ATLAS Country Report: Global Poland

Country Report

Global Poland

View:
Activity
Sources
Malicious Servers

Output:
Print
XML
CSV

Activity (past 24 hours)

Key	Service	Bytes per subnet	Percentage
	TCP/135	6.34 kB	37.8%
	TCP/445 (microsoft-ds)	3.00 kB	17.8%
	ICMP/8	2.10 kB	12.5%
	UDP/137 (netbios-ns)	1.22 kB	7.2%
	TCP/139 (netbios-ssn)	869.42 B	5.2%
	TCP/23 (telnet)	839.90 B	5.0%
	TCP/1433 (ms-sql-s)	738.70 B	4.4%
	UDP/53 (domain)	591.77 B	3.5%
	TCP/22 (ssh)	558.04 B	3.3%
	TCP/8101	194.67 B	1.2%
	Other	355.29 B	2.1%

Key	Description	Attacks per subnet	Change from yesterday	CVE	Percentage
	Symantec AV realtime VirusScan overflow attempt, SYMC06-010	1.16	+35.8 %	CVE-2006-2630	18.7%
	Symantec Rtvscan.exe remote management exploit attempt	1.16	+35.8 %	CVE-2006-3455	18.7%
	symantec antivirus realtime virusscan overflow attempt	0.83	-1.8 %	CVE-2006-2630	13.4%
	Microsoft Windows ASN.1 Library buffer overflow attempt	0.71	+10.0 %	CVE-2003-0818	11.4%
	ASN.1 constructed bit string	0.70	+9.2 %	CVE-2005-1935	11.4%

Inbound Attacks	0
Outbound Attacks	68
Maximum packet rate	262.76 k pps
Maximum traffic rate	610.55 Mbps
Attack class	Misuse: 48 Profiled: 20
Attack subclass	: 1, Bandwidth: 1, Protocol: 1,

Sources (past 24 hours)

By ASN

Key	ASN	Bytes per subnet	Percentage
	AS5617 (TPNET)	5.34 kB	31.8%
	AS39869 (SITEL-PL)	2.70 kB	16.0%
	AS41809 (ENTERPOL-AS)	1.46 kB	8.7%
	AS42935 (PL-SSH-AS)	1.33 kB	7.9%
	AS8259 (D2DIRECT-AS)	1.21 kB	7.2%
	AS6714 (ATOMNET)	583.79 B	3.5%
	AS20938 (RETSAT)	580.91 B	3.5%
	AS41642 (RAMTEL-AS)	460.30 B	2.7%
	AS12741 (INTERNETIA-AS)	447.11 B	2.7%
	AS16342 (Toya)	341.16 B	2.0%
	Other	2.36 kB	14.1%

By Host

Key	Host	Bytes per subnet	Percentage
	91.193.197.58	1.46 kB	8.7%
	91.188.124.195 (un-124-195.domainunused.net)	925.18 B	5.5%
	91.188.121.101	906.15 B	5.4%
	91.90.93.153	888.28 B	5.3%
	91.123.212.27	862.05 B	5.1%
	195.13.38.2	580.24 B	3.5%
	212.160.195.134 (dante-hell.info)	497.19 B	3.0%
	91.90.191.18	460.30 B	2.7%
	83.12.232.69	431.28 B	2.6%
	91.188.124.213	416.84 B	2.5%
	Other	9.38 kB	55.8%

By ASN

Key	ASN	Attacks per subnet	Percentage
	AS5617 (TPNET)	4.25	68.5%
	AS16366 (ASTER-KRAKOW-AS)	0.66	10.6%
	AS21021 (Unknown)	0.40	6.4%
	AS12741 (INTERNETIA-AS)	0.38	6.1%
	AS6714 (ATOMNET)	0.13	2.1%
	AS42739 (Unknown)	0.12	2.0%
	AS20960 (TKTELEKOM-AS)	0.09	1.5%
	AS20804 (ASN-TELENERGO)	0.05	0.9%
	AS41079 (SUPERHOST-PL-AS)	0.05	0.8%
	AS15857 (Unknown)	0.03	0.5%
	Other	0.05	0.8%

By Host

Key	Host	Attacks per subnet	Percentage
	79.189.65.114 (icn114.internetdsl.tpnet.pl)	1.01	16.2%
	77.236.8.8	0.66	10.6%
	83.8.112.72 (abrs72.neoplus.adsl.tpnet.pl)	0.41	6.6%
	83.6.27.235 (aaut235.neoplus.adsl.tpnet.pl)	0.23	3.7%
	62.148.74.167	0.21	3.3%
	62.148.73.131	0.13	2.1%
	83.21.147.55	0.13	2.0%
	83.10.133.153	0.13	2.0%
	83.24.237.163	0.13	2.0%
	83.29.208.248	0.13	2.0%
	Other	3.06	49.3%

Malicious Servers (past 24 hours)

By ASN

ASN	Number of servers	Percentage
AS5617 (TPNET)	3	60.0%
AS8246 (Unknown)	1	20.0%
AS35790 (Unknown)	1	20.0%
Other	0	0.0%

By Targeted Brand

Brand Name	Phished URLs	Percentage
PayPal	45	0.6%
eBay	37	0.5%
CitiCorp	1	0.0%
Other	7119	98.8%

By ASN

ASN	Phishing URLs hosted	Percentage
AS34377 (BROKER-AS)	3623	50.3%
AS5617 (TPNET)	1894	26.3%
AS9141 (AS9141)	620	8.6%
AS13110 (ICP-AS)	400	5.6%
AS44828 (HNET-AS)	315	4.4%
AS15598 (Unknown)	55	0.8%
AS12476 (Unknown)	47	0.7%
AS35540 (Unknown)	40	0.6%
AS12741 (INTERNETIA-AS)	24	0.3%
AS41079 (SUPERHOST-PL-AS)	23	0.3%
Other	161	2.2%

By Host

Host	Phishing URLs hosted	Percentage
85.198.252.129 (ip-85-198-252-129.broker.com.pl)	3623	50.3%
83.24.209.254	1582	22.0%
81.18.214.7	619	8.6%
62.21.35.254	400	5.6%
62.61.34.173	315	4.4%
83.24.234.112	308	4.3%
62.146.68.167	55	0.8%
85.222.24.114	47	0.7%
87.204.60.206	23	0.3%
81.6.135.111	22	0.3%
Other	208	2.9%

Background

Internet Statistics		Date
Internet Hosts (est.)	5681000	2007
Internet Users (est.)	11000000	2006

Current Threat Rank
1	US (United States)
2	CN (China)
3	NL (Netherlands)
4	IL (Israel)
5	RO (Romania)

Recent Activity

Threat Rank (30 days)

rank history graph

Number of Scanning Sources (30 days)

scanner history graph

Number of Attacking Sources (30 days)

attacker history graph