HostExploit is pleased to present the Q1 2010 report on the Top 50 Bad Hosts and Networks. Using our own data, supplied by SiteVet.com, together with Open Security partners, HostExploit has compiled an updated HE Index of the worst internet hosting players around the world.

Download the report here.

Findings in the report are based on data generated by public ASes (Autonomous Systems) exchanging routing information with each other over the public internet. ‘Bad’ activity in this context includes traffic generated by botnets, spam, MALfi, phishing, malware, exploits and the control centers that manage these activities.

By using a unique combination of actuarially-weighted mathematical equations, a bespoke ‘badness’ rating is created showing the worst hosting organizations for cyber-criminal activity. Consideration is given to the size of each network and related potential for malware distribution where larger servers should have the means to track cyber-criminal activity more effectively.

Organized gangs of cyber criminals avoid detection by other network scoring systems that only track URLs or active domains. For that reason the HE Index is based on a number of respected data sources of varying significance resulting in an easy-to-understand measurement of ‘bad’ activity.

Main Findings:

• Rank #1 in the HE Index is AS29073 Ecatel (NL) seen to be providing bullet proof hosting, spam, exploit servers and infected web sites.
• Rank #2 in the HE Index is AS21740 DemandMedia / eNom (USA) serving a whole raft of assorted badness, including malware, spyware, and spam.
• From a positive perspective – 95% of the 33,410 world’s commercial ISPs, commercial hosts and servers operate effective abuse procedures with a low tolerance for hosting Internet badness.
• Rank #1 in the Top 50 Bad Hosts, has an HE Index of 337.3.
• Rank #50 has an HE Index of 111.1; below rank #1,740 has an HE Index of less than 25.0.
• Disclosure in the first Top 50 Bad Hosts in December 2009 has been helpful for some hosts contacted. In a few demonstrated cases this has resulted in decreases in hosted badness and abuse of up to 90%.

The report explores the implications of criminal involvement and what such activity means in global security terms. As such, it should act as a benchmark for law enforcement agencies, entities monitoring internet crime and the internet community as a whole.

It likewise highlights the need for enforcement of standardized abuse policies and the part that collective community action can play in halting the actions of internet bad players. The recent demise of the server Troyak is an excellent case in example.

To give a balanced view, the report also briefly looks at the best hosting providers around the world, with the aim of benefiting users, webmasters, web developers and the internet community as a whole.