Attackers Without Borders: The Singapore View Of Global Malicious Traffic

Summary: GreyNoise Labs analysed 30 days of sensor data between mid-September and mid-October 2023 and observed 206,971 malicious exploitation attempts against Singapore IP address space, alongside 7,849 attacks originating from Singapore networks directed at other countries. Of the inbound attempts, 2,947 (1.4%) were directed only at Singapore, and the outbound tag distribution closely matched the inbound, with Mirai botnet activity holding the top spot and business networks ranking third among outbound sources.
What you should know: Singapore IP space carries a higher positive reputation than many countries, so perimeter systems making risk-based trust decisions are more likely to let connections from Singapore sources through - which is why nodes under adversarial control there appear to be aiming at ally networks. With mobile networks now fourth among malicious connection sources and accounting for roughly 40-50% of benign traffic to most web applications, blocking them is a conversation most application owners will resist.

Read the original at GreyNoise Blog ↗