April 23, 2013 Akamai Releases Fourth Quarter 2012 State of the Internet ReportContacts
Chris Nicholson
Media Relations
617-444-2987
cnichols@akamai.com
or Natalie Temple
Investor Relations
617-444-3635
ntemple@akamai.com
Nearly 700 million unique IP addresses connected to Akamai Intelligent Platform
Reported DDoS attacks grow more than 200 percent year over year
Global average peak connection speed jumps 35 percent year over year
CAMBRIDGE, MA April 23, 2013 Akamai Technologies, Inc. (NASDAQ: AKAM), the leading cloud platform for helping enterprises provide secure, high-performing user experiences on any device, anywhere, today released its Fourth Quarter, 2012 State of the Internet Report. Based on data gathered from the Akamai Intelligent Platform , the report provides insight into key global statistics including connection speeds, attack traffic, and network connectivity and availability, among many others.
The Fourth Quarter, 2012 State of the Internet Report includes new observations on Distributed Denial of Service (DDoS) attacks, analysis of Phase II of the Operation Ababil attacks, and examinations of Internet disruptions in Syria, Bangladesh, and Senegal. The report also reviews mobile browser usage by network connection type collected by Akamai IO.
Highlights from Akamais Fourth Quarter, 2012 Report:
Global Internet Penetration
Nearly 700 million unique IPv4 addresses from 240 countries/regions connected to the Akamai Intelligent Platform - 4.2 percent more than in the third quarter of 2012 and 13 percent more than in the fourth quarter of 2011. Since a single IP address can represent multiple individuals in some cases - such as when users access the Web through a firewall or proxy server - Akamai estimates the total number of unique Web users connecting to its platform during the quarter to be well over one billion.
Quarterly growth among all of the top 10 countries ranged from 1.1 percent in Japan to 5.1 percent in Russia. Among the full set of countries/regions worldwide that connected to the Akamai Intelligent Platform, 75 percent saw a quarterly increase in unique IP address counts.
Year-over-year, the global unique IP address count increased by nearly 10 percent, or more than 71 million, compared to the fourth quarter of 2011. Among the top 10 countries, yearly growth ranged from less than 1 percent in South Korea and Japan (0.2 percent and 0.8 percent, respectively) to double-digit growth rates in Russia (13 percent), China (19 percent), Italy (21 percent) and Brazil (33 percent). Globally, 79 percent of countries/regions had higher unique IP address counts year-over-year.
Attack Traffic and Top Ports Attacked
Akamai maintains a distributed set of unadvertised agents deployed across the Internet that log connection attempts, which the company classifies as attack traffic. Based on data collected by these agents, Akamai is able to identify the top countries from which attack traffic originates, as well as the top ports targeted by these attacks. It is important to note, however, that the originating country as identified by the source IP address may not represent the nation in which an attacker resides. For example, an individual in the United States may be launching attacks from compromised systems in China.
Akamai observed attack traffic from 177 unique countries/regions during the fourth quarter of 2012, down from 180 in the third quarter. China again maintained its position as the single largest volume source of observed traffic at 41 percent of the total, up from 33 percent in the prior quarter. The United States remained in the number two spot despite a drop in observed attack traffic from 13 percent to 10 percent in the fourth quarter. Turkey took over Russias number three spot with 4.7 percent.
The top 10 countries/regions generated 75 percent of the observed attack traffic during the quarter. China and the United States were responsible for slightly more than 50 percent of total attack traffic.
Port 445 (Microsoft-DS) remained the most targeted port in the fourth quarter, receiving 29 percent of attack traffic. Port 23 (Telnet) was again second at 7.2 percent.
Observations on DDoS Attacks
For the first time, the report includes insight into DDoS attacks reported by Akamai customers. Data from this quarters report will serve as a baseline for future comparisons. Akamai customers reported 768 DDoS attacks in 2012, up more than 200 percent from 2011. Of those, 35 percent targeted companies in the Commerce sector and 22 percent focused on Media and Entertainment companies. Enterprise companies, which include financial services, were subject to 20 percent of reported attacks; 14 percent targeted High Tech and nine percent of reported attacks were directed toward Public Sector agencies. The 768 attacks were reported by 413 unique organizations, indicating that many organizations were targeted more than once - some significantly more.
Operation Ababil, Phase II
As highlighted in the report for the third quarter of 2012, Akamai was involved in protecting some of the organizations targeted by the Operation Ababil series of DDoS attacks. Those attacks continued through October before pausing until December 25, at which point they carried on into January of 2013.
As in the first phase, attackers continued to leverage the BroBot botnet to launch their attacks, and have varied the attacks in an attempt to evade filtering, primarily through the altering of query strings, user-agents, and targeted URLs. BroBot nodes have been observed sending traffic bursts at a rate of up to 10,000 requests per minute per node, and as many as 18 million attack requests per second.
Global Average and Peak Connection Speeds
Quarter-over-quarter, the global average connection speed rose 5 percent to 2.9 Mbps. Further, a total of 98 countri
