httpBL.abuse.ch statistic
On this page you can see a statistical breakdown from httpBL.abuse.ch (mainly focusing RFI attacks).
Most seen RFI scripts (MD5)
| Counter | Hash | Firstseen (UTC) | Lastseen (UTC) | Filesize (MD5) |
| 807 | a05dfd7cca7771a7565a154d65f05ea2 | 2009-05-24 22:10:55 | 2010-07-22 17:02:57 | 75 |
| 492 | 725add22d937622a13654a97d8c04538 | 2009-08-19 03:59:36 | 2010-07-31 13:24:03 | 86 |
| 372 | f5c92f6912a87f4c170cb0622513e197 | 2009-05-24 20:00:05 | 2010-07-31 18:56:54 | 77 |
| 147 | 883b3d0eabfda05ac31193a74c0920c9 | 2009-05-25 08:07:23 | 2010-04-09 10:58:30 | 916 |
| 127 | dc7b2fd7417f4ea1917ac8b7284fecba | 2009-08-23 10:24:48 | 2010-07-29 20:02:49 | 77 |
| 124 | 7ab5a3291410db3231141e2818e85318 | 2009-07-11 14:40:55 | 2010-07-27 04:12:37 | 88 |
| 98 | 06f083d0f8724ab8b544d1e0c1d3c677 | 2009-05-26 06:01:18 | 2010-07-30 19:40:01 | 16'207 |
| 84 | fc9a685b4cd66241b2a62e9aaa113bf7 | 2009-05-28 11:02:47 | 2010-04-12 01:43:20 | 79 |
| 70 | cec588425493d6bf7ab233d84815646f | 2009-05-24 21:05:51 | 2010-06-14 04:50:59 | 903 |
| 63 | 552bfdc62f9d0fe1e3ee6861698f6b00 | 2009-10-13 12:39:50 | 2010-07-21 04:44:48 | 75 |
| 54 | f1a9b4e4b207cd38641061e1b72d4775 | 2009-05-29 08:52:49 | 2010-03-26 05:59:29 | 1'165 |
| 50 | 212c5ea57c859cb18b33ba0c5ef37b9d | 2009-05-25 10:33:06 | 2009-09-28 22:46:05 | 2'630 |
| 46 | 493d3c720be431004253125118998a5d | 2009-06-21 10:33:58 | 2010-03-19 16:56:06 | 569 |
| 44 | 5ca96b4b4cbfd385dd69ed763efcf99f | 2009-05-26 09:55:10 | 2010-04-06 21:13:49 | 76 |
| 44 | 8d7ab0063ac76d17817fb216576e9547 | 2009-06-05 13:25:05 | 2010-07-29 12:12:09 | 1'843 |
Top RFI script size
| Filesize (Bytes) | Hash | Firstseen (UTC) | Lastseen (UTC) | Counter |
| 16'207 | 06f083d0f8724ab8b544d1e0c1d3c677 | 2009-05-26 06:01:18 | 2010-07-30 19:40:01 | 98 |
| 9'772 | 5ba05efa98491ff50af8455a8a1a1d61 | 2009-06-23 00:02:43 | 1 | |
| 8'141 | b61e61201fc67fc839237b7a3f3a3610 | 2009-10-25 19:05:15 | 1 | |
| 6'948 | d0457791c89eccae2831a3506545ad3a | 2009-09-06 22:53:02 | 1 | |
| 6'916 | b1ab0f5f039ec35c5a4868ebd8cb840d | 2009-05-26 03:58:21 | 2009-06-02 11:16:30 | 2 |
| 5'666 | 03acc622942c7e8805516b7ca8f708cb | 2009-06-28 08:39:38 | 2009-06-29 17:24:42 | 2 |
| 5'600 | 24da357215a0b2229f9a48c0179fc514 | 2009-09-24 18:40:43 | 1 | |
| 5'590 | a394c8a423be5c92d26d04f287839d18 | 2010-05-02 21:11:02 | 2010-05-03 07:59:32 | 2 |
| 5'580 | 94c17d6e0cff730cb95c78dde1973ccb | 2009-08-13 07:24:42 | 2009-08-14 14:48:55 | 2 |
| 5'555 | b69136c1d32d9ca0ace6dcf9b0ea46ca | 2010-04-27 15:25:59 | 1 | |
| 5'547 | a41235d260f3a8e46a8b5d8b9d1e3044 | 2010-04-21 07:52:37 | 1 | |
| 5'546 | fd03cbf77d41d714453c4c436023367a | 2010-04-22 16:20:39 | 2010-04-25 12:37:09 | 2 |
| 5'523 | a74703e5b75aeffd0e3ecc7f2ef70582 | 2009-09-09 05:15:14 | 1 | |
| 5'504 | cc2ddbf3f2df9cb3f7fc9d1a2aded7d6 | 2009-06-21 01:31:42 | 1 | |
| 5'415 | e8037a316e07d59cac5011cfa41aa57e | 2009-10-03 19:44:17 | 1 |
Top RFI URLs
| Counter | RFI script URL | Hash |
| 725 | http://217.218.225.2:2082/index.html | d41d8cd98f00b204e9800998ecf8427e |
| 119 | http://musicadelibreria.net/footer | 883b3d0eabfda05ac31193a74c0920c9 |
| 98 | http://www.abuse.ch/ | 06f083d0f8724ab8b544d1e0c1d3c677 |
| 51 | http://phamsight.com/docs/images/head | f5c92f6912a87f4c170cb0622513e197 |
| 50 | http://193.255.208.32:2082/index.html | 212c5ea57c859cb18b33ba0c5ef37b9d |
| 44 | http://188.72.215.230/id5.txt | 725add22d937622a13654a97d8c04538 |
| 36 | http://www.tabakoff.ru//dimti/AinuLid1.txt | fc9a685b4cd66241b2a62e9aaa113bf7 |
| 35 | http://www.medisite.fr/id | c0c2ff0e5ae82a662df920f24e6f69a1 |
| 32 | http://nic.bupt.edu.cn/media/j1.txt | 725add22d937622a13654a97d8c04538 |
| 32 | http://www.sudsalentocultura.it/mail/idxx.pdf | a05dfd7cca7771a7565a154d65f05ea2 |
| 30 | http://dogstudio.net/ampoll/idxx.txt | a05dfd7cca7771a7565a154d65f05ea2 |
| 29 | http://www.luomoeillegno.com/extras/idxx.txt | a05dfd7cca7771a7565a154d65f05ea2 |
| 25 | http://bwbministries.com/images/r8_c11.gif | 4f499e79ec66069bdd4889aa0451d057 |
| 25 | http://www.diakonia-jkt.sch.id/upload/id1 | dc7b2fd7417f4ea1917ac8b7284fecba |
Top attackers (IP)
| Counter | IP address | Hostname | Firstseen (UTC) | Lastseen (UTC) | Country |
| 5'793 | 200.93.147.154 | adsl200-93147154.sta.etb.net.co | 2009-05-25 08:11:58 | 2010-04-08 18:41:45 |  |
| 3'322 | 222.73.17.7 | 2009-07-23 13:59:28 | 2010-02-08 11:51:03 |  | |
| 1'641 | 84.40.30.37 | ltf1010.tam.us.siteprotect.com | 2010-02-25 12:57:59 | 2010-06-09 03:39:33 |  |
| 1'600 | 87.98.222.207 | ns6683.ovh.net | 2009-06-01 15:00:25 | 2010-01-31 18:54:17 |  |
| 1'570 | 61.67.201.187 | 61-67-201-host187.kbtelecom.net.tw | 2010-03-24 16:27:27 | 2010-07-12 23:08:25 |  |
| 1'337 | 210.205.6.233 | 2009-07-18 22:33:46 | 2010-03-04 02:36:07 |  | |
| 1'329 | 218.38.243.71 | 2009-05-25 14:06:07 | 2010-06-16 07:55:59 | | |
| 1'283 | 74.124.198.60 | biz29.inmotionhosting.com | 2010-01-13 03:04:24 | 2010-06-28 19:06:48 | |
| 1'213 | 58.230.162.220 | onmam.com | 2010-01-21 17:38:51 | 2010-06-07 04:43:36 | |
| 1'203 | 79.170.45.126 | 2010-01-04 17:08:44 | 2010-02-02 16:03:47 |  | |
| 1'190 | 58.150.99.144 | 2010-02-13 12:46:00 | 2010-03-09 23:47:22 | | |
| 1'182 | 125.141.91.138 | 2010-01-07 07:50:15 | 2010-07-31 08:47:53 | | |
| 1'158 | 110.45.145.178 | 2010-02-03 22:10:08 | 2010-04-17 19:24:36 | | |
| 1'138 | 92.50.143.90 | 92.50.143.90.static.ufanet.ru | 2009-07-03 20:40:22 | 2009-12-14 17:05:19 |  |
| 1'101 | 67.227.136.138 | harris.webnethost.net | 2009-12-15 23:36:16 | 2010-03-18 22:06:58 | |
Top ten attacker countries
| Rank | Country | # of ips | in % |
| 1 | US | 2'618 | 28.91 |
| 2 | KR | 1'234 | 13.63 |
| 3 |  DE | 679 | 7.5 |
| 4 | RU | 407 | 4.49 |
| 5 |  CA | 390 | 4.31 |
| 6 |  BR | 356 | 3.93 |
| 7 |  IT | 332 | 3.67 |
| 8 | GB | 300 | 3.31 |
| 9 | FR | 291 | 3.21 |
| 10 |  NL | 238 | 2.63 |
| - | other | 2'211 | 24.41 |
You can get a list of all captured RFI URLs here: RFI URL list
You can get a list of all captured RFI attackers here: RFI attacker list