Is Your Network Secretly Polluted? #cybersecurity #ipv6 #ipv4

Why It Matters

Continuous, globally distributed attack traffic erodes IPv4 address reputation and can disrupt services, making coordinated mitigation vital for businesses and internet stability.

Key Takeaways

• Global honey farm recorded 1,000 attacks in 114 seconds.
• Attack traffic is bursty, targeting open IPv4 ports worldwide.
• Campaigns like Vault Typhoon and Marai exploit IoT vulnerabilities.
• Pollution index shows attack density per country normalized by population.
• Leased IPv4 space can inherit “dirty” reputation and blocklisting.

Summary

Leslie Dagel, CTO of the Global Cyber Alliance, presented data from the organization’s global honey farm – a network of 200 sensors that capture malicious traffic targeting open IPv4 ports. Since 2018 the farm has logged billions of probes, and in a recent 114‑second window it recorded over 1,000 distinct attacks, illustrating how pervasive and continuous the threat landscape is.

The analysis highlighted bursty attack spikes, with TNET and SSH accounting for the majority of traffic. Multiple autonomous systems (ASes) generate background radiation, while coordinated campaigns such as Vault Typhoon and Marai exploit unpatched IoT devices, routers, and cameras. A newly published “pollution index” visualizes attack volume per country, normalized by population, revealing hotspots and the sheer scale – over 3,400 ASes and millions of individual IPs involved.

Dagel used vivid analogies, calling the unwanted traffic “microplastics” that contaminate the internet ecosystem. Notable examples include a surge of Chinese‑origin attacks on a Taiwanese sensor during the Vault Typhoon campaign and a single AS launching more than two million attacks. Even network service providers were implicated, with 6,778 IPs from that sector participating in the assault.

The implications are clear: persistent attack traffic degrades the reputation of IPv4 address blocks, leading to blocklisting and potential service disruption for businesses, especially cloud providers. Dagel urged industry collaboration to establish norms that curb pollution at the source, emphasizing that collective action is essential to protect IP value and maintain a functional internet.

Original Description

RIPE Community Presentation #networksecurity #ipv6

What if your network is quietly contributing to hidden attack traffic?

In this RIPE 90 talk, Leslie Daigle introduces Internet Pollution, unwanted traffic that spreads across the Internet and can damage IP reputation, even when it goes unnoticed.

Using attack data and real-world observations, this talk explores how the Internet community can work together to identify and reduce this invisible pollution.

06:35 Specific attack campaigns

09:20 The influence of the volt typhoon campaign

13:55 Conclusion

#InternetPollution #Cybersecurity #NetworkSecurity #RIPE90