There are many reputation databases out, trying to find the right model to compare ISPs in an effective way, on how “bad” or “good” they are. Some of them do that on total numbers of “blacklistings” or “malware incidents”, regardless of the number of existing contracts or domains they control. Others do this IP based, without taking the possibility in account that potentially thousands of customers domains are located on one single host! There are many, many more ways …

We, cyscon GmbH, believe that most fairest and most convincing way to do that is on comparing their “Notice-and-Takedown” procedures with each other. Therefore we have compared those 20 ISPs (or better said Autonomous Systems), who are responsible for 50% of the malware urls, we have in our databases), and how long it took after the abuse department receive our abuse complaint and till our frequently checking crawlers consider an issue as resolved:

1. AS32613 solves reported incidents in an average of 158 hours (about 7 days)
2. AS32475 solves reported incidents in an average of 151 hours (about 6 days)
3. AS28753 solves reported incidents in an average of 147 hours (about 6 days)
4. AS16276 solves reported incidents in an average of 141 hours (about 6 days)
5. AS26496 solves reported incidents in an average of 141 hours (about 6 days)
6. AS36351 solves reported incidents in an average of 140 hours (about 6 days)
7. AS16265 solves reported incidents in an average of 138 hours (about 6 days)
8. AS21844 solves reported incidents in an average of 136 hours (about 6 days)
9. AS8972 solves reported incidents in an average of 135 hours (about 6 days)
10. AS33626 solves reported incidents in an average of 132 hours (about 6 days)
11. AS20773 solves reported incidents in an average of 132 hours (about 6 days)
12. AS6724 solves reported incidents in an average of 130 hours (about 5 days)
13. AS8560 solves reported incidents in an average of 128 hours (about 5 days)
14. AS21788 solves reported incidents in an average of 128 hours (about 5 days)
15. AS33182 solves reported incidents in an average of 126 hours (about 5 days)
16. AS16626 solves reported incidents in an average of 122 hours (about 5 days)
17. AS32244 solves reported incidents in an average of 115 hours (about 5 days)
18. AS24940 solves reported incidents in an average of 113 hours (about 5 days)
19. AS26347 solves reported incidents in an average of 108 hours (about 5 days)
20. AS46606 solves reported incidents in an average of 108 hours (about 5 days)

We do not want to blame any ISP with that statistic, we just want to point out, that some ISPs are more speedy than others in solving the problem on their customers websites / servers.