Top 50 Bad Hosts - September 2012

Abstract

The #1 Host this quarter for levels of malicious activity is new to the top 50 ranking table – AS40034 Confluence Networks, registered in the Virgin Islands but hosted in the United States.

New names in new places is sadly not a consistent theme for this quarter as, despite the new #1, the “Top 50 Hosts” table for Q3 2012 has more than a fair share of familiar names holding the top positions. Unlike the new #1 (AS40034 Confluence Networks), AS16138 Interia.pl, the holder of the #2 spot, is a regular at the top of the chart for consistently serving some of the worst types of malicious activity on the web. Offences include large amounts of “Current Events”, a mix of the most up-to-date and fast changing attack exploits and vectors.

Interia.pl (registered in Poland) has been in the “Top 10” since Q2 2010, except for its #12 slot in Q2 2011. In Q1 2012 it was #1. Frequently Interia.pl is in the top 5.

So why does Interia remain firmly entrenched at the top of the rankings while others come and go? That is a question that only Interia itself can successfully answer. It is also the reason behind a direct appeal to Interia from HE Editor, Jart Armin, who requests a proactive stance against the flow of abuses:

“Changes to your systems and abuse procedures are long overdue. Please prevent further damage from occurring to the unfortunate and long suffering victims of the individuals or gangs who use your services to carry all manner of Internet malpractices.”

An important topic under discussion in the Q3 2012 report is on the subject of “open resolvers”, “DDoS the World - The Problem with DNS Open & Misconfigured Resolvers”. An area that has yet to fully capture the attention of the media, despite being known about for many years, is the misconfiguration of DNS resolvers or “open resolvers”. This can leave powerful resources vulnerable to being hijacked for the purpose of amplifying of DDoS attacks.

DDoS amplification is used far more frequently now and to devastating effect. By amplifying a DDoS attack a targeted website can be overwhelmed by its power causing system failure and service interruption. An additional benefit to the attackers is the masked origin of the attack. For the first time, HE includes data on Autonomous Systems (ASes) and open resolvers. As research continues, more data on this subject will be detailed in future reports.

Similarly, in the country rankings, there have not been large movements. It is disappointing to see that both the United States and Russia have deteriorated since Q2 in their hosts’ overall standings.

An earlier optimism in an improving situation for the United States has proved to be short-lived with an increase in the number of US hosting providers in the Q3 Top 50 – up to 14 from 12 in Q2. For individual hosts in these countries, it has been more of a mixed picture with gains and losses.

Download

world_hosts_report_201209.pdf
PDF document
English 1.45M Download

Authors

Editor Jart Armin
Contributors Steve Burn
Greg Feezel
Andrew Fields
David Glosser
Niels Groeneveld
Matthias Simonis
Bogdan Vovchenko
Will Rogofsky
Philip Stranger
Bryn Thompson
DeepEnd Research
Reviewers Dr. Bob Bruen
Raoul Chiesa
Peter Kruse
Andre’ DiMino
Thorsten Kraft
Ilya Sachkov

Feedback

We welcome any feedback relating to this paper or assistance in this area of research from the community.

Get in touch.