Concerned about recent PAN-OS and other firewall/VPN CVEs? Take advantage of Zscaler’s special offer today

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

IPAbuseCheck Stats

October 26, 2011 - 3 min read

Last week, we announced our IPAbuseCheck lookup tool. We see lots of infected/abusive hosts on the Internet attempting to proxy abusive web transactions through our proxies. Rather than just ignoring these transactions, we’ve decided to provide this lookup utility for security professionals and organizations to query and identify abusive/infected hosts within their networks – based on some feedback, the service has been well received. This follow-up post provides a brief summary of the top offenders that we see in our database to date (July 1 – October 25, 2011).

Top Abuse Breakdown by Geography
The top 15 countries account for over 75% of the abusive clients that we have seen- with the US, China, Russia, Germany, Venezuela, and India accounting for half of the abusive clients that we have seen to date.

Top Abuse Breakdown by Organization (ASN)
ASN by Abusive ClientsASN by Abusive Transactions
ASN% of Clients
AS4812 China Telecom6.32%
AS4134 Chinanet5.16%
AS8048 Servicios, Venezuela3.82%
AS4837 CNCGROUP2.54%
AS15857 Telefonia Dialog S.A.2.53%
ASN% of Transactions
AS14618, Inc.25.16%
AS8069 Microsoft Corp10.23%
AS8075 Microsoft Corp9.92%
AS4134 Chinanet5.02%
AS28753 Leaseweb Germany4.28%

It was interesting to see some well known organizations like Amazon and Microsoft near the top for organizations that have sent us the most abusive transactions. Rather than these being infected corporate systems, it appears to be a handful of hosting service systems that are being abused either directly from the customer or from an infection. Here is a snapshot of a report from our database of a Microsoft IP that we reported to their Abuse Dept. once we started digging into this data:
OriginAS: AS8075

Screenshot of Abuse Report
The transactions observed were hundreds of thousands of brute-force attempts against file sharing sites like Megaupload, Hotfile, Filesonic, and Rapidshare.
Top Abuse Breakdown by Client
Clients in our database that have the longest time range of abuse seen tend to be those clients that are scanning the Internet looking for open web proxies. These were the top 5 clients that we have seen with the longest date range from:

Top 5 Abusive Hosts by Date Range
HostFirst SeenLast SeenBehavior 07:0010/25/11 06:54Proxy Scanning 07:0010/25/11 06:51Proxy Scanning 07:0610/25/11 06:57Proxy Scanning 07:0710/25/11 06:56Proxy Scanning 07:0810/25/11 06:54Proxy Scanning

The following table lists the top 5 abusive hosts by transaction count - these tend to be hosts that attempt to forward bulk transactions through proxies, like forum spam and brute-force attempts. Related to the previous section of organizations with the top abusive transactions - you can see that two Amazon EC2 systems (, 248) are at the top of the list.

Top 5 Abusive Hosts by Transactions
HostTransaction %Behavior Spam Spam Spam
Top Web Services Targeted in Abuse
The following lists the top 5 most targeted web sites/services abused by number of transactions and number of unique abusing clients.
Top 5 Abused Web Services by:
Abusive Transactions:
Abusive Clients:

The bulk of the top sites by transaction are forum spam sites - in the top instances, the forums being abused are in Vietnam. One brute-forcing target is in the top 5, which is the Rapidshare file host. The bulk of the top services being used/abused by number of clients are proxy checkers - the Chinese service was also listed in the top as a spam bot / brute-forcing target.

The above post provides some insight into the types of information that can be extracted from this service, and we'll continue to update the database regularly with the latest abusing clients.
form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.