HostExploit’s Q3 2010 Report - Some Hosts Improving but Malicious Activity Still a Problem

HostExploit, www.hostexploit.com, is pleased to present the Q3 2010 report on the ‘Top 50 Bad Hosts and Networks’. The emphasis this quarter is on the most improved hosts, with many of the worst hosts from the last quarter taking steps to remove cybercriminal activity from their servers.

Bad publicity damages reputations and can be financially detrimental to business. A sobering dose of bad publicity can result in positive action being taken, as Demand Media have demonstrated since the previous report.

HostExploit is pleased to report that based on the latest ranking in the HE Index, there has been a very favorable improvement in the position of eNom, Demand Media’s registrar arm. The drop in their ranking has only occurred since the extensive media coverage of the malicious activity that was being hosted on eNom’s servers. In the time since, we have witnessed a willingness to ‘clean up’ in cooperation with the security community.

Looking at eNom’s position in detail, their ranking has improved from #1 to #7 – due, largely, to the removal of botnet command & control centers, in particular of the infamous Zeus botnet. Although this is very encouraging, it must be considered that eNom still hosts sites that distribute malware and malicious software which infect some 5,326 third-party websites.

However, as good as it is to see eNom/Demand Media’s improved ranking they are by no means the biggest success story this quarter. For example:

• Former #1 Bad Host (Dec 2009) AS30407 Velcom (Canada) has reduced its badness levels by over 70 per cent in just three successive quarters and has fallen down to #99. This shows considerable effort on Velcom’s part to rid their networks of cybercriminal activities.

• Formerly ranked #9, AS28299 CYBERWEB NETWORKS (Brazil) has dropped to an astonishing #228, in just three months. This has been achieved by cleaning up large quantities of phishing servers and botnet command & control centers. This is a truly impressive result.

These brief examples demonstrate the power of raising public awareness. Badware can seem an intractable issue to some hosts; yet, it is possible for hosting providers to reduce levels of badness in a relatively short period of time.
Why then are hosts such as AS29073 Ecatel (Netherlands) still being ranked as #1 now, having been ranked #2 in Q2 2010 and #1 in Q1 2010? The simple answer is that they continue to be cybercrime friendly, taking cash from illicit activities rather than investing in restricting them.

HostExploit’s study combines its own data with a wide range of respected community sources to produce a comprehensive analysis of badness levels on each of the world’s 35,000+ public Autonomous Systems. The data is processed by www.SiteVet.com, an innovative tool that uses unique algorithms to calculate a simple quantitative badness rating out of 1000 (which we call the HE Index) of each AS. Results are further published in tables and charts. With a focus on the worst aspects of cybercriminal activity, the HE Index also takes into account factors such as: size of network; botnet hosting; infection rates; current events; distribution of malware, exploits, rogues and spam.

The report can be downloaded here: http://hostexploit.com/blog/14-reports/3518-hostexploits-top-50-bad-hosts-3rd-quarter-2010.html

HostExploit.com is a focal point for open source resource research, publication and creating awareness of Cyber crime activity. The focus is on Internet hosts, registrars, and the delivery of crime ware. It was designed to provide a holistic approach to the study of Cyber crime, integrating research from various sources of expertise; anti-spam, Malware, botnet, cyberwarfare, organizational analysis, and organized crime. The concept is unique in that the output so far has been detailed research reports, which are highly graphic and aimed at a general readership. The reports have been of considerable use in provision of well researched community information for technical and non-technical journalists, bloggers, security analysts, academics, law enforcement, and the wider Internet community, to primarily provide awareness.

HostExploit is an open organization of international volunteers, created as an open source resource for those who wish to reduce and prevent Cyber crime, its effects and causes, and assist in wider awareness and education. This way CERTS, law enforcement, governmental agencies and the wider concerned Internet user are better informed.

The HostExploit site and associated blog(s) are edited by Jart Armin, however much of the research is provided by a wider volunteer group. All those involved are respected Internet professionals within the areas of; web hosting, server management, DNS (Domain Name System), Internet security, and IDS (Intrusion Detection Systems).

1903 60th Place E.
Suite M6193,
Bradenton,
FL 34203,
USA

This release was published on openPR.