4 ms·

You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip} https://ip.guide/{src_ip}` and got back the ASN and country etc and added a l

by drcongo 3mo ago

You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip} https://ip.guide/{src_ip}` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.

reaperducer 3mo ago
In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.
- ok123456 3mo ago
  Closer to 95% if you count Teams.
  - razodactyl 3mo ago
    I appreciate you.
- drcongo 3mo ago
  Mine is very similar, but with DO and AWS swapped around.
- exiguus 3mo ago
  I have a similar experience with a tendency to Digital Ocean. Actually, I semi-automatically collect IPs that are banned by (mostly SSH) fail2ban and eBPF bans from dnsdist. These IPs are then merged into CIDRs, which are used as ipsets in a firewall ban chain. The IPs are collected on around ~20 Machines with public, static IPv4 and IPv6 addresses. Most of the Machines are in Canada and Europe. However, I have statistics for the CIDRs based on their whois record that look like: CIDRs used: 1255 Already cached: 1252 Skipped uncached targets: 0 IPs scanned total: 985300 Estimated throttled wait: 0.10 minutes == Country codes == Metric: Top 10 of 90 unique country codes Total: 1183 country codes total and 90 unique country codes in 1255 targets US 287 CN 132 NL 88 VN 53 DE 51 HK 45 AU 38 ID 36 RU 33 CA 27 == Regions == Metric: Top 10 of 29 unique regions Total: 334 regions total and 29 unique regions in 1255 targets CO 48 FL 40 WA 37 QLD 32 GA 26 NY 25 CA 23 TX 17 QC 15 UT 14 == Origin ASNs == Metric: Top 10 of 382 unique origin ASNs Total: 805 origin ASNs total and 382 unique origin ASNs in 1255 targets AS16276 26 AS132203 24 AS24086 18 AS38731 18 AS7552 18 AS24940 17 AS9808 15 AS135377 14 AS137718 13 AS62390 11 == Netnames == Metric: Top 10 of 630 unique netnames Total: 1157 netnames total and 630 unique netnames in 1255 targets RIPE 38 MSFT 31 SINGLEHOP 25 ACEVILLEPTELTD-SG 21 VIETTEL-VN 18 CMNET 17 APNIC 16 CHINANET-GD 14 VOLCANO-ENGINE 13 UCLOUD-HK 11 == Org names == Metric: Top 10 of 222 unique org names Total: 703 org names total and 222 unique org names in 1255 targets RIPE Network Coordination Centre 55 DigitalOcean, LLC 40 Asia Pacific Network Information Centre 32 Microsoft Corporation 31 Internap Holding LLC 25 HostPapa 23 Korea Telecom 20 Hetzner Online GmbH 17 China Mobile 16 ReliableSite.Net LLC 16 == Organizations == Metric: Top 10 of 236 unique organizations Total: 691 organizations total and 236 unique organizations in 1255 targets RIPE Network Coordination Centre (RIPE) 55 DigitalOcean, LLC (DO-13) 40 Asia Pacific Network Information Centre (APNIC) 32 Microsoft Corporation (MSFT) 31 Internap Holding LLC (IC-1425) 25 HostPapa (HOSTP-7) 23 ORG-HOA1-RIPE 17 ORG-CM1-AP 16 ReliableSite.Net LLC (RL-323) 15 FranTech Solutions (SYNDI-5) 13 == Domains == Metric: Top 10 of 534 unique domains Total: 2581 domains total and 534 unique domains in 1255 targets rdap.arin.net 404 apps.db.ripe.net 83 chinatelecom.cn 63 vnnic.vn 58 ripe.net 55 www.ripe.net 53 apnic.net 46 digitalocean.com 44 ovh.net 38 www.as14061.net 35 I deleted the (abuse) mail section. Because. 99% of the IPs are IPv4. In the IPset are mostly /32 but also a lot of ~/24 and rarely ~/16 segments. RIPE, ARIN and APNIC comes into play because some CIDR blocks are somewhat generously sized and block multiple network segments belonging to different organizations at the same time. E.g. this hides BR from the stats (because the ipset mostly bans every provider from BR).
  - drcongo 3mo ago
    Not sure why this got voted down to death, I found it interesting, thanks.
- yjftsjthsd-h 3mo ago
  100% is from those 4 clouds?

by drcongo 3mo ago

reaperducer 3mo ago

In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.

ok123456 3mo ago
Closer to 95% if you count Teams.
- razodactyl 3mo ago
  I appreciate you.
drcongo 3mo ago
Mine is very similar, but with DO and AWS swapped around.
exiguus 3mo ago
I have a similar experience with a tendency to Digital Ocean. Actually, I semi-automatically collect IPs that are banned by (mostly SSH) fail2ban and eBPF bans from dnsdist. These IPs are then merged into CIDRs, which are used as ipsets in a firewall ban chain. The IPs are collected on around ~20 Machines with public, static IPv4 and IPv6 addresses. Most of the Machines are in Canada and Europe. However, I have statistics for the CIDRs based on their whois record that look like: CIDRs used: 1255 Already cached: 1252 Skipped uncached targets: 0 IPs scanned total: 985300 Estimated throttled wait: 0.10 minutes == Country codes == Metric: Top 10 of 90 unique country codes Total: 1183 country codes total and 90 unique country codes in 1255 targets US 287 CN 132 NL 88 VN 53 DE 51 HK 45 AU 38 ID 36 RU 33 CA 27 == Regions == Metric: Top 10 of 29 unique regions Total: 334 regions total and 29 unique regions in 1255 targets CO 48 FL 40 WA 37 QLD 32 GA 26 NY 25 CA 23 TX 17 QC 15 UT 14 == Origin ASNs == Metric: Top 10 of 382 unique origin ASNs Total: 805 origin ASNs total and 382 unique origin ASNs in 1255 targets AS16276 26 AS132203 24 AS24086 18 AS38731 18 AS7552 18 AS24940 17 AS9808 15 AS135377 14 AS137718 13 AS62390 11 == Netnames == Metric: Top 10 of 630 unique netnames Total: 1157 netnames total and 630 unique netnames in 1255 targets RIPE 38 MSFT 31 SINGLEHOP 25 ACEVILLEPTELTD-SG 21 VIETTEL-VN 18 CMNET 17 APNIC 16 CHINANET-GD 14 VOLCANO-ENGINE 13 UCLOUD-HK 11 == Org names == Metric: Top 10 of 222 unique org names Total: 703 org names total and 222 unique org names in 1255 targets RIPE Network Coordination Centre 55 DigitalOcean, LLC 40 Asia Pacific Network Information Centre 32 Microsoft Corporation 31 Internap Holding LLC 25 HostPapa 23 Korea Telecom 20 Hetzner Online GmbH 17 China Mobile 16 ReliableSite.Net LLC 16 == Organizations == Metric: Top 10 of 236 unique organizations Total: 691 organizations total and 236 unique organizations in 1255 targets RIPE Network Coordination Centre (RIPE) 55 DigitalOcean, LLC (DO-13) 40 Asia Pacific Network Information Centre (APNIC) 32 Microsoft Corporation (MSFT) 31 Internap Holding LLC (IC-1425) 25 HostPapa (HOSTP-7) 23 ORG-HOA1-RIPE 17 ORG-CM1-AP 16 ReliableSite.Net LLC (RL-323) 15 FranTech Solutions (SYNDI-5) 13 == Domains == Metric: Top 10 of 534 unique domains Total: 2581 domains total and 534 unique domains in 1255 targets rdap.arin.net 404 apps.db.ripe.net 83 chinatelecom.cn 63 vnnic.vn 58 ripe.net 55 www.ripe.net 53 apnic.net 46 digitalocean.com 44 ovh.net 38 www.as14061.net 35 I deleted the (abuse) mail section. Because. 99% of the IPs are IPv4. In the IPset are mostly /32 but also a lot of ~/24 and rarely ~/16 segments. RIPE, ARIN and APNIC comes into play because some CIDR blocks are somewhat generously sized and block multiple network segments belonging to different organizations at the same time. E.g. this hides BR from the stats (because the ipset mostly bans every provider from BR).
- drcongo 3mo ago
  Not sure why this got voted down to death, I found it interesting, thanks.
yjftsjthsd-h 3mo ago
100% is from those 4 clouds?