The map belows shows the approximate geographic locations of Internet Relay Chat (IRC) Command and Control, (C&C), servers currently monitored by Team Cymru, represented by the green circles. This data is updated on an hourly basis, and is displayed in a loop, automatically reloaded each time all of the C&C locations have been shown. The relative size of each dot is an indicator of how many C&Cs are being monitored in that area.
IRC is a legitimate chat protocol used by many on the Internet to communicate with friends and colleagues around the world, discussing an almost limitless number of topics. Unfortunately, it is also mis-used by online miscreants to coordinate their activities. IRC is one of the many media used to transact business in the Underground Economy. It is also used, as depicted in this map, as a command and control mechanism for botnets, networks of computers infected with malware. The servers depicted in this map are being used to control these infected computers, collecting unknowing users' bank logins, credit card data, and other personal information, as well as launching Distributed Denial of Service (DDoS) attacks against anyone who runs afoul of the miscreant who controls the botnet (or whom the miscreant has been paid to attack).
If you believe you may have already been targeted or fallen victim to an Internet crime, ourinvestigations wing may be able to use our insight to help bring the responsible parties to justice. Contact us to find out more about this and other ways we might be able to help you secure your network!
Please note that the locations shown are approximated using IP geolocation technology - this is by no means a perfect approximation, and if a higher level of detail than the country of the IP address is not known, the IP may be shown at the geographic center of that country, which may be significantly different from the actual location of the activity taking place.