Updated infection stats

Posted by Maxim Weinstein Wed, 30 Jul 2008 18:45:00 GMT

In June we released a report with numbers from late May, showing the network blocks containing the largest numbers of badware sites reported by Google. Here are updated numbers from early July:

Note: A network block owner is not always the owner or operator of the infected servers on that block, and our publication of these data is intended to inform and educate, not to assign blame.

Overall, the numbers have decreased significantly as a result of Google more aggressively scanning previously-flagged sites and removing stale entries. A few other notable changes:

• Google is no longer on the top 10 list, probably as a result of more aggressive rescanning of their own sites after they have been cleaned.
• Also dropping from the top 10 are European web hosting company iEurop and Chinese network provider Beijing Dian-Xin-Tong Network Technologies Co., Ltd.
• New on the list is AOL, a StopBadware.org partner. Most or all of the infected sites are from their Hometown service, which offers free blogging and web hosting. (Like Google’s Blogspot, free accounts on Hometown are targeted by spammers and other bad actors as a means to create bogus websites containing or linking to badware.) AOL tells us that they are taking quick action against the sites and the user accounts involved.
• Also new on the list is Endurance International Group. (Endurance is now the parent company of iPowerWeb, which led our list over a year ago.) Endurance told us that as soon as they received notice from us about these infections, they identified thousands of malware redirects on their customers’ sites and took action, including removing the redirects, notifying the customers, and forcing the users to reset their passwords. They also took steps to look for and respond proactively to similar malware in the future.

Posted in all | Tags aol, endurance, Google, stats, stopbadware

Commtouch: Zombie PCs are everywhere

Posted by Maxim Weinstein Fri, 11 Jul 2008 17:01:00 GMT

A new report [pdf] from Commtouch, an e-mail security vendor, indicates that “zombies” (PCs infected with bots that send spam and malware) are geographically much more dispersed than we found infected websites to be. Turkey led the world by a small margin, with 11% of the ten million zombie IP addresses analyzed, while the U.S. was in 9th place with 4.3%.

Not mentioned in the report is that some of the countries near the top of the list, including Turkey, Germany, and Poland, must have very high “zombies per Internet user” rates, as these countries have far fewer users, yet more total zombies, than the U.S. Perhaps all the work that has been done here at home in the last few years to educate users about PC security is having some effect. Still a long way to go, though, if we have 4+ million zombies in the country.

Posted in all | Tags commtouch, stats, stopbadware

Commentary on top infection stats

Posted by Maxim Weinstein Mon, 07 Apr 2008 13:33:00 GMT

Oliver posted some great stats early this morning showing the networks and individual IP addresses with the largest number of infected sites. Some might be wondering why Google appears so high on a list of sites that Google itself has flagged as potentially harmful. Our colleagues at Google (disclaimer: Google is a sponsor of StopBadware.org) tell us that these sites represent infected Blogspot blogs and that Google takes these down quickly after identifying them as bad. Sometimes, they don’t get around to rescanning and removing them from their list of bad URLs right away, which is why they continue to show up in our data and in our Clearinghouse. Apparently, though, the sites are no longer a threat.

We have also been in touch with ThePlanet.com, and they say they are working to clean up the infected sites hosted on their network.

If anyone has any knowledge of how to contact the various Chinese providers listed, please let us know at contact@stopbadware.org.

Posted in all | Tags stats, stopbadware

Top Infected ASN for March 2008

Posted by Oliver Day Sun, 06 Apr 2008 02:26:00 GMT

[note] All data provided by Google and Team Cymru

Tags asn, stats, stopbadware

Top Infected IP Addresses for March 2008

Posted by Oliver Day Sun, 06 Apr 2008 01:48:00 GMT

Tags stats

See the top pages in our Clearinghouse

Posted by Erica George Thu, 07 Feb 2008 22:08:00 GMT

One of the most popular resources at StopBadware is our Badware Website Clearinghouse, which has information about websites that have been reported as potentially harmful by one of our partners. The Clearinghouse pages for websites that Google has flagged also are linked from Google’s warnings for the sites.

Now you can see which of those Clearinghouse pages are the most popular. We’ve set up a traffic monitor that automatically displays the top Clearinghouse pages, by visits to our website. You can view today’s top sites, this week’s, this month’s and this year’s data. Check out our new top sites page to see which website reports have been generating the most interest.

Posted in all | Tags clearinghouse, stats, stopbadware, transparency