In its State of the Internet report for the fourth quarter 2009, Akamai said that the US moved back up into second place in its list of countries serving attack traffic. It represented 12% of malicious traffic in the last three months of 2009, compared to 6.9% in the third quarter. The US toppled Brazil from the second slot, relegating it to fourth place.
"Once again, port 445 was overwhelmingly the top port targeted by attacks among the top 10 countries, in some cases by orders of magnitude more than the next most targeted port," said the report. It mused that this might indicate continued activity from the Conficker internet worm, which other reports have suggested now infects 6.5 million PCs globally. "However, it may also indicate a resurgence of older worms such as Lioten, Randex, and Deloader based on comments posted to the SANS Internet Storm Center page for port 445." The second most targeted port in most countries was either 22 or 23, which Akamai said could indicate brute force login attempts over SSH or telnet.
A dramatic increase in the number of port scans increased what Akamai categorized as attack traffic almost threefold between the two quarters. The US was the top source of port scans by far, lagged by India in second place.