# Which of our servers connect to cheap cloud hosting providers, and why?

Find out from the connections first, then ask the owner of each server, because most such connections have a boring explanation and a few do not. Legitimate reasons include monitoring and backup services, software update mirrors, a supplier's API, a developer's test machine, or a SaaS vendor that hosts on a budget provider. Worrying signs are the opposite: a server that has no business reason to talk to the internet at all, connections that repeat at fixed intervals day and night, traffic that started after an incident or a new install, and destinations that nobody in the company recognises. Rented virtual servers at low-cost hosts are a common place for attackers' command-and-control and for staging stolen data, precisely because they are cheap, quick and anonymous to rent. Keep the list of expected destinations per server, review it with the owners, and block outbound traffic from servers that do not need it. On every plan, NetSenX shows connections from your hosts with their destinations, and alerts on beaconing and unusual outbound volume, which are the patterns that matter most here.

FAQ: [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) · https://netsenx.com/en/faq/why-do-our-servers-connect-to-cheap-cloud-hosting-providers

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/eu-data-residency

## Related questions

- [Can attackers hide command-and-control inside trusted cloud services?](https://netsenx.com/en/faq/can-attackers-use-trusted-cloud-services-for-command-and-control)
- [How do we tell a legitimate cloud sync from data theft?](https://netsenx.com/en/faq/how-to-tell-a-cloud-sync-from-data-theft)
- [Can we see if a leaving employee uploads company data to the cloud?](https://netsenx.com/en/faq/can-we-see-if-a-leaving-employee-uploads-company-data-to-the-cloud)
- [Can ransomware reach the files we keep in the cloud?](https://netsenx.com/en/faq/can-ransomware-reach-our-cloud-files)
- [Is our SaaS data backed up by the provider?](https://netsenx.com/en/faq/is-our-saas-data-backed-up-by-the-provider)