Facebook LinkedIn Twitter Pinterest

Jeroen Steeman - Live Internet traffic monitoring

Live Internet Traffic Insight

"Internet, the hits just keep coming, the good, the bad and the ugly". The want to know about how much good and bad Internet traffic that is reaching this on-line instance, is the reason behind this construct.

No matter what firewall you use (and I hope you use one!), none that I have seen really give good insight into what is happening at any moment in time and what is good and bad IP traffic. What percentage of Internet traffic is bad and dangerous and how much time, effort and energy (read $$$) is spent generating and then dealing with bad Internet data.

Earth A cartographic representation of the currently blocked IP address sources can be seen on the Cartographic IP Block Black List. This shows the originating country by accumulated confirmed bad Internet activity over a period of time. As this process is a capture and release round robin collection, IP ranges that show no aggressive undertaking during a period of time will be taken off the listing.

Current IP events overview

A graphical representation of the ratio of good versus bad IP traffic hitting 'this entity' right about now. General information on Internet IP blocking can be found here.

IP Block List Tools

Book Some older block lists from the 19th century are also available here for reference to see how the landscape has changed. Here we look at what is facing us and happening now. Will admit that putting this Internet Traffic page on-line is asking for trouble, but trouble knows me well as do I know it as well.

Latest (updates are between a few hours to a day, for threat level 1 to 4 are available below. I (we, this, it) take no responsibility for you using it in any way. Level1 contains IP addresses also seen by multiple other Internet security institutions and organizations. The chance of false positives is extremely low and these IP addresses are known for conduct unbecoming and should be blocked (dropped) for inbound as well as any outbound traffic on any protocols on any ports. Level 4 is different and a very active list, as multiple reports for bad IP addresses are received as notified by many (unconfirmed) sources, they are added to this list. The level 4 list thus has the possibility of having false positives (can be poisoned by bot nets, hackers or constitutions), so be careful with this one if you intend to use it. It can bite you, best to use it as a day zero or botnet additional checklist and not just block everything.

Proxy IP Block list date: 3/26/2023 9:33:24 AM (UTC) size: 175.7 KB bytes. Contains 12473 IP Addresses and ranges.
Compromised IP Block list date: 3/26/2023 2:07:42 PM (UTC) size: 5.3 KB bytes. Contains 374 IP Addresses and ranges.
Attack IP Block list date: 3/26/2023 12:23:34 PM (UTC) size: 264.0 KB bytes. Contains 18967 IP Addresses and ranges.
Level 1 IP Block list date: 3/26/2023 4:54:08 AM (UTC) size: 33.1 KB bytes. Contains 2139 IP Addresses and ranges.
Level 2 IP Block list date: 3/26/2023 4:02:05 PM (UTC) size: 184.5 KB bytes. Contains 13126 IP Addresses and ranges.
Level 3 IP Block list date: 3/26/2023 11:00:06 AM (UTC) size: 257.2 KB bytes. Contains 18149 IP Addresses and ranges.
Level 4 IP Block list date: 3/25/2023 10:48:17 PM (UTC) size: 2.5 MB bytes. Contains 182222 IP Addresses and ranges.
NORD VPN IP Block list date: 3/24/2023 10:56:00 AM (UTC) size: 84.4 KB bytes. Contains 5583 IP Addresses.
TOR Exit Node list date: 3/6/2023 3:18:10 AM (UTC) size: 20.7 KB bytes. Contains 1448 IP Addresses.
Active CnC Botnets date: 3/26/2023 4:14:48 PM (UTC) size: 2.5 KB bytes. Contains 168 IP Addresses.
AbuseIPDB IP List date: 3/26/2023 5:00:01 PM (UTC) size: 149.9 KB bytes. Contains 9995 IP Addresses.

Current month top exploit attempts

Port: 23 hit 63901 times.
Port: 25 hit 32989 times.
Port: 6379 hit 19762 times.
Port: 587 hit 15175 times.
Port: 22 hit 11880 times.
Port: 8080 hit 7458 times.

Note: About current IP block lists

You are welcome to use the regularly updates IP block lists as provided on this web page. It will hopefully provide some additional protection from the sewage present on the Internet. Do note that using these lists is at your own risk. Besides level 1 to 4 lists, the others each have separate detection and logging processes. This has as effect that the same IP number may appear in multiple lists, depending upon the actions that were undertaken by said IP address.