Akamai Technologies, the cloud platform provider for helping enterprises provide secure, high-performing user experiences, today released its First Quarter, 2013 State of the Internet Report. Based on data gathered from the Akamai Intelligent Platform, the report provides insight into key global statistics such as network connectivity and connection speeds, attack traffic and broadband adoption and availability, among many others.
The First Quarter, 2013 State of the Internet Report includes new observations on “account checker” attacks targeting e-commerce sites and the impact on Akamai traffic from events including the death of Hugo Chavez, announcement of the new Pope, and undersea cable disruptions. The report also reviews mobile browser usage by network type based on data from Akamai IO.
Highlights from Akamai’s First Quarter, 2013 State of the Internet Report:
Global Internet Penetration
More than 733 million unique IPv4 addresses from 243 countries/regions connected to the Akamai Intelligent Platform, an increase of 3.1% over the previous quarter and 10% year over year. Since a single IP address can represent multiple individuals in some cases – such as when users access the web through a firewall or proxy server – Akamai estimates the total number of unique web users connecting to its platform during the quarter to be well over one billion.
Among the top 10 countries that connected to the Akamai Intelligent Platform in the first quarter, quarterly growth ranged from 0.7% in Germany to 5.3% in China. Across the full set of observed countries/regions worldwide, nearly 75% saw a quarterly increase in unique IP address counts.
Year-over-year, the number of global unique IP addresses connecting to Akamai grew by 10% – an increase of more than 73 million over the first quarter of 2012. Among the top 10 countries, yearly growth ranged from 1% in the US to double-digit growth in the UK (11%), Russia (15%), Italy (20%), China (20%) and Brazil (38%). Worldwide, nearly 75% of countries/regions had higher unique IP address counts year-over-year.
Attack Traffic and Top Ports Attacked
Akamai maintains a distributed set of unadvertised agents deployed across the Internet that log connection attempts, which the company classifies as attack traffic. Based on the data collected by these agents, Akamai is able to identify the top countries from which attack traffic originates, as well as the top ports targeted by these attacks. It is important to note, however, that the originating country as identified by the source IP address may not represent the nation in which an attacker resides. For example, an individual in the US may be launching attacks from compromised systems anywhere in the world.
Akamai observed attack traffic originating from 177 unique countries/regions during the first quarter of 2013, the same number that was observed in the fourth quarter of 2012. While China kept its position as the single-largest volume source of observed traffic with 34% of the total (down from 41% in the previous quarter), Indonesia took over second place with 21% of observed traffic (up from 0.7% in the previous quarter). The US dropped from second to third with 8.3% of observed traffic (down from 10% in the previous quarter).
The top 10 countries/regions generated more than 80% of the observed attack traffic during the quarter. More than half of the total observed attack traffic originated from China and Indonesia.
Port 445 (Microsoft-DS) continued to be the most targeted port in the first quarter, receiving 23% of observed attack traffic. Port 80 (WWW HTTP) was second at 14% with a majority of these attacks observed to be originating in Indonesia.
Observations on DDoS Attacks
Starting in the fourth quarter of 2012, the State of the Internet Report includes insight into DDoS attacks based on reports from Akamai customers. In the first quarter of 2013, Akamai customers reported 208 attacks, up slightly from the 200 reported in the previous quarter. Of those attacks, 35% targeted Enterprise customers; 32% were focused on Commerce customers; 22% on Media customers; 7% on High Tech customers; and 4% targeted Public Sector customers. Attacks were reported by 154 different organizations in the first quarter of 2013.
‘Account Checker’ Attacks
In the first quarter of 2013, Akamai observed attempted account takeover behavior for numerous e-commerce organizations that resulted from reuse of credentials obtained from other sites. Using automated tools known as “account checkers,” attackers can quickly determine valid user ID/password combinations across a large number of e-commerce sites. Once an account is breached, attackers can collect a user’s personal data and credit card information to use for further fraud.
Global Average and Peak Connection Speeds
Quarter-over-quarter, the global average connection speed rose 4% to 3.1 Mbps (up from 2.9 Mbps). A total of 117 countries/regions that qualified for inclusion saw average connection speeds increase this quarter, ranging from 0.7% in Kuwait to 75% in Guatemala.
Year-over-year, average connection speeds grew by 17%, with eight of the top 10 nations/regions growing by double-digit percentages. Around the world, 123 qualifying countries/regions saw a year-over-year increase in average connection speeds, ranging from 1.4% in Oman to 122% in Iraq.
Global average peak connection speeds increased 9.2% to 18.4 Mbps during the first quarter of 2013. Hong Kong was again number one at 63.6 Mbps, an increase of 9% over the previous quarter.
Year-over-year, global average peak connection speeds continued to show strong long-term growth, rising 36%.
Global broadband (>4 Mbps) adoption increased 5.8% during the quarter to reach 46%. Global high broadband (>10 Mbps) reached 13% on a 10% increase over last quarter.
“This quarter’s State of the Internet Report shows continued positive growth in terms of Internet and broadband adoption worldwide. We have seen overall increases in average and peak connection speeds along with greater broadband penetration on both a quarterly and annual basis,” said David Belson, the report’s editor.
“However, the levels of malicious activity we’ve observed show no signs of abating, as evidenced by the ongoing rise in DDoS attacks. This reinforces the continued need for vigilance by organizations that are conducting business and maintaining a presence on the Internet,” added Belson.
Mobile Connectivity
In the first quarter of 2013, average connection speeds on surveyed mobile network operators ranged from a high of 8.6 Mbps to a low of 0.4 Mbps. Nine operators demonstrated average connection speeds in the broadband (>4 Mbps) range while 64 more operators showed average connection speeds above 1 Mbps. Data collected by Ericsson indicates that the volume of mobile data traffic doubled from the first quarter of 2012 to the first quarter of 2013, and grew 19% between the fourth quarter of 2012 and the first quarter of 2013.
An initial release of an updated data source for Akamai IO occurred in mid-February 2013, resulting in significant changes in observed device/browser adoption levels. For the first half of the quarter, mobile devices on cellular networks using the Android Webkit accounted for just over 41% of total requests, while Apple Mobile Safari accounted for 38%.
In the second half of the quarter, Android Webkit was responsible for nearly 44% of requests and Apple Mobile Safari accounted for just over 30%. When measuring mobile devices across all network types, Apple Mobile Safari accounted for approximately 60% and Android Webkit was responsible for 20-33% of requests.