Attackers Without Borders: The View Of Global Malicious Traffic For The United Arab Emirates

Summary: GreyNoise Labs analysed 30 days of sensor data ending February 28, 2024, and observed 36,383 malicious exploitation attempts against IP address space allocated to the United Arab Emirates, alongside 2,666 attacks from UAE networks directed at other countries. Only 93 of the inbound attempts (0.26%) were directed solely at the UAE, and the outbound tag distribution was nearly identical to the inbound, with Mirai botnet activity consistently among the top detections.
Bottom line: The UAE's IP space carries a higher positive reputation than many other countries, so risk-based perimeter systems are more likely to let connections from those sources pass - and nodes under adversarial control there appear to be aiming at ally networks. GreyNoise notes that leaving a default or misconfigured system exposed for less than an hour is enough for it to join the adversarial inventory.

Read the original at GreyNoise Blog ↗