reserve outright blocks for addresses whose individual score justifies it.

Before blocking an address here, check whether it belongs to a service you actually rely on — uptime monitors, payment webhooks and integrations all live in networks like this one.

Addresses observed on this network

A sample of the most-looked-up addresses — each links to its full report. Capped at 12.

Check Another IP