Country of Origin for Malicious Attacks

Wed Jun 25 16:06:21 UTC 2003

Sean,
of the scans I get and have seen..
60% APNIC region
	Most noteably- Taiwan, China, and Korea (north)
20% RIPE 
	Most noteable- Former Soviet Block nations then
		Scandanavian countries...
20% ARIN/LACNIC

This is a rough estimate from the last 3 weeks...

I guess you may be after this kind of fact:
When I blocked HINET
(Taiwan based-- has a single /16 to my knowledge)
I cut scans/probes by 20%....

Later,
Jim

-----Original Message-----
From: sgorman1 at gmu.edu [mailto:sgorman1 at gmu.edu]
Sent: Wednesday, June 25, 2003 11:58 AM
To: nanog at merit.edu
Subject: Country of Origin for Malicious Attacks

I was wondering if folks had noticed any trends with malicious 
network attacks predominantly originating from any individual 
or group of countries.  Any observations, comments or help 
would be greatly appreciated.

Thanks,

sean