Which of our servers connect to cheap cloud hosting providers, and why?
Find out from the connections first, then ask the owner of each server, because most such connections have a boring explanation and a few do not. Legitimate reasons include monitoring and backup services, software update mirrors, a supplier's API, a developer's test machine, or a SaaS vendor that hosts on a budget provider. Worrying signs are the opposite: a server that has no business reason to talk to the internet at all, connections that repeat at fixed intervals day and night, traffic that started after an incident or a new install, and destinations that nobody in the company recognises. Rented virtual servers at low-cost hosts are a common place for attackers' command-and-control and for staging stolen data, precisely because they are cheap, quick and anonymous to rent. Keep the list of expected destinations per server, review it with the owners, and block outbound traffic from servers that do not need it. On every plan, NetSenX shows connections from your hosts with their destinations, and alerts on beaconing and unusual outbound volume, which are the patterns that matter most here.