We would like to present the 2006 Philippine internet security statistics based on the data collected through the joint Leurre.com - Philippine Honeynet Project endeavor.

What follows are the highlights of the findings for the past year, 2006:

• The Philippines had the 6th highest internet attacks among the 20 partner nations with an average of 336.2 attacks per day per sensor
• In a local perspective, majority of attacks directed to the Philippines were local attacks, meaning it came from the Philippines itself (31.96 attacks/day/sensor). It is followed closely by those coming from China, Malaysia, Japan, Korea and the United States
• In a worldwide perspective, sensors from other countries detected just a small percentage of attacks coming from the Philippines (0.61attacks/day/sensor). Majority of the attacks monitored came from the United States and China.
• The top ports or services attacked in the Philippines sensors were:
  • 445 - Microsoft Directory Services
  • 135 - DCOM Service Control Manager
  • 139 - NETBIOS Session Service
  • 1433 - Microsoft-SQL-Server
  • 80 - World Wide Web HTTP
  
  Note that most of these ports, except probably for port 80 are ports usually used exclusively by Windows services


• Philippine-directed attacks were highest starting from 3PM and were maintained at a constant rate until midnight. Attacks were lowest between 2 to 6 AM.
• Most attacks are coming from or are staged from Windows machines particularly from Windows 2000 and XP machines. This could indicate higher botnet, malware or worm activity from Windows machines, probably because of it's larger deployment around the world
• Attacks were highest in the last quarter of the year particularly on October and November, consistent with last years report

The full report with the supporting data can be downloaded here