Akamai Diversity

The Akamai Blog

China Again the Top Producer of Attack Traffic

Akamai released its Third Quarter 2013 State of the Internet Report yesterday. On the security side, we saw a return of sorts to the status quo.
Last quarter, Indonesia had replaced China as the world's top source of attack traffic and Port 80 had replaced Port 445 as the most targeted. This time around, China is again the top attack traffic producer and Port 445 is again the most targeted. 
The full report can be downloaded here

Akamai looked at attack traffic from 185 countries and regions during the third quarter of 2013, up 10 over the previous quarter. Thirty-five percent of observed attacks came from China. Indonesia, which topped the list for attack traffic last quarter, fell to second place with 20 percent of observed attack traffic. The United States remained in third place with 11 percent of observed attacks, but that's up from 6.9 percent last quarter. Overall, the concentration of attacks declined during the third quarter of 2013, with the top 10 countries originating 83 percent of observed attacks, compared to 89 percent in the second quarter. 

Meanwhile, Port 445 (Microsoft-DS) returned to its spot as the most targeted port in the third quarter, drawing 23 percent of observed attacks, after falling to third place last quarter. Port 80 (WWW [HTTP]) and Port 443 (SSL [HTTPS]) dropped to second and third place at 14 and 13 percent, respectively. Port 445 was the most targeted port in eight of the top 10 countries/regions, the only exceptions being China and Indonesia. Port 1433 (Microsoft SQL Server) was the top target for China and Port 443 was the most targeted from Indonesia. 

The following chart illustrates the attack traffic patterns:
Thumbnail image for Figure_01_Q3_2013.jpg
The next chart illustrates the top port targets:
Thumbnail image for Figure_02_Q3_2013.jpg