We are pleased to report that the #1 Bad Host and crime server from last quarter's report - AS29106 VolgaHost, has been taken off-line, as from January 17th 2011.

This has occurred on the back of the recent de-peering of several major bulletproof hosts - so called for their support of known centers of cybercrime.

VolgaHost is well known to HostExploit. It topped our ranking of ‘Bad Hosts’ for the 4th quarter of 2010, having been ranked #3 in the two previous quarters.

As the following chart shows, it earned its placing due to the number of botnet Command & Control (C&C) servers it was hosting, as well as significant levels of malicious URLs, Zeus and exploit servers:

Click image to view full size.

The following graph of historical data shows activity on the server stopped on January 17, having been consistently active for many months before:

Click image to view full size.

This was also related to community efforts with regard to AS39150 Vline Telecom (#6 Bad Host in the 2010 Q4 report), which was de-peered from its upstream provider AS3267 RUNNet.ru - the Russian State Institute of Information Technologies and Telecommunications.

As a result, the table below shows currently disconnected crime servers & bullet proof hosts for a variety of botnets. Also see links to Spamhaus and abuse.ch.

Currently AS39150 Vline Telecom is tenuously connected to the Internet by the following upstream:

• AS31500 GLOBALNET-AS Global Network Managment Ltd
• AS29648 COMLINE-AS ComLine Ltd, an Chelyabinsk ISP
• AS29053 TELENET-JSC-AS JSC Telenet

The following are still currently downstream and of questionable reputation:

• AS48159 - STREAMLINE LLC "Stream Line"
• AS29234 - ASN-WESTLUCKY Zahidna Merezha Uspihu ISP
• AS24912 - BILIM-AS JSC BiLiM Systems Ltd
• AS49158 - NICE-AS Nice LTD
• AS44016 - PACSERVICE-AS PVKP PacService
• AS44001 - EPYGI Epygi Technologies

This is a major step in the ongoing fight against botnet hosting and cybercrime as world’s worst host VolgaHost, and other associated crime servers, have disappeared. The situation can be monitored here on HostExploit, you can also use live checks of any AS via SiteVet (updated daily) and via abuse.ch.