IPAbuseCheck Stats

Last week, we announced our IPAbuseCheck lookup tool. We see lots of infected/abusive hosts on the Internet attempting to proxy abusive web transactions through our proxies. Rather than just ignoring these transactions, we’ve decided to provide this lookup utility for security professionals and organizations to query and identify abusive/infected hosts within their networks – based on some feedback, the service has been well received. This follow-up post provides a brief summary of the top offenders that we see in our database to date (July 1 – October 25, 2011).

Top Abuse Breakdown by Geography

The top 15 countries account for over 75% of the abusive clients that we have seen- with the US, China, Russia, Germany, Venezuela, and India accounting for half of the abusive clients that we have seen to date.

Top Abuse Breakdown by Organization (ASN)

ASN by Abusive Clients	ASN by Abusive Transactions
ASN % of Clients AS4812 China Telecom 6.32% AS4134 Chinanet 5.16% AS8048 Servicios, Venezuela 3.82% AS4837 CNCGROUP 2.54% AS15857 Telefonia Dialog S.A. 2.53%	ASN % of Transactions AS14618 Amazon.com, Inc. 25.16% AS8069 Microsoft Corp 10.23% AS8075 Microsoft Corp 9.92% AS4134 Chinanet 5.02% AS28753 Leaseweb Germany 4.28%

It was interesting to see some well known organizations like Amazon and Microsoft near the top for organizations that have sent us the most abusive transactions. Rather than these being infected corporate systems, it appears to be a handful of hosting service systems that are being abused either directly from the customer or from an infection. Here is a snapshot of a report from our database of a Microsoft IP that we reported to their Abuse Dept. once we started digging into this data:

70.37.48.163
OriginAS: AS8075
NetName: MICROSOFT-DYNAMIC-HOSTING

Screenshot of 70.37.48.163 Abuse Report

The transactions observed were hundreds of thousands of brute-force attempts against file sharing sites like Megaupload, Hotfile, Filesonic, and Rapidshare.

Top Abuse Breakdown by Client

Clients in our database that have the longest time range of abuse seen tend to be those clients that are scanning the Internet looking for open web proxies. These were the top 5 clients that we have seen with the longest date range from:

Top 5 Abusive Hosts by Date Range

Host	First Seen	Last Seen	Behavior
193.17.253.7	07/01/11 07:00	10/25/11 06:54	Proxy Scanning
207.226.163.146	07/01/11 07:00	10/25/11 06:51	Proxy Scanning
174.34.168.114	07/01/11 07:06	10/25/11 06:57	Proxy Scanning
221.187.4.28	07/01/11 07:07	10/25/11 06:56	Proxy Scanning
69.164.211.212	07/01/11 07:08	10/25/11 06:54	Proxy Scanning

The following table lists the top 5 abusive hosts by transaction count - these tend to be hosts that attempt to forward bulk transactions through proxies, like forum spam and brute-force attempts. Related to the previous section of organizations with the top abusive transactions - you can see that two Amazon EC2 systems (75.101.225.168, 248) are at the top of the list.

Top 5 Abusive Hosts by Transactions

Host	Transaction %	Behavior
75.101.225.168	19.94%	Forum Spam
111.221.81.70	6.31%	Forum Spam
75.101.225.248	5.17%	Forum Spam
117.41.235.133	3.06%	Brute-Forcing
84.16.224.62	2.13%	Brute-Forcing

Top Web Services Targeted in Abuse

The following lists the top 5 most targeted web sites/services abused by number of transactions and number of unique abusing clients.

Top 5 Abused Web Services by:

Abusive Transactions: forum.zing.vn dbol.vn/forum/ forum.sonlaol.vn api.rapidshare.com vdrz.vn/f/

Abusive Clients: chek.zennolab.com login.sina.com.cn clickingagent.com p24.easybitsgo.net checker.samair.ru

The bulk of the top sites by transaction are forum spam sites - in the top instances, the forums being abused are in Vietnam. One brute-forcing target is in the top 5, which is the Rapidshare file host. The bulk of the top services being used/abused by number of clients are proxy checkers - the Chinese service sina.com.cn was also listed in the top as a spam bot / brute-forcing target.

The above post provides some insight into the types of information that can be extracted from this service, and we'll continue to update the database regularly with the latest abusing clients.