An upstream service provider is a larger entity that provides foundational internet infrastructure, bandwidth, or network connectivity to smaller web hosting providers.
In the case where a website and their hosting provider continuously ignore requests to remove content, it may be time to escalate to the web host’s upstream service provider, which often have much stricter polices than their clients.
I like to use bgp.tools to find upstream providers of problematic web hosts, especially because they provide a a real-time view of the path data takes through network providers.
Step 1: Identify the ASN
Search for the website’s IP or domain on bgp.tools. This will give you the Autonomous System Number (ASN) of the host.
If the ASN belongs to Cloudflare or a similar service, you are seeing an anonymizing proxy, and not the host. You must identify the true host first, which can be retrieved over email after submitting a Cloudflare abuse report.
Step 2: View the Upstream Table
Once on the ASN page, click on the “Connectivity” tab.
- The Upstream Table: Scroll to the “Upstreams” section. These list all the upstream service providers that the web host is receiving services from.
- The Connectivity Graph: Visualizes the hierarchy. If a host has multiple upstreams, prepare to contact all of them to prevent the host from simply switching routes.
Step 3: Find the Correct Abuse Contact
Don’t rely solely on the first email address you see.
- WHOIS Data: Look for fields that mention an Abuse contact.
- Surface Web Search: Search for the upstream’s official website. Many providers have dedicated legal/abuse web forms that are processed faster than standard emails.
Step 4: Draft Your Report
When contacting an upstream service provider, your goal is to prove their client is a liability. Be sure include the following:
- Specific Identification: “One of your clients who is receiving upstream services from you, ASN [Number][Name], is hosting illegal NCSEI at the website [Domain].”
- Evidence of Non-Compliance: Attach screenshots showing that you contacted the host and were ignored, which demonstrates that the host is knowingly violating the law.
- Request Call to Action: Ask the upstream to request that their client remove the infringing content.
Sometimes it may take multiple contact attempts for an upstream host to take action on a NCSEI request. Be persistent, and continue to follow up every 3-5 business days.
Unfortunately, some upstream providers cater to bulletproof hosts who intentionally ignore takedown notices. While these providers are difficult to work with, documenting your attempts is vital for building a legal paper trail or for escalating to even higher-level infrastructure providers or legal authorities.
This post was last updated on December 22, 2025.
