The Latest in IT Security

IPAbuseCheck Stats


Last week, we announced our IPAbuseCheck lookup tool. We see lots of infected/abusive hosts on the Internet attempting to proxy abusive web transactions through our proxies. Rather than just ignoring these transactions, we’ve decided to provide this lookup utility for security professionals and organizations to query and identify abusive/infected hosts within their networks – based on some feedback, the service has been well received. This follow-up post provides a brief summary of the top offenders that we see in our database to date (July 1 – October 25, 2011).
Top Abuse Breakdown by GeographyThe top 15 countries account for over 75% of the abusive clients that we have seen- with the US, China, Russia, Germany, Venezuela, and India accounting for half of the abusive clients that we have seen to date.

Top Abuse Breakdown by Organization (ASN)

ASN by Abusive Clients ASN by Abusive Transactions
ASN % of Clients
AS4812 China Telecom 6.32%
AS4134 Chinanet 5.16%
AS8048 Servicios, Venezuela 3.82%
AS4837 CNCGROUP 2.54%
AS15857 Telefonia Dialog S.A. 2.53%
ASN % of Transactions
AS14618, Inc. 25.16%
AS8069 Microsoft Corp 10.23%
AS8075 Microsoft Corp 9.92%
AS4134 Chinanet 5.02%
AS28753 Leaseweb Germany 4.28%

It was interesting to see some well known organizations like Amazon and Microsoft near the top for organizations that have sent us the most abusive transactions. Rather than these being infected corporate systems, it appears to be a handful of hosting service systems that are being abused either directly from the customer or from an infection. Here is a snapshot of a report from our database of a Microsoft IP that we reported to their Abuse Dept. once we started digging into this data:
OriginAS: AS8075

Screenshot of Abuse Report
The transactions observed were hundreds of thousands of brute-force attempts against file sharing sites like Megaupload, Hotfile, Filesonic, and Rapidshare.
Top Abuse Breakdown by ClientClients in our database that have the longest time range of abuse seen tend to be those clients that are scanning the Internet looking for open web proxies. These were the top 5 clients that we have seen with the longest date range from:
Top 5 Abusive Hosts by Date Range

Host First Seen Last Seen Behavior 07/01/11 07:00 10/25/11 06:54 Proxy Scanning 07/01/11 07:00 10/25/11 06:51 Proxy Scanning 07/01/11 07:06 10/25/11 06:57 Proxy Scanning 07/01/11 07:07 10/25/11 06:56 Proxy Scanning 07/01/11 07:08 10/25/11 06:54 Proxy Scanning

The following table lists the top 5 abusive hosts by transaction count – these tend to be hosts that attempt to forward bulk transactions through proxies, like forum spam and brute-force attempts. Related to the previous section of organizations with the top abusive transactions – you can see that two Amazon EC2 systems (, 248) are at the top of the list.
Top 5 Abusive Hosts by Transactions

Host Transaction % Behavior 19.94% Forum Spam 6.31% Forum Spam 5.17% Forum Spam 3.06% Brute-Forcing 2.13% Brute-Forcing

Top Web Services Targeted in AbuseThe following lists the top 5 most targeted web sites/services abused by number of transactions and number of unique abusing clients.
Top 5 Abused Web Services by:

Abusive Transactions:

Abusive Clients:


The bulk of the top sites by transaction are forum spam sites – in the top instances, the forums being abused are in Vietnam. One brute-forcing target is in the top 5, which is the Rapidshare file host. The bulk of the top services being used/abused by number of clients are proxy checkers – the Chinese service was also listed in the top as a spam bot / brute-forcing target.
The above post provides some insight into the types of information that can be extracted from this service, and we’ll continue to update the database regularly with the latest abusing clients.

Leave a reply


MONDAY, MARCH 01, 2021

Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...



Latest Comments