Home / How it works
How BGP Ranking works
What the tool is for, the few notions you need, how the rank is computed and how to read each page.
1. What it is for
BGP Ranking answers one question: which networks of the Internet host the most malicious activity, relative to their size?
Every day, many organisations publish lists of IP addresses seen doing something malicious: scanning, brute-forcing SSH passwords, sending spam, hosting malware or controlling botnets. A list of IP addresses alone does not tell you which network is badly managed. BGP Ranking groups those addresses by the network that owns them and gives each network a score, every day, so you can compare networks and follow them over time.
It was created by CIRCL (the CERT of Luxembourg) and is developed within the D4 Project.
2. Three notions
The address of one machine on the Internet, e.g. 8.8.8.8. Think of it as a house.
A block of consecutive addresses, e.g. 8.8.8.0/24 (256 addresses). A street.
A network run by one organisation (ISP, hosting company, university…), identified by a number, e.g. AS15169 = Google. It owns several prefixes. A district.
BGP (Border Gateway Protocol) is how each AS tells the rest of the Internet “these prefixes are reachable through me”. It is what lets us know, for any IP address, which AS it belongs to on a given day.
3. Why divide by size
On the same day, imagine:
Network A — small hosting
1 000 IP addresses, 50 reported
5 % of the network
Network B — national ISP
10 000 000 IP addresses, 500 reported
0.005 % of the network
B has ten times more bad addresses, yet A is a thousand times worse in proportion. Counting addresses would always put the biggest networks on top; dividing by the size of the network shows where abuse is concentrated, which is what matters to decide whom to contact or what to watch.
4. How a rank is computed
Collect
Public lists of malicious IP addresses are fetched several times a day. Each list has a weight reflecting how reliable and severe it is (see section 10).
Map
Each IP address is matched with the prefix and the AS that announced it in BGP on that day (CAIDA data, through IP ASN History). Addresses announced by nobody (AS0) are ignored.
Rank
For each list, the malicious IPs of an AS are multiplied by the list weight and divided by the number of IPs the AS announces. The ranks obtained for every list are added up.
The global rank of an AS is the sum of its ranks over all lists. Choosing sources in the filters recomputes it with those lists only. IPv4 and IPv6 are ranked separately. The ranking runs every hour for the current day.
5. Reading a rank
- 0Nothing from this network appeared in the selected lists that day.
- smallA few reported addresses compared with the size of the network (most large ISPs).
- highA large share of the network is reported: abuse is concentrated there, or the network is very small.
Ranks have no unit and no upper limit: compare them with each other (same day, same IP version, same sources) rather than reading them in absolute terms. On a chart, a peak usually means a campaign or a compromised machine; a high, flat line means abuse that lasts.
IPv6 ranks look tiny (around 10-18) because an IPv6 network contains astronomically many addresses; charts then show values multiplied by a power of ten, written on the axis (e.g. “×10-18”).
6. Who uses it
| Who | Their question | Where to look |
|---|---|---|
| A CERT / CSIRT | Which networks are problematic right now? Whom should we notify? | Ranking |
| A SOC analyst with a suspicious IP in the logs | Who owns this address? Is that network known for abuse? | IP lookup, then the AS page |
| An ISP or hosting company | How does our own network score? Since when is it getting worse? | The page of their AS |
| A researcher or policy maker | How do countries compare and evolve? | Countries |
7. The pages
Ranking
The most malicious ASes of the selected day, worst first. Click an AS to open its page.
AS page
Its rank over time, the prefixes involved on the selected day, the exact IP addresses of a prefix with the lists that reported them, and the history of its name. Open it by searching an AS number.
IP lookup
Which AS and prefix announced an IP over the last 60 days. It tells you who owns the address, not whether it is malicious: open the AS to see its reputation.
How is this country doing?Countries
The combined rank of all the ASes of one or more countries, and which of their ASes had activity. Large countries take time: the server ranks thousands of ASes for each day.
Filters
- Date — the day to look at. Lists are collected during the day, so the most recent day may still be incomplete; the default is yesterday.
- IPv4 / IPv6 — the two address families are ranked separately.
- Sources — count only some lists, e.g. only SSH brute-force lists to focus on one kind of abuse.
- Search — type an AS number (
5577orAS5577) to open its page, or an IP address / prefix to look it up.
8. A typical investigation
- A suspicious address shows up in your firewall logs:
203.0.113.42. - Paste it in the search field: IP lookup shows it is announced by, say, AS64500.
- Open AS64500: its rank has been high for weeks and several of its prefixes appear, so the network hosts abuse on a regular basis.
- Click the prefix that contains your address: the list of reported IPs tells you whether this exact machine was already reported, and by which lists.
- Decide: block the prefix, raise the alert level, or contact the network's abuse desk.
9. Limits — read this before drawing conclusions
- A rank is not proof of guilt. It says “a lot of activity from this network was reported”, not “this organisation is criminal”.
- Legitimate scanners rank high. Research projects that scan the whole Internet (Shadowserver, internet measurement projects…) are reported by scanner lists, so they often appear near the top.
- Very small networks are sensitive: a handful of compromised machines is enough to give them a high rank.
- It depends on the lists. Activity that no list reports is invisible, and a list that stops publishing makes ranks drop.
- Shared infrastructure: on cloud or hosting networks, one customer's machine can pull the whole network up.
10. Lists and weights
The weight says how much an address reported by a list counts. Reliable lists of confirmed malware infrastructure weigh more than broad lists of scanners.
| List | Weight |
|---|---|
| abuse.ch SSL blacklist | 7 |
| blocklist.de strong IPs | 6 |
| abuse.ch ThreatFox | 5 |
| Feodo Tracker | 5 |
| Emerging Threats compromised | 5 |
| CI Army | 5 |
| malc0de | 5 |
| Malware Domain List | 5 |
| Clean MX (malware, phishing, portals) | 5 |
| blocklist.de bots / FTP / IMAP / SIP / SSH | 3 |
| GreenSnow | 3 |
| CoinBlockerLists (mining servers) | 3 |
| bsdly POP3 gropers | 3 |
| DShield top IPs | 1 |
| blocklist.de Apache / mail | 0.1 |
| DShield daily sources | 0.1 |
| AlienVault reputation | 0.01 |
Source: the impact value of each module in config/modules/.
11. FAQ
The ranking is empty for today, is it broken?
No. The lists are collected and ranked during the day; pick an earlier date with the Date filter.
Why is IPv6 empty or so small?
Few lists report IPv6 addresses, and IPv6 networks are huge, so ranks are tiny. The chart shows the scale on its axis.
What does AS0 mean in IP lookup?
That nobody announced the address in BGP at that time: it was not reachable on the Internet.
Why does the country page take so long?
A country's rank is the sum of all its ASes. For a large country the server ranks thousands of ASes for each of the 30 days.
An AS has no prefixes listed although its rank is above 0.
Prefixes are listed for the selected day only; the rank chart covers many days. Change the date to a day with a peak.