A week ago, StopBadware reported on five web hosting providers hosting large numbers of the sites listed in our Badware Website Clearinghouse. Today, we have new information to share about how some of those web hosts are working to keep their hosted sites clean and secure. Our data last week featured five hosting providers of sites that are listed in our Clearinghouse. Sites in the Clearinghouse have been reported to us by trusted partners as hosting or distributing badware, often as the result of hacking attacks by malicious third parties. Our data reflects sites that are part of our Clearinghouse, and does not necessarily reflect the internet as a whole.

The top site in our listings was iPowerWeb, at 10,843 sites. We’re happy to report that we are now in contact with iPowerWeb, and that it has demonstrated a commitment to working proactively to combat badware. iPowerWeb has informed us that it has located and removed badware-distributing code from thousands of its sites that are listed in our Clearinghouse. These sites will now be reviewed according to our usual process. All sites that are confirmed to be clean will then be removed from the Badware Website Clearinghouse.

StopBadware has also been contacted by two other hosting providers we identified, Internap Network Services and Layered Technologies. We’re looking forward to working with these and other hosting providers to help combat badware at the hosting level. Check back soon for more updates.

StopBadware recently analyzed 49,296 sites which were submitted by trusted third parties to our Badware Website Clearinghouse. We identified five web hosting companies with the largest number of infected sites residing on their servers:

• iPowerWeb, Inc., (10,834)
• Layered Technologies, (2,513)*
• ThePlanet.com Internet Services, Inc, (2,056)
• Internap Network Services, (1,437)
• CHINANET Guangdong province network, (786)

Many of the sites listed in the Clearinghouse as distributors of badware are otherwise innocent sites that have been hacked into by third parties. If a provider hosts a large number of sites that distribute badware, it’s possible that the provider has unaddressed security vulnerabilities that increase the likelihood of the sites the provider hosts being hacked.

iPowerWeb, one of the world’s largest hosting providers, hosts a startlingly high number of sites in the Clearinghouse. iPowerWeb’s homepage claims that the provider hosts over 700,000 sites; at 10,834, more than 1.5 percent of those can infect internet users with badware.

StopBadware spoke with some owners of websites in our Clearinghouse that are hosted by iPowerWeb. To iPowerWeb’s credit, many of their customers report that iPowerWeb personnel quickly located and removed the badware or badware-distributing code from their sites. Some customers complained, however, was that iPowerWeb support personnel were unable to provide details about how the websites were compromised.

StopBadware encourages all web hosting providers to work proactively to stem the spread of badware on the internet. StopBadware co-director John Palfrey says, “Web hackers and badware distributors are constantly finding new ways to work around the safeguards that are put in place to protect consumers. Web hosting providers must do their part to stay ahead of the curve and help keep the websites they host safe from malicious attacks.”

You can read our full press release here. If you’d like to comment on this information, or share a story about your own experiences with a web hosting provider to address a compromised site, please visit our discussion group.

* NOTE: Layered Technologies has informed us that it provides a style of web hosting known as self-managed hosting, in which its customers have full control over and responsibility for server management.