Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

31–40 of 124 posts

Re: Visualizing malicious IP addresses

#32

Post by keepamovin »

This was cool. The makings of an adhoc DIY cyber intelligence dashboard.

I guess the distribution could reflect places with lower income levels looking to get free compute? (for whatever purposes). A lot are coming out of places where relative cost of compute compared to income, may be too high, alternately there may not have access to accepted payment methods?

For the servers coming from the US and developed East Asia it could be already cyber companies doing scanning to find clients, or already compromised servers?

Re: Visualizing malicious IP addresses

#33

Post by tomschlick »

ies7 wrote: post #28

> Interesting! We can see the most locations in India, Indonesia, and China as well as a significant number in the US and Europe. Are these because the bad guys are in there or just because of the population size? China, India, US, and Indonesia are the top four of the most populous country and also 4 countries with most internet users. Even the size of 10% of Indonesian internet users are almost the entire Taiwan po…

> Are these because the bad guys are in there or just because of the population size?

Yes

Re: Visualizing malicious IP addresses

#34

Post by chriscjcj »

It's been a couple decades since I adminned servers and firewalls. In my experience, in the early 2000's, Russian IPs were extremely common. I was surprised that OP didn't see even one. Can anyone conjecture on what might account for the apparent change?

Re: Visualizing malicious IP addresses

#36

Post by efnx »

chriscjcj wrote: post #34

It's been a couple decades since I adminned servers and firewalls. In my experience, in the early 2000's, Russian IPs were extremely common. I was surprised that OP didn't see even one. Can anyone conjecture on what might account for the apparent change?

The Russians are probably tunnelling through another connection or are steering a botnet.

Re: Visualizing malicious IP addresses

#37

Post by bauruine »

mo_42 wrote: post #25

It's not so hard to use Tor for that. I wonder how the Tor exit nodes are distributed across the globe and see how that correlates or not.

I don't have exactly what you want but you would be very disappointed by the result anyway. Tor isn't as nefarious as people tend to believe.

  [bauruine@tp:projects/misc]$ python check_ip_tor.py /tmp/malicious_ips.txt
  Got a total of 6303 malicious IPs
  Of which 15 are Tor relays
Edit: Small addendum here are the worst 5 ASNs.

  1607 TENCENT-NET-AP-CN
  738  DIGITALOCEAN-ASN
  483  KIXS-AS-KR 
  205  GOOGLE-CLOUD-PLATFORM
  115  OVH

Re: Visualizing malicious IP addresses

#38

Post by apstls »

micw wrote: post #30

"Failed publickey" - does this make sense? What is the chance to brute-force a private key that way?

It could be key spraying, maybe targeting a particular organization with distributed infrastructure for which the attacker already has some keys, but more likely groups blasting default keys (i.e. for some crappy IoT devices that included them in the firmware etc) for a nice & quick botnet.

Re: Visualizing malicious IP addresses

#40

Post by johanbcn »

chriscjcj wrote: post #34

It's been a couple decades since I adminned servers and firewalls. In my experience, in the early 2000's, Russian IPs were extremely common. I was surprised that OP didn't see even one. Can anyone conjecture on what might account for the apparent change?

> Can anyone conjecture on what might account for the apparent change?

Many companies that do not have business in countries known for their abundance of bad actors will block their IP ranges right away.

Nowadays hackers worth their salt will make use of botnets and VPNs located at more "friendly" countries.

Post reply on HN