The document discusses trust hacking and web risks in 2017. It found that every website calls on an average of 25 background sites for content. More than 32,000 sites relied on the vulnerable Microsoft IIS 7.5 software from 2009. The business and economy category had the most "known bad" sites and vulnerable sites, and suffered the most breaches over the last year compared to other categories. Categories of websites can change their reputations and phishing sites were found across different categories using legitimate hosting services.

1. Trust Hacking
State of the Web 2017

2. | © 2018 / Menlo Security, Inc. All rights reserved.2
Weaponizing Trust

3. | © 2018 / Menlo Security, Inc. All rights reserved.3
Background Radiation
Our researchers found that every
time a user visits a website, that site
calls on an average of 25
background sites for content

4. | © 2018 / Menlo Security, Inc. All rights reserved.4
Widespread Use of Vulnerable Software
More than 32,000 of the
sites we studied rely on
Microsoft IIS 7.5, which
was released in 2009

5. | © 2018 / Menlo Security, Inc. All rights reserved.5
Web Risk by Category

6. | © 2018 / Menlo Security, Inc. All rights reserved.6
Top Categories with Known Bad Sites
Consider Business and Economy.
It had more “known bad” sites than
any other traditionally trusted
category, with more than 12,000.
That’s fewer than in Adult and
Pornography, but more than in
Gambling.

7. | © 2018 / Menlo Security, Inc. All rights reserved.7
Top Categories with Vulnerable Sites
More sites in Business and Economy
relied on vulnerable software than
in any other category, for the
second year in a row. Many of these
sites still use Microsoft’s IIS 5 web
server, which the company stopped
supporting 12 years ago.

8. | © 2018 / Menlo Security, Inc. All rights reserved.8
Top Categories with Recent Threat History
Business and Economy sites also in the
Last Year suffered more breaches and
other successful attacks than any other
category.

9. | © 2018 / Menlo Security, Inc. All rights reserved.9
Categories Can and Will Change
One reputation service rightly identified
email.complianceonline.com as malicious—
except for a brief period when it didn’t.

10. | © 2018 / Menlo Security, Inc. All rights reserved.10
Categories Containing Phishing Sites
In 2017, we discovered
4,600 phishing sites using legitimate
hosting services.

11. | © 2018 / Menlo Security, Inc. All rights reserved.11
Common Typosquatting Categories

12. | © 2018 / Menlo Security, Inc. All rights reserved.12
Best Practices to Mitigate Web and Email Risk

13. | © 2018 / Menlo Security, Inc. All rights reserved.13
Download the Report Today
http://info.menlosecurity.com/state-of-the-web-2017.html