These graphs are a count of all the network scans into routed CIDR blocks that occur from the botnets that we are aware of. If a scan were to probe a /16 of a CIDR block, but that block was routed on the internet as 128 /24's and 64 /23's, we count that as 192 scans not as one. Note that the smallest CIDR block that we count is a /24. NOTE: This is MOST of the nets that we are monitoring.
These reports are updated every 15 minutes.