Active IP Block Lists Representation

Cartographic representation of the amount of networks that have been refused access per country. This is a historic collection of data obtained over time. To get an idea of how this comes to be see the live Internet traffic page for actual and current Internet inbound data processing.

Top 20 abusive Internet activity by countries

A list of the top 20 most aggressive and abusive Internet activities detected and blocked ranked by country (not including data centers).

IP blocking. Why and how.

Wanting to continue on the geographic mapping experience of Cartographic live web visitors overview, however this time I wanted to see how many hack attempts were coming from which country as source, using various intrusion detection and intrusion prevention systems.

The hunt for a country outline source led me to thematicmapping.org, besides the fact that some borders are disputed (probably always will be), an excellent high definition country border shape file source. Thanks to Bjorn Sandvik for providing this.

Another challenge was the fact that these files were shape files and very high resolution many MB in size not good for fast web transfer. Leaflet can work really well with Geo-JSON data and not with shape files at all, so the need to simplify the outlines for a small data footprint and thus faster loading, as well converting it from shape file to Geo-JSON was on. This led me to GDAL and from here I was able to produce a low resolution Geo-JSON file of world country outlines

Avoiding the 'try your luck scripting kiddies', I'm looking at Internet conduct unbecoming as a bigger (definitely organized) picture. This entails brute force access attempts, exploits, spy-ware, exploited and plundered social media accounts (this is thriving business at present) and a LOAD more, also taking into account the frequency of the attempts and the ISP/ASN's involved What is missing in this picture are complete ASN blocks, at present only one 'Digital Ocean AS14061' as their very affordable short term VPS solutions have drawn many unsavory clients, that when reported they do nothing about (just like Amazon in the old days).

Enough about the vague way IP addresses are accumulated. Once identified, the assigned country that IP range was assigned to at the time of the detection needs to be determined. I use AbuseIPDB. They are not always up to date and lag behind, but that can be because they only track certain types of attacks. This is my first 'goto service' to get country information as well a check to see if others have been abused from said IP address(es) before I detected them.

IP blacklisting

See what I do, but don't do as I do.

For the following reasons.

• There is no commercial interests on information, services, tools, utilities and source code that is on-line and completely free to use (not abuse) at will.
• All on-line services are equipped to detect targeted and purposed abuse, from zero-day exploits to crafty distributed multi-targeted and coordinated sniffing and attacks.
• No distinction is made between private (hacked personal computers), corporate or institutional organizations (read hacker groups and [politically motivated] governments)
• Use it, don't abuse it or loose it, is strictly enforced. One strike and you're out.
• Bad ISP's who do not do anything about conduct unbecoming from some of their IP ranges are completely blocked (Digital Ocean, OVH and more) also cloud services from Microsoft, Amazon and Google are amongst the refused class-C IP ranges. Because generally Data Centers should not be trying to exploit Internet services to begin with!

Thus if your Internet facing services have your commercial interest at heart, it is not advisable to use of the data presented here. As you want to be exposed to as great an audience as possible. And as you can see the approach taken here has a lot of collateral damage which is not good for business. There are other ways to do this however they rely on third party (paid) services.

What to see the Internet traffic arriving at this front door? Have a look here, you may well be surprised at how much effort is put into exploitation via Internet.

If you want more extensive information on how IP block lists are created and maintained, I highly recommend looking at information provided by 'FireHOL'.

IP block lists as currently used by this entity......

• Proxy IP Block list date: 10/15/2024 3:52:28 PM (UTC) size: 66.4 KB bytes. Contains 4707 IP Addresses and ranges.
• Compromised IP Block list date: 10/15/2024 8:35:56 AM (UTC) size: 8.3 KB bytes. Contains 577 IP Addresses and ranges.
• Attack IP Block list date: 10/15/2024 4:00:36 PM (UTC) size: 368.3 KB bytes. Contains 26509 IP Addresses and ranges.
• Level 1 IP Block list date: 10/15/2024 5:23:48 PM (UTC) size: 63.2 KB bytes. Contains 4118 IP Addresses and ranges.
• Level 2 IP Block list date: 10/14/2024 8:59:40 PM (UTC) size: 269.7 KB bytes. Contains 19224 IP Addresses and ranges.
• Level 3 IP Block list date: 10/15/2024 6:26:15 AM (UTC) size: 239.1 KB bytes. Contains 16990 IP Addresses and ranges.
• Level 4 IP Block list date: 10/15/2024 5:22:12 PM (UTC) size: 2.1 MB bytes. Contains 154474 IP Addresses and ranges.
• TOR Exit Node list date: 10/15/2024 5:57:54 AM (UTC) size: 17.8 KB bytes. Contains 1269 IP Addresses.

IP black list usage

You are free to use these provided IP block lists as you see fit at your own risk. Should you automate downloading any of these IP block lists, as they are updated daily, please don't download more than twice a day. Abuse may get you blocked.