China, US Top List Of Countries With Most Malicious IPs

New research by threat intelligence firm Recorded Future has yielded some surprising insights on risky IP addresses, their distribution around their world, and how organizations can protect against them.

Recorded Future tied four million known bad IP address back to the network operators to which they belonged in order to try and understand the risk posed by each operator. Each of the IPs in the list was known to be either currently or historically risky and was associated with behavior that ranged from "unusual" to the "very malicious."

The four million IPs that Recorded Future analyzed traced back to a total of 26,581 Autonomous System Numbers (ASNs), which are unique numbers for identifying the IP subnets managed by different operators.

The company's analysis yielded some interesting results: China, for instance, had more risky or suspicious IP address than any other country. Given the country's tight control over the Internet, the high number of risky IPs suggests government awareness of malicious use, Recorded Future said.

Russia, which in recent months has been accused of a wide range of malicious activity, had a relatively low level of risky IP addresses, suggesting that bad actors there are exploiting infrastructure in other countries. Surprisingly, Brazil had 20% more risky IP addresses than Russia, while a group of Asian countries including Korea, Thailand, Vietnam, and India had two times as many bad IPs as Russia and Ukraine.

The US, which is often regarded as safer than many other countries, actually had the second highest number of bad IPs - second to China. But the IP addresses in the US were distributed across 360% more IPs in total than China.

Recorded Future's analysis revealed other interesting insight as well. The ASNs with the most number of risky IP addresses were both from China, and are currently ranked the first and fourth largest IP subnets in the world.

However, when Recorded Future ranked the ASNs by the percentage of risky IPs in them, a different picture emerged entirely. For instance, though China's Chinanet had by far the highest raw number of risk-scored IPs, that number represented a mere 0.4% of the total 100 million IP addresses managed by Chinanet overall.

In contrast, three operators — one each in Russia, Germany, and Latvia — though much smaller, appeared completely compromised with 100% of their IP addresses found risky.

Russia's ADM Service Ltd., for instance, accounted for just 511 of the 4 million IPs that Recorded Future looked at, but that number represented 100% of ADMs IP address space. Overall, Russia and Brazil topped the list of countries with network operators that had 2% or higher of their IP addresses classified as risky — a number that represents endemic risk, the analysis shows.

US Dominates

When Recorded Future looked at ASNs with the highest number of IPs associated with command and control activity, the US dominated the charts. The top three ASNs in this category were located in the US, while there were four ASNs overall in the top 10 list. The same result emerged when Recorded Future inspected IP addresses that were hardcoded into malware samples.

One explanation of why malicious activity is based in the US and countries like Canada and the UK is because threat actors want to make their traffic appear as innocent as possible, Recorded Future conjectures.

For network professionals, the key takeaway is that it is possible to proactively identify and block risky parts of the Internet by doing ASN-level risks assessments, says Bill Ladd, chief scientist at Recorded Future.

"Country-level assessments are useful for general situational awareness and ASN level assessments are useful for blocking," he says.

Instead of looking merely at the total number of bad IPs associated with an ASN it is more informative to consider the percentage riskiness of an ASN, he says. ASNs with endemic levels of risky IPs are much smaller in number and blocking them is likely to have less of a negative impact, he says.

Blocking ASNs based on their risk percentage can be effective. For example, when Recorded Future implemented rules for blocking the 10 riskiest ASNs, it preemptively also blocked over 1,720 IP addresses that later turned out to be risky. When Recorded Future tightened its rule to block all ASN's with 6% or higher of risky IPs, the company proactively blocked close to 12,000 IPs that later emerged as risky.

"High-risk ASNs can be identified and blocked," Ladd says. With almost 60,000 ASNs worldwide, it is impossible to evaluate all of them. So a risk-ordered list is needed to prioritize the most important ones to block, he notes. Organizations should review the riskiest ASNs and make blocking decisions based on both risk and business value.

"My advice to organizations is to identify and evaluate ASNs that are of highest risk. I'd also advise organizations to block any that have minimal business value," Ladd says

Related Content: