Blogs & Stories

SpiderLabs Blog

Attracting more than a half-million annual readers, this is the security community's go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.

[Honeypot Alert] Status Report for January 2012

Monthly Web Honeypot Status Report

We have received a tremendous amount of positive feedback on our web-based honeypot alert blog posts. While we agree that this data is useful for raising awareness of individual attack details, we feel that what was missing was information on scale. Specifically, how many of each type of attacks are we seeing. The goal of these new monthly blog posts will be to provide some context on the web attack trends we are seeing in hopes that this will aid organization with determining attack likelihood.

Reporting Period: January 2012

Number of Web Honeypot Sensors: 69

Total Number of Attacks Seen for January 2012: 468194

Attack Types per Month


The overall number of attacks seen did decrease from 646973 in December 2011 down to 468194 in January 2012 (a 27% reduction).

Example Attack Trends

Timthumb Attacks


The overall volume of Timthumb injection attacks dropped significantly from what we saw in December 2011 (down 67%) however with ~144k attacks still seen it is by no means a sporadic attack vector.

Remote File Inclusion (RFI) Attacks


RFI attacks also decreased significantly from December 2011 to January 2012 (down 86%).

Local File Inclusion (RFI) Attacks


While Timthumb and RFI attack traffic was trending down, LFI attacks increased dramatically up 671% from December 2011.

Attacker Source Trends

Total Number of Unique Attack Sources: 2100

Top 10 Attacker Sources

Top 10 Attackers

HostnameCountry CodeCountry NameRegionRegion NameCityISPOrganization SystemsOVH SAS Daddy Netherlands B.V.Go Daddy Netherlands B.V. FederationInternet-Hosting LtdInternet-Hosting Ltd StatesTXTexasDallasLimestone NetworksLimestone Networks StatesMIMichiganLansingSourceDNSSourceDNS Internet AG1&1 Internet AG SystemsOVH SAS StatesTXTexasDallasSoftLayer TechnologiesJoylab.ca StatesPAPennsylvaniaWayne1&1 Internet1&1 Internet StatesILIllinoisChicagoSingleHopJDI - JustHost Web and Backup Servers