Zscaler ThreatLabz Releases Free Web Service to Help Identify Internet Abuse

Sunnyvale, California, October 19, 2011

Zscaler, The Cloud Security Company, today announced the release of a free web service that the public can access at ipabuse.zscaler.com, which will allow them to query a dynamic ThreatLabZ database to identify whether any of their endpoint clients and IP addresses are being used for malicious purposes. Users who leverage the new IPAbuseCheck service will now be able to identify and clean-up compromised endpoint clients that are unintentionally participating in some form of Internet proxy abuse—including brute-force web logins, forum spamming, pay-per action cheating, open proxy scanning, DDoS attacks and web-site scraping.

The Zscaler ThreatLabz IPAbuseCheck service combines a simple, easy-to-use web interface with an extensive ThreatLabz database that contains IP addresses that have attempted to forward abusive or unwanted traffic through one or more Zscaler cloud proxies.

Unlike other publically available services and tools, ThreatLabZ IPAbuseCheck provides a different perspective on Internet abuse. Lists that track forum spamming and other types of Internet abuse, for example, often log the ‘source’ IP address from the perspective of the spammed web server. This approach, however, will often result in the identification of a source address that represents a proxy IP address that is being abused, as opposed to the actual infected client. IPAbuseCheck is different than standard blacklists in that the clients listed have specifically attempted some form of Internet abuse through one or more web proxies within Zscaler’s global security cloud.

“Malicious or compromised clients leverage proxies to distribute and/or mask their origin when conducting forms of abuse,” said Mike Geide, senior researcher at Zscaler ThreatLabZ and developer of the new IPAbuseCheck tool. “We've seen so many IP addresses bang against our proxies hundreds of thousands of times the past few months, attempting to brute-force web logins. Yet, searching for these IPs against multiple blacklists does not identify them as being offensive. This new IPAbuseCheck service will provide another helpful resource to identify and clean-up compromised endpoint clients.”

According to Michael Sutton, VP of Security Research, “Most enterprises have infected machines participating in botnets, but don’t even know about it. IPAbuseCheck is a simple, dynamic service that will allow both consumers and enterprises to quickly determine if their machines are being used for such activity.”

Client IP addresses listed in the IPAbuseCheck database include both those that are intentionally used for abuse and those that are from infected hosts that are unknowingly abusing proxies on the internet. Zscaler's global, cloud-delivered service provides policy and security enforcement through its proxies from its customers. Valid Zscaler customers must first authenticate to the Zscaler cloud before being able to use these proxies. Transactions listed in the IPAbuseCheck database are from non-authenticated clients attempting to utilize one or more Zscaler proxies in an open manner – as a way to distribute and mask traffic for their abuse.

The Zscaler ThreatLabZ IPAbuseCheck is freely available to everyone and can be accessed at http://ipabuse.zscaler.com.

About Zscaler

Zscaler is revolutionizing Internet security with the industry’s first Security as a Service platform. As the most innovative firm in the $35 billion security market, Zscaler is used by more than 5,000 leading organizations, including 50 of the Fortune 500. Zscaler ensures that more than 15 million users worldwide are protected against cyber attacks and data breaches while staying fully compliant with corporate and regulatory policies.

Zscaler is a Gartner Magic Quadrant leader for Secure Web Gateways and delivers a safe and productive Internet experience for every user, from any device and from any location — 100% in the cloud. With its multi-tenant, distributed cloud security platform, Zscaler effectively moves security into the internet backbone, operating in more than 100 data centers around the world and enabling organizations to fully leverage the promise of cloud and mobile computing with unparalleled and uncompromising protection and performance. Zscaler delivers unified, carrier-grade internet security, next generation firewall, web security, sandboxing/advanced persistent threat (APT) protection, data loss prevention, SSL inspection, traffic shaping, policy management and threat intelligence—all without the need for on-premise hardware, appliances or software. To learn more, visit us at www.zscaler.com.

Additional Resources:

Media Contacts:

Whitney Black 
Director of Communications