ASN and IP Address Reports

One important consideration when interpreting this data should be that the sites in our clearinghouse are those provided to us by our data partners. Therefore, this data does NOT comprise a comprehensive report of all infected websites on an AS or on an IP address; rather, it may reflect the methods employed by our data partners in detecting infections.

We map IP addresses to ASNs using data provided by Team Cymru. AS information is not available for all of the IP addresses in our database; the URLs in our database that resolve to IP addresses that are non-routable or for which no AS information is available are listed as belonging to the nonexistent AS 0 in our 'Top 50' list. Furthermore, since not all ASs are the same size, our 'Top 50' list should not be interpreted as reflecting infection rates; it only describes the number of infections that are reported on each AS. It is therefore best to consider our infection prevalence data not in absolute terms, but relative to the size of other ASNs, and over an extended period of time.

Certain other factors may influence the data we report, including the frequency with which StopBadware obtains data from various partners and the success we have in resolving IP addresses for the URLs that are reported at a given time. Observable spikes in reported infections may occur if irregular batches of data are received from a partner, and various events or attributes of our systems may also impact our results. We will try to describe any such events as they occur.

For example, we were unable to resolve IPs for new infections during the period from September 9, 2009 to October 1, 2009. The ASN charts decline across the board during this period, reflecting the rate at which sites which had already been identified were removed from our partners' blacklists, but they do not include sites that were added during that period, until October 2nd, 2009. The IP address charts that we display do not reflect this period.