Sunnyvale, California, October 19, 2011
Zscaler, The Cloud Security Company, today announced the release of a free web service that the public can access at ipabuse.zscaler.com, which will allow them to query a dynamic ThreatLabZ database to identify whether any of their endpoint clients and IP addresses are being used for malicious purposes. Users who leverage the new IPAbuseCheck service will now be able to identify and clean-up compromised endpoint clients that are unintentionally participating in some form of Internet proxy abuse—including brute-force web logins, forum spamming, pay-per action cheating, open proxy scanning, DDoS attacks and web-site scraping.
The Zscaler ThreatLabz IPAbuseCheck service combines a simple, easy-to-use web interface with an extensive ThreatLabz database that contains IP addresses that have attempted to forward abusive or unwanted traffic through one or more Zscaler cloud proxies.
Unlike other publically available services and tools, ThreatLabZ IPAbuseCheck provides a different perspective on Internet abuse. Lists that track forum spamming and other types of Internet abuse, for example, often log the ‘source’ IP address from the perspective of the spammed web server. This approach, however, will often result in the identification of a source address that represents a proxy IP address that is being abused, as opposed to the actual infected client. IPAbuseCheck is different than standard blacklists in that the clients listed have specifically attempted some form of Internet abuse through one or more web proxies within Zscaler’s global security cloud.
“Malicious or compromised clients leverage proxies to distribute and/or mask their origin when conducting forms of abuse,” said Mike Geide, senior researcher at Zscaler ThreatLabZ and developer of the new IPAbuseCheck tool. “We've seen so many IP addresses bang against our proxies hundreds of thousands of times the past few months, attempting to brute-force web logins. Yet, searching for these IPs against multiple blacklists does not identify them as being offensive. This new IPAbuseCheck service will provide another helpful resource to identify and clean-up compromised endpoint clients.”
According to Michael Sutton, VP of Security Research, “Most enterprises have infected machines participating in botnets, but don’t even know about it. IPAbuseCheck is a simple, dynamic service that will allow both consumers and enterprises to quickly determine if their machines are being used for such activity.”
Client IP addresses listed in the IPAbuseCheck database include both those that are intentionally used for abuse and those that are from infected hosts that are unknowingly abusing proxies on the internet. Zscaler's global, cloud-delivered service provides policy and security enforcement through its proxies from its customers. Valid Zscaler customers must first authenticate to the Zscaler cloud before being able to use these proxies. Transactions listed in the IPAbuseCheck database are from non-authenticated clients attempting to utilize one or more Zscaler proxies in an open manner – as a way to distribute and mask traffic for their abuse.
The Zscaler ThreatLabZ IPAbuseCheck is freely available to everyone and can be accessed at http://ipabuse.zscaler.com.
Zscaler (NASDAQ: ZS) enables the world’s leading organizations to securely transform their networks and applications for a mobile and cloud-first world. Its flagship services, Zscaler Internet Access™ and Zscaler Private Access™, create fast, secure connections between users and applications, regardless of device, location, or network. Zscaler services are 100 percent cloud-delivered and offer the simplicity, enhanced security, and improved user experience that traditional appliances are unable to match. Used in more than 185 countries, Zscaler operates a multi-tenant distributed cloud security platform, protecting thousands of customers from cyberattacks and data loss. Learn more at zscaler.com or follow us on Twitter @zscaler.
Zscaler™, Zscaler Internet Access™, and Zscaler Private Access™, ZIA™ and ZPA™ are either (i) registered trademarks or service marks or (ii) trademarks or service marks of Zscaler, Inc. in the United States and/or other countries. Any other trademarks are the properties of their respective owners.
Vice President, Global Communications