RE: Country of Origin for Malicious Attacks

["McBurnett, Jim" <jmcburnett () msmgmt com>]

Sean,
of the scans I get and have seen..
60% APNIC region
        Most noteably- Taiwan, China, and Korea (north)
20% RIPE 
        Most noteable- Former Soviet Block nations then
                Scandanavian countries...
20% ARIN/LACNIC
        
This is a rough estimate from the last 3 weeks...

I guess you may be after this kind of fact:
When I blocked HINET
(Taiwan based-- has a single /16 to my knowledge)
I cut scans/probes by 20%....


Later,
Jim


-----Original Message-----
From: sgorman1 () gmu edu [mailto:sgorman1 () gmu edu]
Sent: Wednesday, June 25, 2003 11:58 AM
To: nanog () merit edu
Subject: Country of Origin for Malicious Attacks




I was wondering if folks had noticed any trends with malicious 
network attacks predominantly originating from any individual 
or group of countries.  Any observations, comments or help 
would be greatly appreciated.

Thanks,

sean