How to takedown 100,000 malware sites
Published on 21th January 2019, 11:23:48 UTC
End of March 2018, abuse.ch launched it's most recent project called URLhaus. The goal of URLhaus is to collect and share URLs that are being used for distributing malware. The project is a huge success: with the help of the community, URLhaus was able to takedown almost 100,000 malware distribution sites within just 10 months! During that time, 265 security researchers located all over the world have identified and submitted in average 300 malware sites to URLhaus each day, helping others to protect their network and users from malware campaigns.
But it is not only the infosec community that makes URLhaus a success story: Together with the community, URLhaus also managed to get the attention of many hosting providers, helping them to identify and re-mediate compromised websites hosted in their network. This is not an easy task, specially for large hosting providers that have tens of thousands of customers and hence a significant amount hijacked websites in their network that are getting abused by cybercriminals to distribute malware.
Nevertheless, URLhaus in average counts between 4,000 and 5,000 active malware distribution sites every day, which is a way too much. The following chart shows the number of active malware distribution sites tracked since the launch of URLhaus. The blue line indicates the number of abuse reports sent out to the correpsoning hosting providers and network owners.
Having a look at the average takedown time doesn't make the situation any better: In average, malware distribution sites stay active for more than a week (8 days, 10 hours, 24 minutes). That's more than enough time to infect thousands of device every day.
The table below shows the top malware hosting networks, hosting active malware content (counting online malware distribution sites only as of Jan 20th, 2019). As you can easily spot, 2/3 of the top malware hosting networks are hosted either in the US or China.
| Rank | ASN | Country | Average Reaction Time | Malware URLs |
|---|---|---|---|---|
| 1 | AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC |  US | 6 days, 12 hours, 56 minutes | 307 |
| 2 | AS4134 CHINANET-BACKBONE No.31,Jin-rong Street |  CN | 1 month, 9 days, 19 hours, 22 minutes | 256 |
| 3 | AS4837 CHINA169-BACKBONE CHINA UNICOM China169 | CN | 1 month, 23 days, 8 hours, 41 minutes | 163 |
| 4 | AS48815 CRITICALCASE |  IT | 21 hours, 58 minutes | 151 |
| 5 | AS46606 UNIFIEDLAYER-AS-1 - Unified Layer | US | 2 days, 11 hours, 54 minutes | 127 |
| 6 | AS53667 PONYNET - FranTech Solutions | US | 13 days, 3 hours, 37 minutes | 105 |
| 7 | AS16276 OVH |  FR | 5 days, 22 hours, 6 minutes | 104 |
| 8 | AS60144 THREE-W-INFRA-AS -- TRANSIT -- |  NL | 9 days, 10 hours, 37 minutes | 83 |
| 9 | AS13335 CLOUDFLARENET - Cloudflare, Inc. | US | 13 days, 7 hours, 5 minutes | 67 |
| 10 | AS37963 CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba | CN | 1 month, 2 days, 0 hours, 1 minutes | 66 |
| 11 | AS8342 RTCOMM-AS |  RU | 10 days, 8 hours, 9 minutes | 63 |
| 12 | AS36352 AS-COLOCROSSING - ColoCrossing | US | 16 days, 9 hours, 57 minutes | 53 |
| 13 | AS3462 HINET Data Communication Business Group |  TW | 17 days, 6 hours, 19 minutes | 51 |
| 14 | AS23650 CHINANET-JS-AS-AP CHINANET jiangsu province | CN | 3 days, 11 hours, 50 minutes | 51 |
| 15 | AS3462 HINET Data Communication Business | TW | 17 days, 6 hours, 19 minutes | 51 |
What is also an eye-catcher is the takedown time of malware sites hosted in China: The three top Chinese malware hosting networks have an average abuse desk reaction time of more than a month!
A vast amount of the malware distribution sites tracked by URLhaus are related to Emotet (aka Heodo). Emotet gets propagated through spam that hits users inbox almost every day. These malspam campaigns usually contain a malicious office document with macros. Once the victim opens the document and enables macros, it will automatically download and execute Emotet from a comprised website. To bypass spam filters, these malspam campaigns sometimes point to a comprised website that hosts the malicious office document instead of attaching it to the email directly. To dismantle these campaigns and prevent that users are getting infected with Emotet, it is essential that the associated malware distribution sites are getting cleaned up in time by the responsible hosting provider.
The weight that Emotet has in the current threat landspace also becomes more clear when having a look at the identified malware families associated with the payloads URLhaus received from the tracked malware distribution sites. Across the 380,000 malware samples (payloads) that URLhaus has collected over the past 10 months, Emotet/Heodo is the top malware as the following chart documents.
Conclusion
URLhaus wouldn't be successful without the help of the community. It proofs that the key in figthing malware and botnets is sharing.
But we are not where we should be yet. There is still a long way to go with regards to response time of abuse desks. An average reaction time of more than a week is just too much and proofs a bad internet hygiene. I do also hope that the Chinese hosting providers weak up and start taking care about the abuse problems in their networks in time. Having malware distribution sites staying active for over a month is just not acceptable.
If you have your own ASN, you are a CERT with national responsibility or you are a ccTLD or gTLD owner, I do recommend you to subscribe to the appropriate URLhaus feed that is available for free. I should fetch it every 15 minutes and act upon it accordingly:
To protect your network and users, you may also want to implement one of the URLhaus blocklists that are available for free too. There are different formats available, including DNS RPZ and Snort/Suricata IDS rules: