About this page
The map uses recent DShield data. An IP address is considered if we received reports for it within the last 30 days. You can plot different characteristics:
- Number Of Tracked Hosts in Country: This is the number we often label as "Number of Sources" in our reports. Each distinct IP address that triggers a report is considered a "source".
- Number of Hosts Reporting Attacks: Each distinct IP address reported as a target of a report is counted here. The location is the location of the host originating the report. If you see for example "100" for country "X", it means that hosts located in country "X" triggered reports in 100 hosts worldwide.
- Number Of Reports Reports Submitted For Hosts Originating in Country: This is similar to the number of tracked hosts in the country, but instead of counting each IP address only once, it counts the total number of reports. One address triggering 1,000,000 reports is considered the same way as 1,000,000 hosts triggering 1 report each.
- Average Number of Days a Hosts Persists: This number counts the average number of days between the first and last report we receive for hosts in this country. Note that this does not just depend on the time it takes to mitigate a possible infection, but countries that are more likely to use dynamic IP addressing will also show up with a shorter persistence.