Skip to main content
Each number on this map is attack volume attributed to a country of origin for the same analysis window covered elsewhere in this report. The United States shows the highest count at 224, followed by China at 93, with dozens of other countries contributing counts in the single or low double digits — including clusters across South America, Southeast Asia, and Western Europe.

​
A long tail is the expected shape

A small number of countries carrying most of the volume, alongside a wide scatter of low counts everywhere else, is the typical signature of botnet and proxy infrastructure rather than a handful of attackers operating from fixed locations. Compromised hosts and proxy exit nodes exist wherever infrastructure happens to be available, which is why origin country is a weak basis for blocking on its own — geo-blocking a high-count country stops a fraction of the volume while doing nothing about the long tail, and risks blocking legitimate traffic routed through the same regions.

​
What the map is useful for

Origin data isn’t the blocking mechanism here — the Crime Score is. What this map does provide is context: it shows where enforcement decisions driven by Crime Score are concentrated geographically, which is useful for understanding exposure by region even though the underlying decision to block is made per indicator, not per country.
Proof of Value engagements map attack origins against a client’s own traffic in the same way. Start a Proof of Value.