HostExploit is pleased to present the Q3 2010 report on the Top 50 Bad Hosts and Networks. The emphasis this quarter is on the most improved hosts, with many of the worst hosts from the last quarter taking steps to remove cybercriminal activity from their servers.

Download the report here.

Bad publicity damages reputations and can be financially detrimental to business. A sobering dose of bad publicity can result in positive action being taken, as Demand Media have demonstrated since the previous report.

HostExploit is pleased to report that based on the latest ranking in the HE Index, there has been a very favorable improvement in the position of eNom, Demand Media’s registrar arm. The drop in their ranking has only occurred since the extensive media coverage of the malicious activity that was being hosted on eNom’s servers. In the time since, we have witnessed a willingness to ‘clean up’ in cooperation with the security community.

Looking at eNom’s position in detail, their ranking has improved from #1 to #7 – due, largely, to the removal of botnet command & control centers, in particular of the infamous Zeus botnet. Although this is very encouraging, it must be considered that eNom still hosts sites that distribute malware and malicious software which infect some 5,326 third-party websites.

However, as good as it is to see eNom/Demand Media’s improved ranking they are by no means the biggest success story this quarter. For example:

• Former #1 Bad Host (Dec 2009) AS30407 Velcom (Canada) has reduced its badness levels by over 70 per cent in just three successive quarters and has fallen down to #99. This shows considerable effort on Velcom’s part to rid their networks of cybercriminal activities.
• Formerly ranked #9, AS28299 CYBERWEB NETWORKS (Brazil) has dropped to an astonishing #228, in just three months. This has been achieved by cleaning up large quantities of phishing servers and botnet command & control centers. This is a truly impressive result.

These brief examples demonstrate the power of raising public awareness. Badware can seem an intractable issue to some hosts; yet, it is possible for hosting providers to reduce levels of badness in a relatively short period of time.

Why then are hosts such as AS29073 Ecatel (Netherlands) still being ranked as #1 now, having been ranked #2 in Q2 2010 and #1 in Q1 2010? The simple answer is that they continue to be cybercrime friendly, taking cash from illicit activities rather than investing in restricting them.

HostExploit’s study combines its own data with a wide range of respected community sources to produce a comprehensive analysis of badness levels on each of the world’s 35,000+ public Autonomous Systems. The data is processed by SiteVet, an innovative tool that uses unique algorithms to calculate a simple quantitative badness rating out of 1000 (which we call the HE Index) of each AS. Results are further published in tables and charts. With a focus on the worst aspects of cybercriminal activity, the HE Index also takes into account factors such as: size of network; botnet hosting; infection rates; current events; distribution of malware, exploits, rogues and spam.

Comments  

 

+2 # ecatel 2010-10-10 14:29

Ecatel tried to contact you several times regarding your reports but never a reply.

Reply | Reply with quote | Quote

 

 

+1 # sja 2010-10-27 06:55

So the passivity of some hosts allow cybercrime to happen, and sometimes it’s even actually a sort of active support to take cash from it? If the nature of those crimes(1) matches the type of campaign Avaaz is leading, you could try collaborate with them to get mass-petitions sent to thoses hosts…if you deem it worth.
http://avaaz.org/en/
Best greetings and congratulation on your fight.
(1) such as this one : http://www.boingboing.net/2010/10/26/good-news-of-a-kind.html

Reply | Reply with quote | Quote

 

 

-1 # mcp 2010-11-09 02:21

AS41665 HOSTING-AS National Hosting Provider, UA, with 144,384 IP addresses and ranked #4 on the HostExploit Top Bad Hosts report in December 2009 out of 34,000 ASNs (autonomous systems / hosts) compared for serving badness on the Internet. Although in the forthcoming HostExploit Top Bad Hosts report, Hosting UA had demonstrated some improvement over the first quarter 2010 – see forthcoming report, March 2010.

Reply | Reply with quote | Quote

 

 

-1 # mcp 2010-11-09 02:22

The fire that occurred on the second floor Business Center Factory of Business St. Dal’nic’ka 46, Odessa occurred at around 10:00 pm local mcp time on the evening on March 27th 2010. (http://watcher.com.ua). At this time there has not been any official explanation as to the cause of the fire

Reply | Reply with quote | Quote

 

 

-1 # peterg 2010-12-22 16:39

Re: Phishing continues to be a cause for
concern to banks

Well, yes and no. I’ve had quite a few phishing mails this year and the ones that contain graphics look the most convincing. What REALLY P**** ME OFF is that the fact that these same banks STILL allow hotlinking of images from their sites so its a no-brainer for phishers. Despite emails to their “security” departments nothing ever happens. It ain’t rocket science and the customers lose out!

Reply | Reply with quote | Quote

 

 

0 # John Bokma 2012-07-17 17:27

It would really help if the report was not behind a login wall plastered with whining for donations.

Name and shame might work. Now you’re just helping out the hosting providers who make money by looking the other way….

Reply | Reply with quote | Quote

 

 

0 # will 2012-07-18 05:09

Quoting John Bokma:

It would really help if the report was not behind a login wall plastered with whining for donations.

John, all reports in the last year have not required a login.

Reply | Reply with quote | Quote

 

Refresh comments list
RSS feed for comments to this post

Add comment