Hackers have published a research paper detailing how they built a 420,000-node botnet resulting in an impressive map of the Internet over a 24-hour period.
‘Carna Botnet’ was created by hacking into almost half a million unprotected computers. The map shows where people are logging in and the changes in traffic patterns around the world. The abstract for the ‘Internet Census 2012‘ reads:
While playing around with the Nmap Scripting Engine (NSE) we discovered an amazing number of open embedded devices on the Internet. Many of them are based on Linux and allow login to standard BusyBox with empty or default credentials. We used these devices to build a distributed port scanner to scan all IPv4 addresses. These scans include service probes for the most common ports, ICMP ping, reverse DNS and SYN scans. We analyzed some of the data to get an estimation of the IP address usage. All data gathered during our research is released into the public domain for further study.
The GIF below shows a world map of 24 hour relative average utilization of IPv4 addresses observed using ICMP ping requests: