Graphs

This page shows all graphs in the rotation of statistics on our home page. Some graphs are updated hourly, while others are updated daily. We're always looking at new and interesting data, so come back often to see what has changed, and check out the rest of our monitoring section for information on the underlying data that allows us to generate these graphs.

Overall Malicious Activity, Top 10 Countries


This chart lists the top 10 countries seen contributing to malicious activity online in the last 24 hours, as a percentage relative to total malicious activity in the same period. IP geolocation isn't perfect, so this data isn't exact, but we believe it should be roughly representative of the current global picture.

Bot Activity, Top 10 Countries


This chart lists the top 10 countries seen contributing to botnet activity online in the last 24 hours, as a percentage relative to total malicious activity in the same period. IP geolocation isn't perfect, so this data isn't exact, but we believe it should be representative of the current global picture.

IP Protocol Trends


Our global view of Internet traffic provides many useful insights, one of which is the relative prevalance of various IP protocols. This chart shows the most commonly seen IP protocols, and their relative popularity in sampled network traffic over the past 30 days. Note that the Y axis is scaled logarithmically, so even small differences on the chart reflect significant differences in usage levels.

Underground Economy Activity


This chart shows a very general sampled indicator of the average number of messages per hour seen each day in various underground economy forums for the past 30 days. The numbers should not be taken as absolutes, and have considerable sampling error, but are believed to be a reasonable indicator of overall trends.

Top 10 TCP Ports (logarithmic scale)


This chart shows the top 10 TCP ports seen in sampled global Internet traffic in our most recent hourly data sample. This chart is on a logarithmic scale, so the difference between the top port (usually TCP/80) and the bottom port may be more

Top 10 UDP Ports (logarithmic scale)


This chart shows the top 10 UDP ports seen in sampled global Internet traffic in our most recent hourly data sample. This chart is on a logarithmic scale, so the difference between the top port (usually UDP/53) and the bottom port may be more significant than it appears to the naked eye.

Average Daily Botnet Traffic


This chart shows the average amount of traffic we see to each botnet command and control (C&C) server we are monitoring daily. This is the actual bandwidth consumed by the bots as they check in with the controller and receive commands. This data is based on a sampled view of traffic, and shouldn't be treated as hard numbers, but can give you an idea of the rates of usage involved in running a botnet.

Daily DDoS Attacks


Our malicious activity monitoring includes insight into distributed denial of service (DDoS) attacks launched by various botnets around the globe. This chart indicates the number of attacks seen each day across a subset of our monitoring infrastructure, giving some insight into trends and patterns in miscreant activity.

Sampled Internet Traffic Rate (hourly)


We receive sampled and generalized information about Internet traffic flow rates from many partners, and this chart reflects those rates over the past week, aggregated hourly. This is by no means the "full speed" of the Internet, but a way of seeing trends and patterns within the overall mix of traffic.

Sampled Internet Traffic Rate (daily)


We receive sampled and generalized information about Internet traffic flow rates from many partners, and this chart reflects those rates over the past 30 days, aggregated daily. This is by no means the "full speed" of the Internet, but a way of seeing trends and patterns within the overall mix of traffic.

Sampled DNS Request Rate (hourly)


We receive sampled and generalized information about Internet traffic flow rates from many partners, and this chart reflects those rates over the past 30 days, aggregated daily. This is by no means the "full speed" of the Internet, but a way of seeing trends and patterns within the overall mix of traffic.

Sampled DNS Request Rate (daily)


Our insight into Internet traffic around the globe allows us to sample and estimate trends in Domain Name System (DNS) requests, one of the key pieces of Internet infrastructure. This chart provides a glimpse into that sampled rate over the past 30 days, aggregated daily, for both TCP and UDP DNS requests (though the TCP request rate is so low it is difficult to discern).