5 comments

[ 2.0 ms ] story [ 22.3 ms ] thread
The submitted title [1] was upworthyesque linkbait, so we cribbed the title from the previous submission of this url [2].

1. "This Site Shows Who Is Hacking Who Right Now – And The US Is Getting Hammered"

2. https://news.ycombinator.com/item?id=7943681

This is pretty interesting to watch. It reminds me of an RTS, especially when there are large bursts of attacks.
So they're just monitoring honeypots right? I can't think of any other way to do this real-time.
They scan every single IP every second.
"Every second, Norse collects and analyzes live threat intelligence from darknets in hundreds of locations in over 40 countries. The attacks shown are based on a small subset of live flows against the Norse honeypot infrastructure, representing actual worldwide cyber attacks by bad actors. At a glance, one can see which countries are aggressors or targets at the moment, using which type of attacks (services-ports)."