WHAT’S NICTER ?

Incident analysis center NICTER (Network Incident analysis Center for Tactical Emergency Response) is an integration of large-scale networking monitoring and analysis of cyber threats such as botnet or DDoS. Since 2005, NICTER has collaborated with numerous organizations both in Japan and overseas to distribute sensors to monitor darknet in real-time. A darknet is a set of globally announced unused IP addresses. Because there is no computer connected to the darknet, communication (packets) should not actually arrive under the normal usage of the internet. However, in reality, a large amount of packets arrives darknet: scan packets from a computer infected with malware searching for the next infection destination, spoofed packets bouncing back from a server to darknet (called backscatter), or internet-wide scan packets from those research organizations collecting data about internet-connected hosts and their open ports or services running etc. Observing and analysing such network traffic arriving at darknet guide us to the identification of new threats or unknown behavior of botnets which is one of the mission of NICTER's darknet observation.

Atlas

In Atlas, packets that reach the darknet are animated on the world map based on country, port numbers, and protocol information associated with the source and destination IP addresses.

Cube

Cube visualizes packets arriving at NICTER's darknet in a three-dimensional space, based on information about its source and destination IP address.
 

Stats visualizes time series data of NICTER's darknet traffic (hosts and packets) in a specified period and unit time (5 minutes, 1 hour, 1 day).

In the top 10 list, you can display the top 10 countriese and ports for the specified day. You can go back up to 3 months.
Date of 2025/05/12

Number of unique hosts by country

country Hosts Percentage
China(CN) 71,301
 
38%
India(IN) 18,409
 
10%
United States(US) 14,919
 
8%
Russian Federation(RU) 7,450
 
4%
Iran (Islamic Republic Of)(IR) 7,011
 
4%
Republic of Korea(KR) 6,803
 
4%
Viet Nam(VN) 3,503
 
2%
Taiwan(TW) 3,349
 
2%
Brazil(BR) 3,252
 
2%
Egypt(EG) 2,941
 
2%

Number of unique hosts by TCP dst port

Dst Port Hosts Percentage
23 45,403
 
1%
80 41,863
 
1%
445 24,996
 
< 1%
8080 24,934
 
< 1%
81 20,406
 
< 1%
83 17,404
 
< 1%
82 15,744
 
< 1%
85 15,051
 
< 1%
2323 10,640
 
< 1%
22 9,593
 
< 1%

Number of unique hosts by UDP dst port

Dst Port Hosts Percentage
56089 4,098
 
1%
5353 3,937
 
1%
47808 3,530
 
< 1%
6881 3,278
 
< 1%
1900 3,096
 
< 1%
50798 2,739
 
< 1%
5060 2,675
 
< 1%
6969 2,638
 
< 1%
5632 2,569
 
< 1%
161 2,523
 
< 1%

Number of packets by country

Packets Percentage
United States(US) 41,613,311
 
43%
Bulgaria(BG) 7,781,548
 
8%
Canada(CA) 7,592,257
 
8%
Cyprus(CY) 5,780,724
 
6%
China(CN) 5,322,474
 
5%
Germany(DE) 4,134,611
 
4%
Great Britain(United Kingdom)(GB) 3,804,892
 
4%
Seychelles(SC) 3,587,430
 
4%
France(FR) 2,360,934
 
2%
Lithuania(LT) 1,615,796
 
2%

Number of packets by TCP dst port

Dst Port Packets Percentage
8728 2,972,767
 
4%
23 2,759,551
 
3%
80 2,229,955
 
3%
22 1,488,860
 
2%
5555 1,222,466
 
1%
8080 1,092,758
 
1%
81 1,025,389
 
1%
443 974,946
 
1%
2222 689,662
 
1%
445 680,831
 
1%

Number of packets by UDP dst port

Dst Port Packets Percentage
5060 734,506
 
6%
53 504,174
 
4%
123 393,553
 
3%
1900 192,859
 
2%
389 183,769
 
1%
161 178,398
 
1%
1434 152,881
 
1%
9034 150,163
 
1%
5683 149,818
 
1%
5353 131,727
 
1%

Copyright © National Institute of Information and Communications Technology. All Rights Reserved.