— Created: Xiaoke, 2017/06/05 17:57 CST
— Last modified: Xiaoke, 2017/06/13 09:39 CST

Recently I found my server was under constantly break-in attempts of the root account. After blocking failed log-in attempts for only a couple of days, the list of blocked IP addresses grew to hundreds. I was curious about the geographical distribution of the IP addresses, so I downloaded the list and used the following tools.

On GitHub, PyGeoIpMap gained quite a lot of stars for plotting the location of IP addresses on a world map. This tool is fairly easy to use, and a simple example is

 python3 pygeoipmap.py –i iplist 

Make sure the iplist file contains only an IP address on each line.

In order to use the PyGeoIpMap script, we need to install python dependencies of numpy, matplotlib, Basemap, pygeoip, as listed on the github page. Among them, the installation of Basemap was not straightforward on macOS.

• First install geos by

   brew install geos 

• Then install Basemap. Direct installation through pip gave an error message of Could not find any downloads that satisfy the requirement. A workaround is to find the basemap information page on pypi, follow the download link on the page to download the tarball. Then install basemap from the tarball by

  pip install basemap-1.0.7.tar.gz 

Then we'll be able to run the plotting script.

The following figure shows the distribution of the IP addresses.