[nsp-sec] Daily Reports Summary for week ending 2011-04-11

[SURFcert - Peter]

Tim,

Tim Wilde wrote on 2011-04-11 22:12:

>
> Immediately below you will find the weekly summary of Daily Reports /
> ASN Alerts submissions for the week ending 11 APR 2011.
>
>                        CURRENT WEEK'S DATA               PREVIOUS WEEK
>
> report       UniqueIPs   Change  ASNs  bogon  noroute    UniqueIPs  ASNs
> ------     ------------------------------------------  -----------------
> Beagle           3,005  +  4.1%   263      0        1        2,888   260
> Bots         1,191,479  + 14.2%  9215      0       84    1,043,105  8917
> Bruteforce         281  +  6.4%   179      0        0          264   170
> Ddosreport       1,108  + 27.9%   430      1        5          866   384
> Fastflux         3,015  + 76.9%   426      0        1        1,704   347
> Flowbots             1  -  0.0%     1      0        0            1     1
> Malwareurl      16,649  + 13.8%  2169      1        1       14,625  2017
> Nachi            1,819  -  0.8%   337     15       16        1,833   352
> Openresolvers  689,099  -  2.5% 10056      0       64      706,598 10163
> Phatbot            587  -  9.4%   171      0        0          648   189
> Phishing         1,381  +  8.6%   510      1        1        1,272   473
> Proxy           19,261  - 12.5%  1816      0        1       22,015  1944
> Routers            286  -  3.4%    63      0        0          296    92
> Scanners        40,219  + 45.1%  3736      1       12       27,710  3310
> Slammer             45  +104.5%    28      0        0           22    10
> Spam         6,627,279  +  6.2% 13614      0      995    6,243,215 12590
> Spreaders          704  + 28.9%   221      0        0          546   193
> Stormworm        3,320  -  3.9%   471      0        0        3,456   467
>
> TOTALS       8,436,880  +  6.4% 17286     17     1178    7,932,420 16544

Do you have any idea why this seems to grow this much the last couple of
weeks? In our constituency we have seen a growth of about 200% in open
incidents during April.

> Last week's reports featured some data from one provider coming into the
> spam category that wasn't really spam related.  Several of you wrote to
> us about this, and upon further investigation, we've split the data from
> that provider into more appropriate categories, so hopefully there
> should be less confusion going on there.  That's responsible for at
> least part of the increase in the bots category, otherwise things look
> relatively sane overall.

Thanks.

-- 
Peter Peters                     /------\           SURFnet bv
SURFcert                         | SURF |           cert.surfnet.nl
cert at surfnet.nl                  \-----\ \-----\    Postbus 19035
PGP Key ID 0x5A52C966                   | CERT |    NL-3501 DA  Utrecht
+31 30 2305 305                         \------/    fax: +31 30 2305 329



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 543 bytes
Desc: OpenPGP digital signature
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20110413/66c3b3b9/attachment-0001.sig>