Jeroen Steeman - Live Internet traffic monitoring

Live Internet Traffic Insight

Internet Traffic"Internet, the hits just keep coming, the good, the bad and the ugly". The want to know about how much good and bad Internet traffic that is reaching this on-line instance, is the reason behind this construct.

FirewallNo matter what firewall you use (and I hope you use one!), none that I have seen really give good insight into what is happening at any moment in time and what is good and bad IP traffic. What percentage of Internet traffic is bad and dangerous and how much time, effort and energy (read $$$) is spent generating and then dealing with bad Internet data.

EarthA cartographic representation of the currently blocked IP address sources can be seen on the Cartographic IP Block Black List. This shows the originating country by accumulated confirmed bad Internet activity over a period of time. As this process is a capture and release round robin collection, IP ranges that show no aggressive undertaking during a period of time will be taken off the listing.

Current IP events overview

Pie GraphA graphical representation of the ratio of good versus bad IP traffic hitting 'this entity' right about now. General information on Internet IP blocking can be found here.

IP Block List Tools

BookSome older block lists from the 19th century are also available here for reference to see how the landscape has changed. Here we look at what is facing us and happening now. Will admit that putting this Internet Traffic page on-line is asking for trouble, but trouble knows me well as do I know it as well.

CogsLatest (updates are between a few hours to a day, for threat level 1 to 4 are available below. I (we, this, it) take no responsibility for you using it in any way. Level1 contains IP addresses also seen by multiple other Internet security institutions and organizations. The chance of false positives is extremely low and these IP addresses are known for conduct unbecoming and should be blocked (dropped) for inbound as well as any outbound traffic on any protocols on any ports. Level 4 is different and a very active list, as multiple reports for bad IP addresses are received as notified by many (unconfirmed) sources, they are added to this list. The level 4 list thus has the possibility of having false positives (can be poisoned by bot nets, hackers or constitutions), so be careful with this one if you intend to use it. It can bite you, best to use it as a day zero or botnet additional checklist and not just block everything.

  • Proxy IP Block list date: 6/12/2024 3:39:33 PM (UTC) size: 72.2 KB bytes. Contains 5126 IP Addresses and ranges.
  • Compromised IP Block list date: 6/13/2024 3:06:53 PM (UTC) size: 4.9 KB bytes. Contains 336 IP Addresses and ranges.
  • Attack IP Block list date: 6/13/2024 2:12:39 PM (UTC) size: 364.7 KB bytes. Contains 26214 IP Addresses and ranges.
  • Level 1 IP Block list date: 6/13/2024 4:01:45 PM (UTC) size: 34.1 KB bytes. Contains 2202 IP Addresses and ranges.
  • Level 2 IP Block list date: 6/12/2024 5:43:36 PM (UTC) size: 252.9 KB bytes. Contains 18050 IP Addresses and ranges.
  • Level 3 IP Block list date: 6/12/2024 4:57:09 PM (UTC) size: 252.8 KB bytes. Contains 17829 IP Addresses and ranges.
  • Level 4 IP Block list date: 6/13/2024 3:20:52 AM (UTC) size: 2.0 MB bytes. Contains 147262 IP Addresses and ranges.
  • VPN IP Block list date: 6/13/2024 12:12:42 AM (UTC) size: 54.0 KB bytes. Contains 3404 IP Address ranges.
  • TOR Exit Node list date: 6/8/2024 8:03:11 AM (UTC) size: 16.3 KB bytes. Contains 1146 IP Addresses.
  • Active CnC Botnets date: 6/6/2024 3:44:05 AM (UTC) size: 134.0 bytes bytes. Contains -1 IP Addresses.
  • AbuseIPDB IP List date: 6/13/2024 3:37:04 PM (UTC) size: 149.7 KB bytes. Contains 9991 IP Addresses.

Current month top exploit attempts

  • Port: 23 hit 4279 times.
  • Port: 8728 hit 2185 times.
  • Port: 6379 hit 1233 times.
  • Port: 22 hit 1075 times.
  • Port: 3389 hit 1038 times.
  • Port: 2222 hit 815 times.
Note: About current IP block lists

You are welcome to use the regularly updates IP block lists as provided on this web page. It will hopefully provide some additional protection from the sewage present on the Internet. Do note that using these lists is at your own risk. Besides level 1 to 4 lists, the others each have separate detection and logging processes. This has as effect that the same IP number may appear in multiple lists, depending upon the actions that were undertaken by said IP address.

Current IP events


Find who is responsible for routing this IP address, the Autonomous System Number, name, location and more information.

Country flag ...
Region ...
City ...
IP Range Type ...
IP Range ...
ASN ...
Name ...
URL ...
Description ...
IP Range Type Legend
  • (CDN) Content Delivery Network
  • (COM) Commercial
  • (DCH) Data Center/Web Hosting/Transit
  • (EDU) University/College/School
  • (GOV) Government
  • (ISP) Fixed Line ISP
  • (LIB) Library
  • (MIL) Military
  • (MOB) Mobile ISP
  • (ORG) Organization
  • (RSV) Reserved
  • (SES) Search Engine Spider
  • (---) Under Investigation
  • ( ) No clue yet