Last year, we tracked millions of IPs scanning the internet.
But it all began with just one.
1.0.149.29
1.0.149.29 is an IP address in TOT Public Company Limited's network (AS23969), geo-attributed
to Thailand (in theory at the location in the map). It's an ISP, so this IP address is likely a residential
IP, and it likely has one or more compromised devices in it.
But, physical geo-location is only one (bad) way to "map" IP addreses.
Since IPv4 addresses are just integers (1.0.149.29 is 16815389), we can use
special
space-filing curves
(called Hilbert curves) to map them into two-dimensional space.
Here's where 1.0.149.29 is on the Hilbert map
Oh, that's right. Each pixel on a Hilbert curve is a full "/24" network block (what you likely
use inside your home's network). So, with only one IP address on the map, it's virtually invisible.
Here's where 1.0.149.29 is on the Hilbert map, isolated to the "/8" network its
"/24" resides in. It's still mostly invisible, but at least we have a frame of reference for it,
now.
Let's take a look at all the IPs that touched a GreyNoise sensor on January 1, 2025.
271,929 unique IPs were tagged this day. Many more were observed, but we know what these IPs were
doing, so we'll focus on just tagged IPs from now on.
Let's take a look at all the unique tagged IPs across the first full week of January 2025.
1,231,725 unique IPs were tagged this week. So the mean is around ~176K unique IPs-per-week.
Where were we at month's end?
By month's end, we're at 4,111,424! But, this doesn't necessarily mean there are ~4 million "bad"
IP addresses.
In many regions of the world, home routers (like yours) get assigned new IP addresses very frequently. So, one infected device in a given home may touch a GreyNoise sensor with a different IP addres every hour, day, week, etc.
Still, the internet is obviously not a very safe place.
I wonder how bad it was at mid-year?
By the end of June, we had accumulated 12,832,438 unique IP addresses! That's ~2.14 million
unique IPs per-month.
Clearly, we have some repeat offenders.
I wonder if this trend continued all year?
By December, we had catalogued 20,685,174 unique IPs. Not quite double, but there was a short
"burst" in the curve in August before things settled down again.
This is legend for these heatmaps. Since we're mostly seeing gold/yellow on the Hilbert map, that means only a fraction of some (most) network blocks are talking to random IP addresses (ours) on the internet.
Thanks for exploring the data!
Made with pure css-scroll-timeline.
Stamen Toner Maps by Stadia Maps
IPv4 Hilbert Heatmaps made with
https:/rust-ipv4-heatmap
Covered in the 2026-01-05 Daily Drop