Cyber-Attacks: Where Are They Coming From? And Where Are They Going?

By Sean Michael Kerner

According to AlienVault’s latest Open Threat Exchange (OTX) snapshot, China tops the list of countries with the most reported malicious IP addresses.

In contrast with AlienVault’s findings, the second-quarter Akamai “State of the Internet” report found that Indonesia is the top country for attack traffic, with 38 percent of attack traffic originating there. China is second at 33 percent, with the U.S. a distant third at only 6.9 percent.

While attacks can come from any corner of the world, Akamai found that the vast majority of distributed denial-of-service (DDoS) attacks were against organizations in the Americas.

According to the third-quarter 2013 attack report from Arbor Networks, most DDoS attacks consume less than 1G bps of attack bandwidth.

Although attacks of less 1G bps currently represent the majority of DDoS attacks, larger bandwidth attacks are growing. According to Arbor Networks, attacks of between 2G and 10G bps now represent 37 percent of all DDoS attacks.

According to Arbor Networks, the majority of DDoS attacks are short-lived, lasting 30 minutes or less in duration.

It should come as no surprise that Port 80 is identified by Arbor Networks as being the most attacked server port. Port 80 is the primary operating system port used for all Web traffic on devices and servers. When it comes to the most attacked ports after Port 80, other vendors have different views.

As is the case with the Arbor Networks data, Akamai’s “State of the Internet” report also found Port 80 to be the most attacked port. The Akamai report found that Port 443, which is used for Secure Sockets Layer (SSL) encryption, is the second most attacked port.