Abstract: Techniques for a service provider network to automatically mitigate malicious activity by an internet protocol (IP) address in a cloud computing environment are discussed herein. A system can detect malicious data hosted by the IP address and determine whether or not to allow subsequent data exchanges by the IP address. In some examples, the system can validate an impact to a resource, a service, a network, or other entity of a service provider in the cloud computing environment. The system can determine whether to block the IP address based on the validated impact to the resource, the service, the network, or the entity. The system can determine an action for a particular IP address to reduce or eliminate exploitation, disruption, and/or data theft, by a threat actor hosting a botnet attack.