Comments on: The location of spammers on a world map http://www.spoutingshite.com/2009/09/08/the-location-of-spammers-on-a-world-map/?utm_source=rss&utm_medium=rss&utm_campaign=the-location-of-spammers-on-a-world-map Cloud Computing isn't about technology; it's about enabling your technology led business model with lower capital investment Mon, 26 Apr 2010 13:33:00 +0000 hourly 1 http://wordpress.org/?v=3.0 By: rosscooney http://www.spoutingshite.com/2009/09/08/the-location-of-spammers-on-a-world-map/comment-page-1/#comment-291 rosscooney Wed, 16 Sep 2009 17:02:40 +0000 http://www.spoutingshite.com/?p=385#comment-291 excellent idea Rob! I have found this chart type:<br><a href="http://code.google.com/apis/visualization/documentation/gallery/motionchart.html" rel="nofollow">http://code.google.com/apis/visualization/docum...</a><br><br>This is how Hans and the guys at <a href="http://gapminder.org" rel="nofollow">gapminder.org</a> draw their graphs. I will start to collect the correct data and map it out over the next few weeks. excellent idea Rob! I have found this chart type:
http://code.google.com/apis/visualization/docum...

This is how Hans and the guys at gapminder.org draw their graphs. I will start to collect the correct data and map it out over the next few weeks.

]]> By: Rob Colling http://www.spoutingshite.com/2009/09/08/the-location-of-spammers-on-a-world-map/comment-page-1/#comment-290 Rob Colling Wed, 16 Sep 2009 15:55:55 +0000 http://www.spoutingshite.com/?p=385#comment-290 Nice work, Ross. That's really interesting, and a very easy-to-understand way to present the information. Hans Rosling would be proud!<br><br>Actually, that makes me wonder whether <a href="http://gapminder.org" rel="nofollow">gapminder.org</a> might be one way to show the change over time? It'd be simple, if maybe not quite as elegant as doing it yourselves. (I have a wonderful vision of the map colours animating to show the last few hours, a bit like the BBC weather maps!) Nice work, Ross. That's really interesting, and a very easy-to-understand way to present the information. Hans Rosling would be proud!

Actually, that makes me wonder whether gapminder.org might be one way to show the change over time? It'd be simple, if maybe not quite as elegant as doing it yourselves. (I have a wonderful vision of the map colours animating to show the last few hours, a bit like the BBC weather maps!)

]]> By: rosscooney http://www.spoutingshite.com/2009/09/08/the-location-of-spammers-on-a-world-map/comment-page-1/#comment-289 rosscooney Wed, 16 Sep 2009 14:28:49 +0000 http://www.spoutingshite.com/?p=385#comment-289 I am not sure. Almost all spam is sent using botnets or viruses, but significant amounts of spam is also relayed upon the networks of corrupt ISP's. We don't do enough analysis of the actual owners of IP's used to send spam. We are setting up an internal research project to find this data. I am not sure. Almost all spam is sent using botnets or viruses, but significant amounts of spam is also relayed upon the networks of corrupt ISP's. We don't do enough analysis of the actual owners of IP's used to send spam. We are setting up an internal research project to find this data.

]]> By: justingsouter http://www.spoutingshite.com/2009/09/08/the-location-of-spammers-on-a-world-map/comment-page-1/#comment-288 justingsouter Wed, 16 Sep 2009 14:21:12 +0000 http://www.spoutingshite.com/?p=385#comment-288 Ross - building on Chris' point: maybe it's because Brazil has lots of hacked machines and they are acting as re-broadcast points for the spam?<br><br>I.e. does this map say something about the overall level of security / patching on machines in this country? Or maybe operating systems? Ross – building on Chris' point: maybe it's because Brazil has lots of hacked machines and they are acting as re-broadcast points for the spam?

I.e. does this map say something about the overall level of security / patching on machines in this country? Or maybe operating systems?

]]> By: rosscooney http://www.spoutingshite.com/2009/09/08/the-location-of-spammers-on-a-world-map/comment-page-1/#comment-287 rosscooney Wed, 16 Sep 2009 13:59:20 +0000 http://www.spoutingshite.com/?p=385#comment-287 Hi Chris, i have updated the post with more information on how er get the data, but the map is drawn every hour by analysing the most recent 250,000 data points across our UK and US scan clusters. This data is analysed and stored in a database in Newcastle-upon-Tyne and IP’s are pinpointed on the map by using the GeoIP database. We save significant amounts of time by using memcached to cache IP lookups. Finally, we use the Google Charts API to draw the map.<br><br>We generate around 250,000 data points every two hours, so the map is useful as it can show the move of traffic across the world depending on time. For example, we see more spam from Brazil during the UK morning hours and a significant spike from India, China and Korea in the UK evenings. We have not been able to find a reason for this yet but we guess that it is related to work pasterns of the various spam teams.<br><br>Our next goal is to find a way to show the changes over a 24, 48 and 168 hour period. Hi Chris, i have updated the post with more information on how er get the data, but the map is drawn every hour by analysing the most recent 250,000 data points across our UK and US scan clusters. This data is analysed and stored in a database in Newcastle-upon-Tyne and IP’s are pinpointed on the map by using the GeoIP database. We save significant amounts of time by using memcached to cache IP lookups. Finally, we use the Google Charts API to draw the map.

We generate around 250,000 data points every two hours, so the map is useful as it can show the move of traffic across the world depending on time. For example, we see more spam from Brazil during the UK morning hours and a significant spike from India, China and Korea in the UK evenings. We have not been able to find a reason for this yet but we guess that it is related to work pasterns of the various spam teams.

Our next goal is to find a way to show the changes over a 24, 48 and 168 hour period.

]]> By: Chris Neale http://www.spoutingshite.com/2009/09/08/the-location-of-spammers-on-a-world-map/comment-page-1/#comment-286 Chris Neale Wed, 16 Sep 2009 13:50:52 +0000 http://www.spoutingshite.com/?p=385#comment-286 Fascinating stuff. It's much more distributed than I'd have thought it would be given the spam I get. Which address are you using to get the geolocation information? Could there be an open proxy in Brazil that's getting absolutely hammered by someone somewhere else in the world? Fascinating stuff. It's much more distributed than I'd have thought it would be given the spam I get. Which address are you using to get the geolocation information? Could there be an open proxy in Brazil that's getting absolutely hammered by someone somewhere else in the world?

]]>