[reaperducer]

In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.

I'm currently fighting this battle.

As of this morning:

  80% of malicious traffic comes from Azure.
  10% from Digital Ocean.
  5% from AWS.
  5% from GCP.

[ok123456]

Closer to 95% if you count Teams.

[razodactyl]

I appreciate you.

[drcongo]

Mine is very similar, but with DO and AWS swapped around.

[yjftsjthsd-h]

100% is from those 4 clouds?

[exiguus]

I have a similar experience with a tendency to Digital Ocean. Actually, I semi-automatically collect IPs that are banned by (mostly SSH) fail2ban and eBPF bans from dnsdist. These IPs are then merged into CIDRs, which are used as ipsets in a firewall ban chain. The IPs are collected on around ~20 Machines with public, static IPv4 and IPv6 addresses. Most of the Machines are in Canada and Europe.

However, I have statistics for the CIDRs based on their whois record that look like:

CIDRs used: 1255

Already cached: 1252

Skipped uncached targets: 0

IPs scanned total: 985300

Estimated throttled wait: 0.10 minutes

== Country codes ==

Metric: Top 10 of 90 unique country codes

Total: 1183 country codes total and 90 unique country codes in 1255 targets

  US  287
  CN  132
  NL  88
  VN  53
  DE  51
  HK  45
  AU  38
  ID  36
  RU  33
  CA  27
  

== Regions ==

Metric: Top 10 of 29 unique regions

Total: 334 regions total and 29 unique regions in 1255 targets

  CO  48
  FL  40
  WA  37
  QLD  32
  GA  26
  NY  25
  CA  23
  TX  17
  QC  15
  UT  14
  

== Origin ASNs ==

Metric: Top 10 of 382 unique origin ASNs

Total: 805 origin ASNs total and 382 unique origin ASNs in 1255 targets

  AS16276  26
  AS132203  24
  AS24086  18
  AS38731  18
  AS7552  18
  AS24940  17
  AS9808  15
  AS135377  14
  AS137718  13
  AS62390  11
  

== Netnames ==

Metric: Top 10 of 630 unique netnames

Total: 1157 netnames total and 630 unique netnames in 1255 targets

  RIPE  38
  MSFT  31
  SINGLEHOP  25
  ACEVILLEPTELTD-SG  21
  VIETTEL-VN  18
  CMNET  17
  APNIC  16
  CHINANET-GD  14
  VOLCANO-ENGINE  13
  UCLOUD-HK  11
  

== Org names ==

Metric: Top 10 of 222 unique org names

Total: 703 org names total and 222 unique org names in 1255 targets

  RIPE Network Coordination Centre  55
  DigitalOcean, LLC  40
  Asia Pacific Network Information Centre  32
  Microsoft Corporation  31
  Internap Holding LLC  25
  HostPapa  23
  Korea Telecom  20
  Hetzner Online GmbH  17
  China Mobile  16
  ReliableSite.Net LLC  16
  

== Organizations ==

Metric: Top 10 of 236 unique organizations

Total: 691 organizations total and 236 unique organizations in 1255 targets

  RIPE Network Coordination Centre (RIPE)  55
  DigitalOcean, LLC (DO-13)  40
  Asia Pacific Network Information Centre (APNIC)  32
  Microsoft Corporation (MSFT)  31
  Internap Holding LLC (IC-1425)  25
  HostPapa (HOSTP-7)  23
  ORG-HOA1-RIPE  17
  ORG-CM1-AP  16
  ReliableSite.Net LLC (RL-323)  15
  FranTech Solutions (SYNDI-5)  13
  

== Domains ==

Metric: Top 10 of 534 unique domains

Total: 2581 domains total and 534 unique domains in 1255 targets

  rdap.arin.net  404
  apps.db.ripe.net  83
  chinatelecom.cn  63
  vnnic.vn  58
  ripe.net  55
  www.ripe.net  53
  apnic.net  46
  digitalocean.com  44
  ovh.net  38
  www.as14061.net  35
  

I deleted the (abuse) mail section. Because. 99% of the IPs are IPv4. In the IPset are mostly /32 but also a lot of ~/24 and rarely ~/16 segments. RIPE, ARIN and APNIC comes into play because some CIDR blocks are somewhat generously sized and block multiple network segments belonging to different organizations at the same time. E.g. this hides BR from the stats (because the ipset mostly bans every provider from BR).

[drcongo]

Not sure why this got voted down to death, I found it interesting, thanks.