RE: Country of Origin for Malicious Attacks

[McBurnett, Jim]

Sean,
of the scans I get and have seen..
60% APNIC region
	Most noteably- Taiwan, China, and Korea (north)
20% RIPE 
	Most noteable- Former Soviet Block nations then
		Scandanavian countries...
20% ARIN/LACNIC
	
This is a rough estimate from the last 3 weeks...

I guess you may be after this kind of fact:
When I blocked HINET
(Taiwan based-- has a single /16 to my knowledge)
I cut scans/probes by 20%....


Later,
Jim


-----Original Message-----
From: sgorman1@gmu.edu [mailto:sgorman1@gmu.edu]
Sent: Wednesday, June 25, 2003 11:58 AM
To: nanog@merit.edu
Subject: Country of Origin for Malicious Attacks




I was wondering if folks had noticed any trends with malicious 
network attacks predominantly originating from any individual 
or group of countries.  Any observations, comments or help 
would be greatly appreciated.

Thanks,

sean