URLhaus measures hosting providers' malware takedown times

URLhaus reports that hosting providers average 3 days to remove malware sites, with only 16% responding within 6 hours—too slow for campaigns like Emotet.

abuse.ch's URLhaus project has begun measuring how quickly hosting providers respond to malware distribution site reports. Across 38,924 abuse reports sent between June and September 2018, the average takedown time was 3 days and 2 hours. Only 104 of 600+ notified hosting providers (16%) responded within 6 hours on average, and just 13 (2%) responded within one hour. This slow response is particularly problematic for fast-moving malspam campaigns like Emotet, where malware sites remain active for days after initial spam runs, continuing to infect users.

The research identified significant operational challenges in abuse reporting, including bounced emails due to poorly-maintained RIR objects, full mailboxes, spam filters blocking legitimate abuse reports, and hosting providers requiring web forms instead of accepting email reports. Ukraine, Japan, and Zimbabwe showed the slowest average response times by country, while Mexico, Iceland, and Pakistan performed better. Some malware sites have remained active for over 3 months without remediation.

abuse.ch recommends that hosting providers maintain valid abuse contacts, subscribe to URLhaus feeds, implement automated takedown processes, and adopt the X-ARF (Extended Abuse Reporting Format) standard to streamline abuse handling. The article raises the broader question of what consequences network operators should face when they consistently ignore abuse reports.

Source reporting: https://abuse.ch/blog/measuring-reaction-time-of-abuse-desks