By: ThreatLabz

IPAbuseCheck Stats

Analysis

Last week, we announced our IPAbuseCheck lookup tool. We see lots of infected/abusive hosts on the Internet attempting to proxy abusive web transactions through our proxies. Rather than just ignoring these transactions, we’ve decided to provide this lookup utility for security professionals and organizations to query and identify abusive/infected hosts within their networks – based on some feedback, the service has been well received. This follow-up post provides a brief summary of the top offenders that we see in our database to date (July 1 – October 25, 2011).

 
Top Abuse Breakdown by Geography
The top 15 countries account for over 75% of the abusive clients that we have seen- with the US, China, Russia, Germany, Venezuela, and India accounting for half of the abusive clients that we have seen to date.

Top Abuse Breakdown by Organization (ASN)
 
ASN by Abusive Clients ASN by Abusive Transactions
ASN % of Clients
AS4812 China Telecom 6.32%
AS4134 Chinanet 5.16%
AS8048 Servicios, Venezuela 3.82%
AS4837 CNCGROUP 2.54%
AS15857 Telefonia Dialog S.A. 2.53%
ASN % of Transactions
AS14618 Amazon.com, Inc. 25.16%
AS8069 Microsoft Corp 10.23%
AS8075 Microsoft Corp 9.92%
AS4134 Chinanet 5.02%
AS28753 Leaseweb Germany 4.28%


It was interesting to see some well known organizations like Amazon and Microsoft near the top for organizations that have sent us the most abusive transactions. Rather than these being infected corporate systems, it appears to be a handful of hosting service systems that are being abused either directly from the customer or from an infection. Here is a snapshot of a report from our database of a Microsoft IP that we reported to their Abuse Dept. once we started digging into this data:

 
70.37.48.163
OriginAS: AS8075
NetName: MICROSOFT-DYNAMIC-HOSTING

Screenshot of 70.37.48.163 Abuse Report
 
The transactions observed were hundreds of thousands of brute-force attempts against file sharing sites like Megaupload, Hotfile, Filesonic, and Rapidshare.
 
Top Abuse Breakdown by Client
Clients in our database that have the longest time range of abuse seen tend to be those clients that are scanning the Internet looking for open web proxies. These were the top 5 clients that we have seen with the longest date range from:

Top 5 Abusive Hosts by Date Range
Host First Seen Last Seen Behavior
193.17.253.7 07/01/11 07:00 10/25/11 06:54 Proxy Scanning
207.226.163.146 07/01/11 07:00 10/25/11 06:51 Proxy Scanning
174.34.168.114 07/01/11 07:06 10/25/11 06:57 Proxy Scanning
221.187.4.28 07/01/11 07:07 10/25/11 06:56 Proxy Scanning
69.164.211.212 07/01/11 07:08 10/25/11 06:54 Proxy Scanning
 

The following table lists the top 5 abusive hosts by transaction count - these tend to be hosts that attempt to forward bulk transactions through proxies, like forum spam and brute-force attempts. Related to the previous section of organizations with the top abusive transactions - you can see that two Amazon EC2 systems (75.101.225.168, 248) are at the top of the list.


Top 5 Abusive Hosts by Transactions
Host Transaction % Behavior
75.101.225.168 19.94% Forum Spam
111.221.81.70 6.31% Forum Spam
75.101.225.248 5.17% Forum Spam
117.41.235.133 3.06% Brute-Forcing
84.16.224.62 2.13% Brute-Forcing
Top Web Services Targeted in Abuse
The following lists the top 5 most targeted web sites/services abused by number of transactions and number of unique abusing clients.
 
Top 5 Abused Web Services by:
Abusive Transactions:
  1. forum.zing.vn
  2. dbol.vn/forum/
  3. forum.sonlaol.vn
  4. api.rapidshare.com
  5. vdrz.vn/f/
Abusive Clients:
  1. chek.zennolab.com
  2. login.sina.com.cn
  3. clickingagent.com
  4. p24.easybitsgo.net
  5. checker.samair.ru

The bulk of the top sites by transaction are forum spam sites - in the top instances, the forums being abused are in Vietnam. One brute-forcing target is in the top 5, which is the Rapidshare file host. The bulk of the top services being used/abused by number of clients are proxy checkers - the Chinese service sina.com.cn was also listed in the top as a spam bot / brute-forcing target.

 
The above post provides some insight into the types of information that can be extracted from this service, and we'll continue to update the database regularly with the latest abusing clients.

Learn more about Zscaler.