Weekly web security warning – April in review

Every week, we examine the top trends in malicious activity we have seen in Canada using data obtained through CIRA’s D-Zone DNS Firewall.

With April now behind us, it feels like a good time to review the activity we tracked through D-Zone DNS Firewall in the past month. We’ll keep it short, simple and full of charts.

We added more than 5.6 million malicious domains to our block list over the last month, and blocked more than 1.9 million queries from user clicks on phishing sites through to botnets—and that’s only in Canada! This all goes to show that no matter how much security to have, users are often the weakest link (sorry).

Over the same period, we saw a steady weekly decline in DDoS queries. One interesting note: the charts clearly show how traffic dips over the weekend as systems are offline. No network, no one to respond to fake queries.   

Over the past month, we saw five common malware threats appear most frequently, you can see them in the chart below. We monitored a very high percentage of customers experiencing malware call home events, and the number of users impacted by Trojan downloaders is also cause for concern if you are an IT manager.

Another way to look at the scope of the threat is to rank them by queries per second (QPS) rather than only the client IP address. QPS provides a good look at the scope of each threat, which shows that some, like Necurs, are more persistent while others, such as DNS tunneling, are more a nuisance than an active hack that is trying to access data.

Finally, we can’t forget about the top 10 blocks of the week. Last week, we saw a lot of random character domains (likely algorithmically generated) and a few .ru domains mixed in for good measure.