Free web service identifies Internet abuse
Zscaler released IPAbuseCheck, free web service which will allow them to query a dynamic ThreatLabZ database to identify whether any of their endpoint clients and IP addresses are being used for malicious purposes.
Users who leverage the service will now be able to identify and clean-up compromised endpoint clients that are unintentionally participating in some form of Internet proxy abuse—including brute-force web logins, forum spamming, pay-per action cheating, open proxy scanning, DDoS attacks and web-site scraping.
The service combines a simple web interface with an extensive database that contains IP addresses that have attempted to forward abusive or unwanted traffic through one or more Zscaler cloud proxies.
Unlike other publicly available services and tools, IPAbuseCheck provides a different perspective on Internet abuse. Lists that track forum spamming and other types of Internet abuse, for example, often log the ‘source’ IP address from the perspective of the spammed web server. This approach, however, will often result in the identification of a source address that represents a proxy IP address that is being abused, as opposed to the actual infected client. IPAbuseCheck is different than standard blacklists in that the clients listed have specifically attempted some form of Internet abuse through one or more web proxies within Zscaler’s global security cloud.
“Malicious or compromised clients leverage proxies to distribute and/or mask their origin when conducting forms of abuse,” said Mike Geide, senior researcher at Zscaler ThreatLabZ. “We’ve seen so many IP addresses bang against our proxies hundreds of thousands of times the past few months, attempting to brute-force web logins. Yet, searching for these IPs against multiple blacklists does not identify them as being offensive. This new IPAbuseCheck service will provide another helpful resource to identify and clean-up compromised endpoint clients.”
Client IP addresses listed in the IPAbuseCheck database include both those that are intentionally used for abuse and those that are from infected hosts that are unknowingly abusing proxies on the internet.
Zscaler’s service provides policy and security enforcement through its proxies from its customers. Valid Zscaler customers must first authenticate to the Zscaler cloud before being able to use these proxies. Transactions listed in the IPAbuseCheck database are from non-authenticated clients attempting to utilize one or more Zscaler proxies in an open manner – as a way to distribute and mask traffic for their abuse.