Internet Malicious Activity Map
The map below represents a summary of malicious activity seen on the Internet in our data sources over the past 30 days, and is automatically updated each day. The IP space is mapped into this image using a Hilbert Curve. The numbers in the upper left-hand corner of each block of the map indicate the first octet of the IP addresses represented in that section, so, for example, the block labeled "24" represents all of the IP addresses in the 24.0.0.0/8 netblock.
Blocks with orange numbers and cross-hatching are full /8 networks that are bogons, unallocated space which should never be seen on the Internet. Non-bogon blocks blocks are displayed with red numbers.
The map below is a half-size version to avoid breaking the layout of the web page and making it impossible to read - click on the image to open the full-sized version of the map in a new browser window/tab.
Each individual pixel of the full map represents 4096 IP addresses. The coloration of the map is scaled in "heatmap" style - if no IP addresses from the block represented by a given pixel were found in our dataset of malicious activity, it will remain black. If any addresses were found, the pixel will be shaded based on the number, starting with blue, transitioning through purple, green, yellow, orange, red, and, finally, to white for the largest concentrations of malicious activity.
Credit for the idea of this mapping concept goes to xkcd, and their Map of the Internet. The Measurement Factory has also done similar visualizations of differing data sets using this technique.
