# Finding and Analyzing Evil Cities on the Internet

Matthijs Polen, Giovane Moura, Aiko Pras

► To cite this version:

Matthijs Polen, Giovane Moura, Aiko Pras. Finding and Analyzing Evil Cities on the Internet. 5th Autonomous Infrastructure, Management and Security (AIMS), Jun 2011, Nancy, France. pp.38-48, 10.1007/978-3-642-21484-4_4. hal-01585870

HAL Id: hal-01585870

https://inria.hal.science/hal-01585870

Submitted on 12 Sep 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Finding and Analyzing Evil Cities on the Internet

Matthijs G.T. van Polen, Giovane C. M. Moura, and Aiko Pras

Centre for Telematics and Information Technology (CTIT)
Faculty of Electrical Engineering, Mathematics
and Computer Science (EEMCS)

Design and Analysis of Communications Systems (DACS)
Enschede, The Netherlands

matthijs@vanpolen.biz, {g.c.m.moura, a.pras} @utwente.nl

**Abstract.** IP Geolocation is used to determine the geographical location of Internet users based on their IP addresses. When it comes to security, most of the traditional geolocation analysis is performed at country level. Since countries usually have many cities/towns of different sizes, it is expected that they behave differently when performing malicious activities. Therefore, in this paper we refine geolocation analysis to the city level. The idea is to find the most dangerous cities on the Internet and observe how they behave. This information can then be used by security analysts to improve their methods and tools. To perform this analysis, we have obtained and evaluated data from a real-world honeypot network of 125 hosts and from production e-mail servers.

**Keywords:** Geographical Analysis, Bad Neighborhoods, Internet Geolocation, IP Geolocation, Spam, Network Attacks, Honeypots

## 1 Introduction

IP Geolocation aims to determine the Internet users' geographical location based on their IP address [1]. It has been used by industries and businesses for many purposes, including targeted advertisement (e.g., a global portal can deliver customized ads according to the user's location), fraud detection (e.g., online stores can check the physical location of a client against its billing address), media licensing (e.g., broadcasters, such as those on Hulu [2], only stream content to IPs belonging to certain countries) and even spam filtering [3].

In relation to security, most of the current Internet Geolocation analysis is done only at the country level. For example, the latest 'State of the Internet' report by Akamai shows only the top 10 countries from where attacks originated [4]<fnref n="1" />. Another example of country-level analysis is the daily generated map provided by Quarantainenet BV [5].

In this paper, we address the Internet Geolocation for security on a city level instead. The assumption is that countries are too big and heterogeneous so their cities/towns are expected to exhibit different behavior in relation to security. The motivation for doing so is that it would allow provide security developers with hints on how to better

<footnote n="1">¹ In this work, by originated we mean where the attack came from. We do not consider if there were other hosts controlling the attacking one.</footnote>
tweak/improve their tools. Therefore, the main research question addressed in this pa-
per is: "Which cities in the world are responsible for most of the security incidents?"
Following the main research question, in this paper we address other sub questions:

- *Are there cities that are relatively more 'evil' than others?* Some cities might be more evil than others (that is, they generate more attacks than others), in some cases just because this city has more inhabitants, which leads to more computers and a higher probability of starting attacks. This sub research question addresses the evilness of cities taking into account its number of attackers per inhabitants. The idea is to observe if and how the evilness of a city changes according to its population.

- *Are the cities where the most attacks originated located in the countries where the most attacks originated?* If this would be the case, then filtering on a city level would not be very necessary, since filtering on a country level would yield the same results. However, if the answer to this question is ‘no’, then filtering on a city level might lead to more accurate results. If there are countries that cause a small number of attacks, but there is a city in that country that does cause a relatively large number of attacks, it might be a good idea to mistrust only the city and not the whole country.

- *Is there much change over time in the list of the most evil cities?* The list of countries where the most attacks come from doesn't change much, as can be observed for the map generated by Quarantainenet [5]. There is a mild variation during the day (probably due to day/night), but seen over the course of a week this list stays mostly the same. Would this behavior hold when cities are evaluated?

- *Do the evil cities change according to the type of attack?* In this question we verify whether the list of evil cities remains the same for different types of security attacks. If the list remains the same, it suggests, for example, that a list of cities where the most SSH attacks originate can be fed into a spam filter when scoring IPs based on their geolocation. If not, then a list of evil cities should be obtained per application.

The remainder of this paper is organized as follows: Section 2 discusses the related work. Section 3 presents our approach on how to find evil cities and describes our data sets. Section 4 addresses the main research question, providing analysis on the most malicious cities. Section 5 aims at the first sub research questions, in which the evilness of cities is evaluated taking into account its population. Section 6 presents results on the second sub question, evaluating whether the most evil cities belong to the most evil countries. Next, Section 7 covers the third sub question, in which the list of evil cities changes over time. After that, we evaluate how the evil cities change according to the type of attack in Section 8. Finally, Section 9 presents our conclusions and remarks for future work.

## 2 Related Work

Most of the current research works focusses on geographical location at the country
level. For example, Jiang et al. [6] propose a spam filtering technique that uses country-
level geographical information, which lead to a reduction of 13.9% in their experiments.
Even though they were able to reduce the number of spam messages, the authors do not describe what could happen if city-level information would be used instead of country level for filtering spam.

Sobel et al. [3], on the other hand, hold a U.S. patent for use of geolocation data for spam detection. It is stated in the patent that "the geolocation data may be any type of geographical information such as city, country, state or presence within a pre-selected radius of a geographical point". As a patent, the method is only described while its effectiveness is not addressed. Other non-scientific reports on the number of attacks per country also exist. For example, the Internet hosting company Akamai provides a quarterly report named 'The State of the Internet' [4], which is obtained from the analysis of users that access Akamai servers (many sites, such as Hulu, BBC iPlayer and the White House use the Akamai content distribution network). In their latest report, they have observed attacks from 209 countries/regions, with the U.S. being the first one, in terms of traffic (12%). However, only 10 countries are mentioned in the report, and they do not provide analysis at city-level. Quarantainenet also provides a daily map of the countries that have attacked their honeypot infrastructure [5].

Other work is also related to ours. In a previous piece of work, Van Wanrooij and Pras [7] employ the concept of 'Internet bad neighborhood' – that is, there are certain IP blocks on the Internet more evil than others – to filter mail messages. Using data from blacklists, the authors were able to filter detect 95% of the spam messages. However, in their work, no geographical information is used. The research questions in our work address the existence of malicious cities on the Internet, instead of network blocks. In another work, Koike et al. [8] perform data visualization on the origin of attacks at IP block level or country level. Finally, Muir et al. [1] present a survey on the current Internet geolocation methods.

In the next section we describe the dataset and the approach used in our study to find evil cities on the Internet.

# 3 Dataset and Approach

## 3.1 Quarantainenet Honeypot Data

In order to answer our research questions, the first step was to obtain reliable data from real world attacks. In our case, we have obtained full non-anonymized data from Quarantainenet B.V [9], a Dutch company that develops network management and security tools and provides admission control and malware detection for their customers, including more than half of Dutch universities. Quarantainenet has a honeypot infrastructure which is distributed mostly over the Netherlands. In total, 125 machines are used for this purpose. Each has multiple IP addresses assigned to it to increase the chance of it being targeted by attackers.

Quarantainenet collects information from each honeypot and combines it into one single database. By definition, every new attack is logged. However, if the same IP address attacks a same honeypot multiple times within 48 hours, only the first incident is recorded. This is employed in order to keep the database more concise. For example, a host performing SSH dictionary attacks could be logged many times if this would not
be employed. However, for our research, this does not represent a problem, since we
are interested in the IP addresses of attackers, instead of the number of attacks.

Each honeypot is able to log many different type of attacks. Among them are SSH- attacks, *Conficker* [10], known exploits of Microsoft Windows and others. Attacks that are as of yet unknown, are forwarded to Qnetlabs, the sister company of Quarantainenet, for further analysis. The honeypots used are passive, which means they wait for incoming connections that are then analyzed to see whether they are malicious.

The data provided by Quarantainenet is not publicly available, as it, of course, con-
tains IP addresses of the attackers. Under Dutch law IP addresses can be ‘persoons-
gegevens’, personal data. It is illegal to make them public. Therefore all IP addresses
were processed automatically. Then they were discarded, leaving only an internal ID
and a location.

For this research, we have evaluated a one week period from Quarantainet database
– from October 29th to November 4th, 2010. During this period 25474 attacks were
logged, from 23814 different IP addresses. Of these attacks, 20174 came from a form
of the *Conficker* worm, a worm that targets the Windows operating system. The next
largest number of attacks, namely 2052, were attacks trying to take advantage of the
vulnerability in certain Windows-versions dubbed MS08-067 by Microsoft<fnref n="2" />.

In the Sections 7 and 8 we have used different periods, which are detailed in the
same sections. Next we describe the method we have employed to obtain Internet Ge-
olocation information.

## 3.2 Method for obtaining IP Geolocation

After having obtained the IP addresses for the monitoring period, we have mapped them to their geographical location using GeoPlugin [11]. GeoPlugin is a free online API which uses Maxmind database [12] to resolve Internet Geolocation. They provide the following data for a particular address: city, region, area code, DMA code, country name, country code, longitude, latitude, currency code, currency symbol and exchange rate. For our experiments, we needed only city and country code.

The main problem with using GeoPlugin that it relies on the accuracy of Max-
mind database [12], of which numbers on accuracy are available [13]. Even though the
database is not 100% precise, (Maxmind claims that their “GeoIP databases are 99.8%
accurate on a country level, 90% accurate on a state level and 83% accurate for the US
within a 25 mile radius”), we believe the results obtained would still hold, even though
with some margin for errors.

For the sub-research question in which the number of inhabitants is taken into ac-
count, this was manually done using numbers obtained from Wikipedia. We intend as
future work to develop a more automated and precise way to perform this using an on-
line database, so that all cities can be checked, and not just the top 20. It would also
be fitting to use the number of internet subscribers in a certain city, but at the time of
writing this paper a database with information on the number of internet subscribers per
city could not be found.

<footnote n="2">² Please see http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx for details
from Microsoft TechNet.</footnote>
In the next sections we present the analysis for the research questions addressed in this paper.

# 4 Which cities are responsible for most of the security incidents?

To answer this question, we have evaluated the dataset described in Section 3. Table 1 shows the top 20 cities from which most of attackers were present, in absolute numbers.

<table><caption>Table 1: Top 20 attacking cities</caption><thead><tr><th>#</th><th>City</th><th>Ctry</th><th># of attacks</th><th>#</th><th>City</th><th>Ctry</th><th># of attacks</th></tr></thead><tbody><tr><td>1</td><td>Seoul</td><td>(KP)</td><td>735</td><td>11</td><td>Guangzhou</td><td>(CN)</td><td>219</td></tr><tr><td>2</td><td>Taipei</td><td>(TW)</td><td>618</td><td>12</td><td>Shanghai</td><td>(CN)</td><td>210</td></tr><tr><td>3</td><td>Beijing</td><td>(CN)</td><td>563</td><td>13</td><td>Ho Chi Minh City</td><td>(VN)</td><td>179</td></tr><tr><td>4</td><td>Jakarta</td><td>(ID)</td><td>362</td><td>14</td><td>Kuala Lumpur</td><td>(MY)</td><td>177</td></tr><tr><td>5</td><td>Buenos Aires</td><td>(AR)</td><td>351</td><td>15</td><td>Bogota</td><td>(CO)</td><td>162</td></tr><tr><td>6</td><td>Bangkok</td><td>(TH)</td><td>308</td><td>16</td><td>Saint Petersburg</td><td>(RU)</td><td>160</td></tr><tr><td>7</td><td>Moscow</td><td>(RU)</td><td>268</td><td>17</td><td>Rio De Janeiro</td><td>(BR)</td><td>152</td></tr><tr><td>8</td><td>Hanoi</td><td>(VN)</td><td>267</td><td>18</td><td>Caracas</td><td>(VE)</td><td>143</td></tr><tr><td>9</td><td>Santiago</td><td>(CL)</td><td>246</td><td>19</td><td>Bucharest</td><td>(RO)</td><td>139</td></tr><tr><td>10</td><td>Sao Paulo</td><td>(BR)</td><td>229</td><td>20</td><td>Chelyabinsk</td><td>(RU)</td><td>129</td></tr></tbody></table>

Analyzing this table, we can observe that, despite most of Quarantainenet's honey-pot infrastructure being located in Europe, we have observed only one European city (Bucharest) among the top 20 evil cities. In addition, 9 of the top attacking cities are located in Asia and other 6 in South America, while no evil city from North America was found among the top 20. Three evil cities are located in Russia and other three in China. Figure 1 shows the attackers concentration in the world map, from the top 20 cities. As can be seen, most of attackers are located in Asia.

Taking the numbers into account, we observe that for that evaluated period most of attacks were originated in Seoul. The reasons for that might be due to Seoul has a huge number of inhabitants – Seoul metropolitan area has more than 24 million people (that is more than the population of the Netherlands, for example) combined with a high Internet penetration level [4]. Another reason could be the precision of the MaxMind database – they claim that 75% of all IP addresses that are located in South Korea are correctly placed within 25 miles of their true location [13]. However, even with such precision, Seoul would still be responsible for many attacks in absolute numbers.

On the next section we present the results for the most evil cities taking into account its number of inhabitants.

# 5 Are there cities that are relatively more ‘evil’ than others?

In the previous section we have presented the most evil cities ranked according to the number of attackers observed. In this section we present how evil they are, taking into account the number of inhabitants of each city. Table 2 shows the results.
<figure><img src="image_2.png" /><figcaption>Fig. 1: Attacks on Dutch networks from 2010-10-29 until 2010-11-04</figcaption></figure>

In this table, each city is ranked according to the number of attackers per million inhabitants. In the third column, the number behind each city name shows the position the city was in Table 1, which only takes into account the absolute number of attackers. One can notice that results change when the population is taken into account. Chelyabinsk, in Russia, is the city with more attackers per inhabitants, while it was number 20 in absolute numbers. Seoul, which was the first, is ranked as 5th in this table. Chelyabinsk has ten times more attacks per inhabitant than Shanghai does, which was not clear looking only at the previous section.

However, we do see that the top four cities don't differ that much; at least not enough to call Chelyabinsk a more evil city than Buenos Aires, for example. Lower down the list the results change. For example, Shanghai, while being on the twelfth position for absolute number of attacks, is on the twentieth position on the relative table. This might be a relatively small drop, however this is because only the absolute top twenty of cities was evaluated.

Finally, looking at these results, one can conclude that there are also significant differences when evaluating cities' evilness according to the number of inhabitants.

**6 Are the cities where the most attacks originated located in the countries where the most attacks originated?**

Table 3 shows the 20 countries that have started more attacks to the Quarantainenet honeypots. As one can notice, China is the leading country, followed by Brazil, U.S. and Russia. This table can be compared with the list provided by Akamai in their report [4]. In this report, they present the top 10 countries originating attacks, using a different metric: volume traffic, instead of number of incidents. In their report, 6 of
<table><caption>Table 2: Top 20 evil cities taking into account the population</caption><thead><tr><th>#</th><th>Ctry</th><th>City</th><th># of attackers</th><th># inhabitants</th><th>Att/10<sup>6</sup>inhab.</th></tr></thead><tbody><tr><td>1</td><td>(RU)</td><td>Chelyabinsk (20)</td><td>129</td><td>1078300</td><td>119.63</td></tr><tr><td>2</td><td>(AR)</td><td>Buenos Aires (5)</td><td>351</td><td>3050728</td><td>115.05</td></tr><tr><td>3</td><td>(MY)</td><td>Kuala Lumpur (14)</td><td>177</td><td>1809699</td><td>97.81</td></tr><tr><td>4</td><td>(TW)</td><td>Taipei (2)</td><td>618</td><td>6776264</td><td>91.20</td></tr><tr><td>5</td><td>(KP)</td><td>Seoul (1)</td><td>735</td><td>10208302</td><td>72.00</td></tr><tr><td>6</td><td>(RO)</td><td>Bucharest (6)</td><td>139</td><td>2151880</td><td>64.59</td></tr><tr><td>7</td><td>(CL)</td><td>Santiago (9)</td><td>246</td><td>5278044</td><td>46.61</td></tr><tr><td>8</td><td>(VN)</td><td>Hanoi (8)</td><td>267</td><td>6500000</td><td>41.08</td></tr><tr><td>9</td><td>(ID)</td><td>Jakarta (4)</td><td>362</td><td>9580000</td><td>37.79</td></tr><tr><td>10</td><td>(RU)</td><td>Saint Petersburg (16)</td><td>160</td><td>4661219</td><td>34.33</td></tr><tr><td>11</td><td>(TH)</td><td>Bangkok (6)</td><td>308</td><td>9100000</td><td>33.85</td></tr><tr><td>12</td><td>(CN)</td><td>Guangzhou (11)</td><td>219</td><td>7841695</td><td>27.93</td></tr><tr><td>13</td><td>(VE)</td><td>Caracas (18)</td><td>143</td><td>5196514</td><td>27.52</td></tr><tr><td>14</td><td>(RU)</td><td>Moscow (7)</td><td>268</td><td>10126424</td><td>26.47</td></tr><tr><td>15</td><td>(CN)</td><td>Beijing (3)</td><td>563</td><td>22000000</td><td>25.59</td></tr><tr><td>16</td><td>(VN)</td><td>Ho Chi Minh City (13)</td><td>179</td><td>7162864</td><td>24.99</td></tr><tr><td>17</td><td>(BR)</td><td>Rio De Janeiro (17)</td><td>152</td><td>6186710</td><td>24.57</td></tr><tr><td>18</td><td>(CO)</td><td>Bogota (15)</td><td>162</td><td>7392241</td><td>24.91</td></tr><tr><td>19</td><td>(BR)</td><td>Sao Paulo (10)</td><td>229</td><td>11037593</td><td>20.75</td></tr><tr><td>20</td><td>(CN)</td><td>Shanghai (12)</td><td>210</td><td>19210000</td><td>10.93</td></tr></tbody></table>

the top 10 countries match our results (China, Brazil, U.S., Russia, Taiwan and Italy), despite different ordering, being the U.S. the first country in their results.

To answer the research question addressed in this section, we should compare Table 3 to Table 1. In Table 1, the most evil city is Seoul. However, The Republic of Korea (South Korea) ranks at the 7th position when we aggregate the number of attackers per country. On the other hand, China tops the list as the most evil country, while it has 3 cities among the top 20 (Beijing, Guangzhou and Shanghai). While only one European city is among the top 20 cities, 8 countries are among the top 20 most evil countries. Finally, there are countries among the top 20 that have no city among the top 20 (e.g., Italy and Spain).

This results shows that there is little correlation between the most evil cities and the most evil countries. There are countries (e.g., Italy, U.S.) that have no cities among the most evil, but when attacks are aggregated at the country level their evilness is revealed. Therefore, filtering traffic taking into account the originating country is a risky approach, and a much more precise solution is to use cities instead.

## 7 Is there much change over time in the list of top offenders?

In order to answer this research question, we have obtained a list of the top 20 cities for each day of the evaluated week. Table 4 shows the obtained results. Due to space constraints, we do not show the number of attackers.
<table><caption>Table 3: Top 20 attacking countries</caption><thead><tr><th>#</th><th>Country</th><th># of attackers</th><th>#</th><th>Country</th><th># of attackers</th></tr></thead><tbody><tr><td>1</td><td>China</td><td>2532</td><td>11</td><td>France</td><td>772</td></tr><tr><td>2</td><td>Brazil</td><td>1943</td><td>12</td><td>Germany</td><td>746</td></tr><tr><td>3</td><td>United States</td><td>1815</td><td>13</td><td>Ukraine</td><td>658</td></tr><tr><td>4</td><td>Russia</td><td>1733</td><td>14</td><td>Vietnam</td><td>622</td></tr><tr><td>5</td><td>Italy</td><td>1690</td><td>15</td><td>Malaysia</td><td>590</td></tr><tr><td>6</td><td>Spain</td><td>955</td><td>16</td><td>Japan</td><td>577</td></tr><tr><td>7</td><td>Republic of Korea</td><td>936</td><td>17</td><td>Thailand</td><td>454</td></tr><tr><td>8</td><td>Argentina</td><td>907</td><td>18</td><td>United Kingdom</td><td>448</td></tr><tr><td>9</td><td>Indonesia</td><td>870</td><td>19</td><td>Romania</td><td>431</td></tr><tr><td>10</td><td>Taiwan</td><td>832</td><td>20</td><td>Poland</td><td>413</td></tr></tbody></table>

<table><caption>Table 4: Top 20 evil cities over one week</caption><thead><tr><th>#</th><th>Day 1</th><th>Day 2</th><th>Day 3</th><th>Day 4</th><th>Day 5</th><th>Day 6</th><th>Day 7</th></tr></thead><tbody><tr><td>1</td><td>Seoul</td><td>Seoul</td><td>Seoul</td><td>Taipei</td><td>Seoul</td><td>Seoul</td><td>Seoul</td></tr><tr><td>2</td><td>Taipei</td><td>Taipei</td><td>Taipei</td><td>Beijing</td><td>Beijing</td><td>Taipei</td><td>Taipei</td></tr><tr><td>3</td><td>Beijing</td><td>Beijing</td><td>Beijing</td><td>Seoul</td><td>Taipei</td><td>Beijing</td><td>Beijing</td></tr><tr><td>4</td><td>Jakarta</td><td>B. Aires</td><td>Jakarta</td><td>B. Aires</td><td>Bangkok</td><td>Jakarta</td><td>Jakarta</td></tr><tr><td>5</td><td>Bangkok</td><td>Bangkok</td><td>S. Paulo</td><td>Bangkok</td><td>B. Aires</td><td>B. Aires</td><td>B. Aires</td></tr><tr><td>6</td><td>Moscow</td><td>Hanoi</td><td>B. Aires</td><td>Jakarta</td><td>Jakarta</td><td>Moscow</td><td>Hanoi</td></tr><tr><td>7</td><td>B. Aires</td><td>Jakarta</td><td>Santiago</td><td>S. Paulo</td><td>Hanoi</td><td>Bangkok</td><td>Santiago</td></tr><tr><td>8</td><td>Santiago</td><td>Guangzhou</td><td>Bangkok</td><td>Hanoi</td><td>Moscow</td><td>HoChiMinh</td><td>Guangzhou</td></tr><tr><td>9</td><td>Hanoi</td><td>Santiago</td><td>R.deJaneiro</td><td>Santiago</td><td>Shanghai</td><td>Shanghai</td><td>Moscow</td></tr><tr><td>10</td><td>Shanghai</td><td>Bogota</td><td>Hanoi</td><td>Cairo</td><td>Guangzhou</td><td>Hanoi</td><td>Bangkok</td></tr><tr><td>11</td><td>S.Petersburg</td><td>S. Paulo</td><td>Moscow</td><td>Guangzhou</td><td>K.Lumpur</td><td>Santiago</td><td>S.Paulo</td></tr><tr><td>12</td><td>K.Lumpur</td><td>Moscow</td><td>Caracas</td><td>Moscow</td><td>Chelyabinsk</td><td>S. Paulo</td><td>Shanghai</td></tr><tr><td>13</td><td>S. Paulo</td><td>S.Petersburg</td><td>Chelyabinsk</td><td>Shanghai</td><td>HoChiMinh</td><td>K.Lumpur</td><td>Bogota</td></tr><tr><td>14</td><td>Guangzhou</td><td>Caracas</td><td>Bucharest</td><td>Chelyabinsk</td><td>S. Paulo</td><td>Guangzhou</td><td>S.Petersburg</td></tr><tr><td>15</td><td>R.deJaneiro</td><td>Shanghai</td><td>HoChiMinh</td><td>Rome</td><td>Madrid</td><td>Bucharest</td><td>Rome</td></tr><tr><td>16</td><td>Bucharest</td><td>K.Lumpur</td><td>S.Petersburg</td><td>Madrid</td><td>S.Petersburg</td><td>Caracas</td><td>K.Lumpur</td></tr><tr><td>17</td><td>Rome</td><td>R.deJaneiro</td><td>Bogota</td><td>Bogota</td><td>Bogota</td><td>R.deJaneiro</td><td>R.deJaneiro</td></tr><tr><td>18</td><td>Caracas</td><td>HoChiMinh</td><td>Madrid</td><td>S.Petersburg</td><td>Bucharest</td><td>Bogota</td><td>Bucharest</td></tr><tr><td>19</td><td>HoChiMinh</td><td>Chelyabinsk</td><td>Brasilia</td><td>Caracas</td><td>Tokyo</td><td>Cairo</td><td>HoChiMinh</td></tr><tr><td>20</td><td>Shenzhen</td><td>Mexico</td><td>Guangzhou</td><td>K.Lumpur</td><td>Santiago</td><td>Madrid</td><td>Caracas</td></tr></tbody></table>

As can be seen, Seoul is the most malicious city for 6 of the 7 days. In addition, the top 3 cities are always Seoul, Taipei or Beijing for each day. The one time Taipei was number one, the difference between the two was only two attackers. However, the mid-section was also quite stable. There were changes between cities already on the list, but only rarely did a city make the list for a day that wasn't already on the top twenty list of the entire week.

So, all in all, the top twenty list of cities is quite stable. This means that it can be used as the foundation of a set of rules for day-to-day use. There were no cases of a
city making the overall top twenty list because there was a one-day spike of traffic. This
suggests that it is not necessary to update the list of malicious cities on a daily basis.

8 Do the evil cities change according to the type of attack?

To investigate if the evil cities differ or not according to type of attack, we have ana-
lyzed data from two different datasets: (i) Quarantainenet database and (ii) log files from
e-mail servers of the Electrical Engineering, Mathematics and Computer Science De-
partment at University of Twente (EWI/UT). The difference between the datasets is that
the first one lists IP addresses of hosts performing different types of brute force/break-in
attempts (as described in Section 3), while the second one lists spamming hosts.

In order to have a more fair comparison, we have evaluated the IP addresses of malicious hosts for the same day: April 22nd, 2010. In this very day, Quarantainenet dataset had 6,797 IPs as malicious. The mail log files from EWI/UT, on the other hand, contained 240,733 spam messages from 70,546 different IP addresses. The IP addresses of both datasets were resolved to city level and then analyzed.

Table 5 presents the Top 20 evil cities for both datasets. At a first glance, one could notice that 9 out of 20 cities are found in both cases (highlighted in boldface). In fact, out of top 100 evil cities, 50 are found for both datasets, and 105 cities are present in both cases when comparing the top 200 evil cities. Even though the position in tables might change for each city, around 50% of the cities remains the same. This could be used, for example, to application level filters (such as mail filters, http proxies), in which cities would get lower scores levels for a certain type of application just by being evil for other applications. However, further research is need to investigated the feasibility of this proposal.

In the table, we can also observe that, for both cases, Seoul is the city where most of attackers and spammers come from. This is an interesting fact that shows us a different side of Seoul (as in Section 4): South Korea is usually regarded as the country with the highest level of broadband adoption, including its capital Seoul<fnref n="3" />. However, as shown by our results, more broadband penetration does not mean higher security levels. Seoul network administrators should be aware of this fact in order to improve security levels in their networks.

Finally, we can conclude that around 50% of malicious cities remains the same for
different types of attacks, even when analyzing data from different domains.

9 Conclusions and Future Work

In this paper we have employed Internet Geolocation in order to find what are the most
evil cities on the Internet. To achieve this, we have obtained IP addresses from malicious
hosts from 125 honeypots maintained by Quarantainenet [5], over a period of one week.

<footnote n="3">³ Seoul was ranked the 9th city in the world with the highest average measured connection speed by Akamai Networks [4] – an average of 14.4 Mpbs (all top 11 cities were in South Korea for the reporting period).</footnote>
<table><caption>Table 5: Top 20 evil cities for different types of attacks</caption><thead><tr><th># QNET-Attacks Cities</th><th># of attackers</th><th># Spamming Cities</th><th># of spammers</th></tr></thead><tbody><tr><td>1 Seoul</td><td>190</td><td>1 Seoul</td><td>1759</td></tr><tr><td>2 Beijing</td><td>176</td><td>2 Mumbai</td><td>1488</td></tr><tr><td>3 Taipei</td><td>147</td><td>3 Hanoi</td><td>1364</td></tr><tr><td>4 Buenos Aires</td><td>107</td><td>4 New Delhi</td><td>797</td></tr><tr><td>5 Jakarta</td><td>106</td><td>5 Ho Chi Mihn</td><td>790</td></tr><tr><td>6 Santiago</td><td>87</td><td>6 Delhi</td><td>752</td></tr><tr><td>7 Guangzhou</td><td>75</td><td>7 Riyadh</td><td>731</td></tr><tr><td>8 Sao Paulo</td><td>75</td><td>8 Bogota</td><td>717</td></tr><tr><td>9 Bogota</td><td>75</td><td>9 Jiddah</td><td>682</td></tr><tr><td>10 Moscow</td><td>73</td><td>10 Sao Paulo</td><td>677</td></tr><tr><td>11 Saint Petersburg</td><td>70</td><td>11 Bangkok</td><td>677</td></tr><tr><td>12 Bangkok</td><td>56</td><td>12 Bangalore</td><td>676</td></tr><tr><td>13 Hanoi</td><td>50</td><td>13 Taipei</td><td>604</td></tr><tr><td>14 Bucharest</td><td>50</td><td>14 Bucharest</td><td>593</td></tr><tr><td>15 Shanghai</td><td>49</td><td>15 Madras</td><td>576</td></tr><tr><td>16 Rio de Janeiro</td><td>49</td><td>16 Hyderabad</td><td>525</td></tr><tr><td>17 Ho Chi Mihn</td><td>40</td><td>17 Santiago</td><td>516</td></tr><tr><td>18 Rome</td><td>37</td><td>18 Kiev</td><td>467</td></tr><tr><td>19 Caracas</td><td>35</td><td>19 Jakarta</td><td>429</td></tr><tr><td>20 Shenzhen</td><td>32</td><td>20 Cairo</td><td>428</td></tr></tbody></table>

Then, we have used Geoplugin [11] which, in turn, employs the Maxmind database to obtain the geographical information associated to a particular IP address.

The main research question addressed in this paper is: “*Which cities in the world are responsible for most of the security incidents?*”. As detailed in Section 4, Seoul is the most dangerous city on the Internet, having 735 malicious hosts attacking Quaran-tainenet infrastructure. In addition, the results have shown that just one European city is among the top 20 most evil cities on the Internet, while 9 of the top 20 evil cities are located in Asia.

The main research question was followed by four sub-questions. The first one was if “*Are there cities that are relatively more ‘evil’ than others?*”. In this sub-question we take into account the number of inhabitants per city to determine how evil they are. We can conclude that there are indeed cities that are relatively more evil than other cities. For example, Seoul caused the highest absolute number of attacks. When the number of inhabitants is taken into account, Seoul ends up on the fifth position. The number of attacks per inhabitant is lower than for example in Taipei.

The next addressed subquestion was “*Are the cities where the most attacks originated located in the countries where the most attacks originated?*”. In our results, we have observed that most of the attackers are in China, Brazil and then in the U.S.. While only one European city is among the top 20 evil cities, 8 countries are among the top 20 most evil countries. The answer to this question is that there is little correlation between the most evil cities and most evil countries. This means that using a list of evil cities to finetune firewalls or filters would yield better results than using a list of countries.
The next sub-question investigated was “Is there much change over time in the list of top offenders?”. The top twenty of evil cities is pretty invariable. While lower on the list changes do occur over time (e.g. looking at different weeks or different days within a week), Seoul is (almost) always on top, followed by Taipei, Beijing, etc. This makes using the data easier, as there is no need to gather new data on a daily basis.

Finally, the last sub-question was if “Do the evil cities change according to the type of attack?”. To answer this question, we have compared the Quarantainenet database against the spam log files from two mail servers from the University of Twente for a period of one day. The answer to this question is that around 50% of the cities remain the same, independently from the type of attack. This suggests that geographical information from one type of attack might be used as input to other types of attacks.

As future work, we intend to improve our approach by using an online database for the number of inhabitants per city. In addition, we intend to conduct an evaluation over a longer period of data (a year) to observe how evil cities change according to time, if there is any sort of pattern. We also intend to perform the same analysis on different datasets. Finally, the next step is to find out if spam filters and/or firewalls can indeed be made more precise by utilizing information about evil cities. One way might be to automate the process of calculating the most dangerous cities over, for example, the last week. The data gathered from this could be incorporated into automated generating of spam rules.

**Acknowledgments** The authors would like to thank Quarantainenet B.V. for granting us access to their honeypot data, in special Casper Joost Eyckelhof. Also, many thanks to Marc Berenschot for his suggestions and contribution to this work.

## References

1. James A. Muir and Paul C. Van Oorschot. Internet geolocation: Evasion and counterevasion. *ACM Comput. Surv.*, 42:4:1–4:23, December 2009.

2. Hulu. Hulu - What your favorites. Anytime. For free. http://www.hulu.com, accessed on February 2011.

3. William E. Sobel and Bruce McCorkendale. Use of Geo-Location Data for Spam Detection. U.S. Patent #7,366,919 issued Apr. 29, 2008, filed 2003.

4. Akamai. The State of the Internet, 3rd Quarter, 2010. Technical report, Akamai. Available online at: http://www.akamai.com/stateoftheinternet/, accessed on February 2011.

5. Quarantainenet B.V. Virus attacks. http://quarantainenet.com/?language=en&page=inffections, accessed on February 2011.

6. Yu Jiang, Ni Zhang, and Binxing Fang. An email geographic Path-Based technique for spam filtering. In *2007 International Conference on Computational Intelligence and Security*, pages 750–753, 2007.

7. W. van Wanrooij and A. Pras. Filtering spam from bad neighborhoods. *International Journal of Network Management*, 20(6):433–444, November 2010.

8. Hideki Koike, Kazuhiro Ohno, and Kanba Koizumi. Visualizing cyber attacks using IP matrix. In *IEEE Workshops on Visualization for Computer Security*, volume 0, page 11, Los Alamitos, CA, USA, 2005. IEEE Computer Society.

9. Quarantainenet B.V. Quarantainenet. http://quarantainenet.com/, accessed on February 2011.
10. Microsoft. Computer Worms - Conficker — Microsoft Security. http://www.microsoft.com/security/pc-security/conficker.aspx, accessed on February 2011.

11. Geoplugin. Geoplugin. http://www.geoplugin.com, accessed on February 2011.

12. Maxmind. Maxmind. http://www.maxmind.com/, accessed on February 2011.

13. Maxmind. Geolite city accuracy. http://www.maxmind.com/app/geolite.city accuracy, accessed on February 2011.